Latest / Identity at the Center / #220 - IAM Evolution Continuum with Martin Kuppinger of KuppingerCole Analysts AG

Transcript

#220 - IAM Evolution Continuum with Martin Kuppinger of KuppingerCole Analysts AG · Identity at the Center

0:05
This is identity at the center. If it has anything to do with I
0:10
am this is the go-to podcast. Now your hosts Jim McDonald and
0:18
Jeff Steadman. Welcome to the identity of the
0:22
center podcast. I'm Jeff.
0:23
And that's Jim. Hey, Jim.
0:24
Hey, Jeff, how are you? Oh, not so bad yourself.
0:28
I'm good. I've been wondering.
0:30
Are you excited for your trip to London which starts early next
0:33
week? Yeah.
0:35
So recording this one advance. I figure when this one's going
0:38
to go live think, probably July 3rd.
0:40
So I will have returned from one at that point.
0:43
But kicked out in the fourth wall today is June 15th as we
0:46
record this. So I have not even thought about
0:50
London. Yet, I just want to get to the
0:52
next two days and get through this week and kind of get
0:54
things, you know, buttoned up. And then I will start to think
0:57
about it but yeah, it is getting close.
0:59
So I'm looking forward to that. Hopefully be able to connect to
1:01
some people in that area and dementia.
1:04
May be meeting up with Andy for 40 or putting a pub crawl or
1:08
something like that. So we'll seeing crumpets tea and
1:11
crumpets. So I have not been to London
1:13
proper ever. So it'll be my first time
1:16
visiting the city but yeah, we'll get that.
1:18
I will be looking forward to it after I get The next two days.
1:22
Well, I know you're going for the, the Cubs and Cardinals
1:25
game. And you remember, the question I
1:27
asked you, the first time I met, you, do you like baseball?
1:29
You said, no. But you like it enough to go.
1:33
There you like two Cubs and actually, the Cubs are doing
1:36
pretty decent this year. Are they the Cardinals?
1:39
Well, the car driving catch up on it.
1:41
Cardinals are one of the worst teams in baseball and they've
1:43
got a great, some big-name players.
1:45
So if you had a chance to see a Cubs win, yeah, hopefully to
1:48
apply that fly. The Big Apple WI.
1:50
Out there and go for it. So yeah, I'm not much of a
1:53
baseball fan but the Cubs are my team.
1:56
And yeah, this is a makeup from a pandemic trip.
1:59
That we were planning all fears back at this point.
2:01
So this is when it got rescheduled and so we're we're
2:04
making the trip out there to see that and do other things so
2:08
yeah, I'll be good time. So look I so I said I will be
2:10
looking forward to it after I get the next two days.
2:14
So we're recording an intro. Today, I recorded with Martin
2:17
grouping or yesterday he's been on the show in the Has he was on
2:22
episode 106 where he gave us his origin story, how it got into.
2:26
I am sitting ask that question again, as per our tradition is
2:30
also an episode 194 and then so this will be episode.
2:34
What? 220, yeah.
2:37
Number 220. Yeah, the hits just keep on
2:41
coming baby. They sure do.
2:43
So yeah, unfortunately had a late-breaking meeting and just
2:47
to prove that the podcast is not our full-time job.
2:50
I needed to address business first so you were able to have a
2:54
conversation so so that's good. Let's see before we get to that
2:58
conversation. Well why don't you tease?
3:00
I guess a little bit because I have not listened to it yet.
3:02
I'm going to listen to it. Obviously while I'm doing the
3:04
edit for this show but what you guys talk about.
3:08
Yeah, so we talked about the EI C, which is the European
3:11
identity and Cloud conference which is hosted in Berlin.
3:16
I got to watch a lot of that as it was happening from LinkedIn.
3:20
Gavin and having that fomo or not from, I guess I would be
3:24
fear of missing out. I was just in regret not being
3:27
there, really wasn't anything there, but Martin gives kind of
3:31
the highlights of that. Then we just kind of, like I
3:35
pick his brain. I mean, you know, he's one of
3:37
the big brains in our industry. So, went through some various
3:41
topics, got his perspective. On them also went through a
3:45
lightning around because we don't want to have two hour-long
3:49
episodes. And Kind of the the same thing
3:52
that I ask them a little bit more on.
3:53
What's up coming for cooping or coal terms of additional
3:58
conferences in terms of leadership compasses?
4:03
Which is the name of their kind of their market analysis
4:07
reports? And I also ask them some
4:09
questions about like the development of those reports and
4:13
you know what, what makes a good report?
4:15
What do you tell people who are new analysts working for your
4:18
firm that you're looking for out of out of the Report and then
4:22
kind of for a lighter note. You know, we always have to
4:26
finish with a little bit of a lighter note.
4:28
Okay. Now which I think you guys talk
4:30
about social media or is it something else?
4:32
No, it was it was social media. I mean because I want to get
4:35
Martin's perspective on. How does he use social media?
4:39
Use a LinkedIn guy? I don't know him, I wouldn't
4:42
have known. If he did have some Community
4:44
outside of like damn that's pretty much all I use but he's
4:47
pretty prolific on LinkedIn and you know I've recommended Ended,
4:51
you know going out there and following him and then he kind
4:54
of gives us his perspective on what he shares.
4:57
Hmm. Okay well why don't we get that
5:00
conversation before we do that though just to remind people you
5:03
and I are going to be the authenticate conference which is
5:05
the next thing that identity is Center will officially be out
5:07
where the official podcast for authenticate 2023 which is very
5:11
cool. I think that's I think that's
5:12
the first time we can say that is that this is the first time
5:15
we're in official anything for anything, right?
5:18
Exactly. That's true.
5:20
And The authenticate conferences, the Fido Alliance
5:23
Conference Finals, like, blistering hot.
5:26
You know, one of the things I realized that I Denver's is, you
5:29
know, kind of came to the conclusion that everybody's in
5:32
favor of what they do. And actually that was the topic
5:34
I've come up with with Martin is like everybody seems to be in
5:37
favor of this. What's your perspective?
5:39
So he shares that but yeah, it's going to be a great conference
5:43
brings together. A lot of the big mines in our
5:46
industry and I This one of the topics we get into which is
5:54
digital identity versus identity access management and I think I
5:57
didn T access management was the core the digital identity starts
6:01
to get into a lot of these expending topics.
6:05
You see a lot of those conversations happening at the
6:08
fight Alliance authenticate conference.
6:11
That's a great conference, gotten bigger and better every
6:13
year, this we should be the biggest and best so far.
6:16
It's in Carlsbad California, which is just North of San
6:18
Diego. It's October 16. 18th and we
6:22
were able to score a discount code for our listeners or
6:25
anybody who really finds out about it, Kitty's it.
6:27
But the code is idac 15 podcast. So we'll have a link in our show
6:33
notes for people to check that out.
6:34
That's a great way to support the show.
6:36
It's a great conference. It's a lot of fun, a lot of
6:38
really smart people be there and it's I would say it's a more
6:40
technically focused conference special round of medication.
6:43
So if that is, you know, your jam come on out there and see
6:49
how use our code and, you know, No, let us know so we can give
6:52
you a fist bumps of gratitude when you show up there.
6:55
So anything else or should we get to your conversation with
6:58
Martin? I think we should get to it.
7:00
Okay, let's do it. Here it is.
7:08
Good evening, Martin. How are you tonight?
7:11
Ducks, I had a bit of a long travel into a sort of east of
7:15
Munich today, but the usual stuff was to turn right away.
7:22
So we're you driving everything else.
7:25
All these things that are happening right now and then
7:28
travel right away, but I arrived from so it's fine.
7:32
I think there's this conception that in Germany, you have the
7:36
Autobahn, right? So if you drive from place to
7:38
place you get on the Autobahn, no speed limit and everybody's
7:42
driving, you know, 200 kilometers an hour is that the
7:46
way it is. So I try to avoid driving but I
7:50
can take the train even while they are.
7:52
Sometimes some bumpy things was to tell me right away, but at
7:56
the end of the day, you know, driving means a lot of cues.
8:02
And the times and routes where you really can speed are
8:08
relatively rare. And at the end of the bar, for
8:11
certain level of speed is really became becomes dangerous.
8:14
And so I really attempted to take the more relaxed train
8:18
travel where you can read where you can work where you can
8:22
relax, I believe it's more convenient.
8:28
So great, you know. I don't trust last week and I
8:33
came back from France and you're traveling rather relaxed for
8:38
whatever 8 or 9 hours or so through France.
8:42
Then you come to Germany and the traffic is way more dense.
8:47
It's not very well flowing when there's a terrific is 10 so then
8:54
so then people are trying to trash that they have to stop
8:58
again and Cetera you end up in queueing.
9:01
So we spend 45 minutes in a queue.
9:04
We didn't have a have any traffic chairman in France, for
9:07
the time. So I think that the fun of
9:11
driving having trouble is massively overrated from an
9:15
outside perspective that leads to my opinion.
9:19
I probably get a lot of negative feedback right out from all the
9:22
ones with me to just broadcast it.
9:24
Our interests lastic drivers. But as I've said, I'm, I'm more
9:29
the Public public transport side, which is very good over
9:32
here. I like taking the train as well.
9:35
You also see the world, enjoy it a little bit and get some work
9:40
done. Like you said, so we are
9:42
Recording this episode in the month of June, it's going to
9:47
drop on July the 3rd, but in the month of May in Berlin, you held
9:54
the EIC which is the European identity and Cloud conference,
9:59
right? It looked like an amazing event.
10:02
I was kind of following along in my LinkedIn feed definitely
10:06
regret missing it. Unfortunately, it's, you know,
10:10
we can only make it to so many conferences per year and the
10:14
travel from the u.s. to Europe is kind of was prohibited for us
10:18
this year. Hopefully, next year, we can
10:20
make it. Can you give me some of the
10:23
highlights from the conference? What was what was it like?
10:27
Yeah. So first it was the biggest yes
10:30
you ever. So we had so many people this
10:33
here way more than in the previous years also.
10:38
A lot of people trying in virtually we had in on the first
10:44
day we had a workshop where we really looked up.
10:47
So to speak all the different elements and how to sort of
10:51
Select what you need identity management.
10:53
And so we were three from our clinical team, MLS team doing
10:59
the drugs from and I spent more less the entire four hours just
11:03
responding to questions because we had I think 60 or 70 or 80
11:07
online questions which Never experienced an in any of these
11:11
events. There was a really huge
11:13
engagement. I learned that we had some 400
11:15
people, so 100 something in your room and 300 or so training
11:22
virtually for this Workshop. So we added a huge audience and
11:25
I think it was a cool thing at this conference because there's
11:28
a lot of interaction, a lot of discussion aside of all the
11:32
panels and presentations and Keynotes, and topic wise, I
11:37
think what Of the hot things. Definitely was decent her
11:40
identity and more to practical use case for another.
11:45
So, how to make this work. So I spent some time for
11:47
instance, talking about really Enterprise, use cases, and the
11:52
value of decentralized. Identify the Enterprise, I
11:55
believe you can do a lot of things better in aichi, a for
11:58
instance, in onboarding process. But also when we didn't add,
12:01
this was another important topic.
12:03
Let me comb or to policy-based access them, then all these
12:07
these we seized or Proofs is verifiable trenches or cold.
12:11
They can, they are in fact attributes for a position.
12:14
We can use some policies. I think this is this is a pretty
12:18
pretty cool thing. So these are some of the topics
12:21
that were very hot but it's usually I see there's a good mix
12:24
between really fundamentals of identity management up to the
12:30
very future looking topics. So we don't try to cover the
12:35
entire range. What is your like average level
12:41
of experience for your guests? Who attend the conference?
12:44
Are they people who are new to the industry couple years, or
12:48
they people who've been in the industry for a long time.
12:52
I think it's increasingly more about worse.
12:56
So in the, in the early years there, so we are running EIC
13:01
since 2007. So in the early years it was
13:03
really erratic relatively small group of us.
13:07
Entity professionals that crew. But in the, I would say, the
13:12
past two years after the pandemic.
13:14
I've seen so many people. I've met so many people, I've
13:17
never met before. The are really new to the
13:19
industry that quickly come with some experience or from other
13:25
markets from other areas, come from cybersecurity, come from
13:29
other it areas or that our young people that are entering the
13:33
market. So it really has changed.
13:37
So it's not to trust the old IJ people, that have been whatever
13:42
already working with son, identity manager.
13:45
But really, it's a very, very mixed and very heterogeneous,
13:49
very diverse group know, it's interesting.
13:52
Tell me a little bit about the expo, hall, the vendor Hall.
13:56
I always feel like a conferences, that's such a great
13:58
area to catch up with people and rekindle old relationships, and
14:04
make new relationships. Yeah.
14:07
So what we do is we don't have a, we have an act for all.
14:11
We don't have an expo hall. So what we don't have is we
14:14
don't have this Hall, which is segregated from the rest.
14:18
But for instance, in the the boozes they are in the area
14:24
where you also pick your food. So sure, get breaks.
14:27
There's there's a you a lot of interactions of people are
14:31
around the different bruises etcetera and I think this is
14:34
something which we Means that there's always plenty of
14:40
opportunity to talk with mr. Wenders, without extra walking
14:45
into separate halt halt, that are maybe even bigger way, so
14:49
that it's very cozy in that sense so to speak.
14:54
And so, I think this is something which is a bit
14:58
different than for several other conferences.
15:00
I've been out in the past. So in terms of speakers at the
15:05
conference did you have mostly Cooper Miracle analysts or were
15:11
there other people who were also speakers that at different
15:16
things? And you know thinking of some of
15:18
the past analysts who have been on our show includes Paul Fisher
15:23
and John Tolbert. Were those folks, they're
15:26
presenting on their areas of expertise and then did you have
15:30
other people from the outside? As that JD I see is not a
15:35
catalyst only conference, which is a few others talking.
15:40
So we always try to have a very good mix between analyst analyst
15:46
presenting. But also analyst participating
15:49
in perils endless are frequently, the moderators so
15:52
that they can moderate. Real is with a big or strong
15:57
knowledge about what they are moderating.
16:00
But we also actually have to dispense Kino, it's we have a
16:05
lot of panels with industry experts and I think, when you
16:09
look at who were all speaking them, many many of the, the
16:14
well-known industry experts are there, both from web to vendor
16:17
side. But also, from the end user
16:19
side, we have we have end-user presentations or best practices.
16:23
A lot where people talk about what they experienced in making
16:27
things work. So I think we have a really
16:29
broad mix of different different Topics.
16:33
And then we have a couple of tracks always running in
16:36
parallel. So a lot of choice between
16:38
different types of sessions. Yeah, I really like going to
16:42
panel sessions because I know personally, I prefer to
16:46
participate in a panel rather than be up in be a solo speaker.
16:51
I think it invites more, people who would not speak to get up
16:56
there and share their opinions which kind of leads into the
17:00
next question I had for you, which was You know was there
17:03
anything that you learned or heard that you didn't know or
17:07
maybe challenge some existing belief that you held going into
17:12
the conference? Yeah that's always a good
17:16
question. So I think I'm still learning on
17:18
everything around. He seemed relaxed identity
17:20
because it's so much and flow. So this is definitely one of the
17:24
areas where I see it is continuously evolving given
17:29
that. I spent some time in what rating
17:31
the identity fat Prix track. This truly was a bit more about
17:37
the sort of the fondant foundational aspects where I'm,
17:42
I'm relatively familiar with but I think that where we all I
17:52
think to learn a lot of sand where I tried also to educated
17:55
but there's some salt is there on the potential for
17:59
policy-based Access, which is for my perspective, her
18:03
Definitely a very critical area of a very huge potential, but we
18:10
also saw, what was definitely some discussion around the
18:15
upcoming. Yeah, I'd us 2.0 regulation in
18:19
Europe. So which is about the
18:21
interoperability of Eid within Europe and potentially Beyond
18:25
which also relates into EU wallet.
18:28
Projects are as links to these gender identity aspects.
18:31
This is really one of these areas which I will further
18:36
analyze from where I've been one of those subject.
18:40
I will definitely take a closer look at this everything around
18:44
shared signals which goes a bit into which is somewhere between
18:49
identity and cyber security. So they were so many topics and
18:55
I still I think have a quite quite a list of things I'd like
18:57
to to cover in the some of my LinkedIn posts and blog posts
19:02
within the next Couple of weeks a month.
19:05
Yeah. So I would definitely recommend
19:07
that anybody who's not following Martin right now on LinkedIn.
19:10
It's something I would recommend to do.
19:15
Thank you. You know, Martin, I wanted to
19:20
bring up a couple of Hot Topics in the identity space.
19:23
Really get your impression or your, your current thinking on
19:28
them. And what I really want to know
19:30
is there some of these things Revolution?
19:32
Terry or evolutionary and you're starting from the premise that
19:38
the identity access management space or digital identity is I
19:43
think people are calling it more.
19:44
Now, these days we had access management, we had identity
19:49
management, which later became identity.
19:52
Governance, we had proved privileged access management but
19:56
now there's all these new areas and I want to know, you know
20:00
what your thoughts are on specifically Some of these areas
20:04
whether you think they're going to have a Major Impact or
20:06
they're going to kind of fade away.
20:10
So the first item I like that, what you said I am versus
20:15
digital ID because I think digital ID is just a broader
20:19
term. It covers more than the
20:21
traditional identity and access management so it's a digital ID
20:26
looks at all types of identities looks at new use cases.
20:29
A lot of things around decentralized identity and I
20:33
think there is also reason why we see so many new people into
20:36
space because it's growing well beyond the traditional, I do
20:42
them. Tray ml trying to move over,
20:45
never workflow and a bit of role management stuff.
20:48
I totally agree. I feel like the space is
20:52
evolving. The name had to evolve to be
20:55
more compassing of the space and things that are coming up.
20:59
And the first one I'm going to bring up, I think is a perfect
21:01
example of this. So which is this concept around
21:04
decentralized or user-centric identity self Sovereign, I'd
21:09
give you whatever you want to call it and wallets.
21:12
Game Changer or not. And are we looking at this
21:16
actually you know, coming to fruition that everybody kind of
21:19
starts to feel it within the next few years.
21:23
Yeah it's definitely more revolutionary side.
21:28
I talked a lot about especially when I talked about the
21:31
Enterprise use case and I said in some way it's disruptive, but
21:35
it's also not disruptive it's disruptive.
21:37
In the sense that it enables us to do a lot of things better and
21:40
a lot of news things we couldn't do so far and I think there will
21:47
be a lot of things that we don't have on the radar yet or most
21:52
have don't have on the radar yet.
21:54
So truly go beyond his time in scope of today's call but many
22:00
years ago probably 10 12 years ago we talked about something we
22:04
called life management platforms.
22:06
Which was an idea, a concept that would allow someone to keep
22:10
all the relevant things. Like whatever their to pay
22:18
salary statements insurance contracts and whatever else
22:22
somewhere in the the web and control access to that, I
22:26
believe, with decentralised identity, we can finally realize
22:30
such models, which allows us typically different way of
22:34
interaction the internet. So there's a huge disruptive
22:38
potential but it's also non-disruptive.
22:42
If so, a decentralized identity, doesn't break the fact that a
22:47
retailer has a system of records that they have their own
22:51
back-end systems, at the end of the day, it still means there's
22:54
Marty cooking or purchasing something.
22:56
Trusted mapping could be here comes in a little different way,
22:58
so it doesn't break the bag and and for IGA for instance, we can
23:04
use it for onboarding because we can use that verification.
23:07
Then my wallet are is the rarefied credential based on our
23:11
video. And for instance, that I'm out
23:14
in cooking oil based on my naturally ID card, that's very
23:18
good for onboarding. Because it's a tool for this is
23:21
Martin kobler onboarding at cooking column list and this
23:26
simplifies the onboarding process which is a very costly
23:30
process. When you look at onboarding
23:32
process, they are really long cumbersome and it cost a lot of
23:36
money. We can make them more efficient
23:38
without breaking. The, I am system in the Pagan
23:41
when we do. Don't do it better.
23:43
When we say, hey, we use the verified credentials for
23:45
authorization because they contain a lot of information.
23:49
Then we sort of speak to the next step because then we add a
23:53
better identity management policy based, which truly then
23:56
changes a lot. But I think what we must
23:59
understand as we can use it, now, you can make a lot of value
24:03
now without breaking everything. But you can evolve from there
24:07
into areas we can land Our await far away from from today, with
24:15
today's technology. So in that sense, there's a also
24:19
disruptive potential and it's the end.
24:21
I think it's revolutionary revolutionary and it feels to me
24:25
like I think in all things technology Legacy is the biggest
24:31
threat to hold it back from kind of moving forward.
24:35
I think in this area is probably more truth in any other area.
24:40
No. So given that No, no.
24:43
It doesn't take my Ig use case. So take the onboarding process
24:48
at the end, the onboarding process means that there's
24:52
marketing cooking or that comes in and that may go through the
24:55
HR System of the mid co-director timss, but I used the verifiable
25:01
credentials Theses to justify. This is Martin is still, my
25:05
trust is cetera, et cetera. And this makes the process lean
25:11
and then it's in the system and the system can continue to work
25:15
as it works today from their own week, then can gradually improve
25:22
other things. But it isn't that it that the
25:25
Legacy hinders Us in adapting and discern drives identity.
25:32
This is just not the case. Okay, so let's move on to the
25:36
next one. So I Eve, the explosion of the
25:40
privileged access management. Fees, when you consider
25:44
Solutions, like Kim cie a more Cloud, Focus Solutions and tools
25:50
to support devops Secrets management.
25:53
You're looking at at Paul Fisher's privileged access
25:57
management leadership Compass. I mean, I think there are like
26:00
30 vendors and I listened to the podcast that Matthias does.
26:05
When you have Paul on it was like there are still some that
26:08
could make the cut. So it could have been many more
26:10
than 30. That feels like an area that
26:13
it's probably being driven largely by the cloud, but I want
26:19
to get your input. You know, is our revenue is a
26:24
revolutionary evolutionary and is this where do you see this
26:28
going in the next few years? I think, if we will see a lot of
26:33
convergence here, So so we have secrets management, we have key
26:40
and we have them areas where when it's cloudy for Section
26:44
title. And remember, so to speak up
26:46
lights as well, then any workloads that run on premises
26:48
in, on a couple native environment where we have
26:51
certain but not all of the problems we have in the public
26:54
cloud or a public is infrastructure as a service
26:58
environment and we have to traditional impairment.
27:01
So I believe that we will see see a lot of So we will see
27:06
Shirley several more startups appearing, but over time it will
27:10
be the usual, some of the commercial vendors at
27:14
capabilities, some acquire, some of the some will remain
27:19
specialized to enter a specialist vendors on certain
27:22
areas. But I think we also from a
27:25
sinking should look at this as a As one big problem, which has
27:31
different facets. So that complex problems past
27:34
are deconstructed into smaller problems.
27:36
And then put together again by, there are so many overlaps that
27:41
when you deconstruct them sort of construct.
27:44
Again, you can will find a lot of synergies in the lot of
27:48
overlaps between the different areas and so this is where I
27:52
believe we will see you conversions from a and then
27:56
evolutionary Revolution. Very depends, probably very much
27:59
on the standpoint. So when you take, whatever
28:04
cyber-ark solution, as it has been in the past years and they
28:08
have definitely made progress in stem.
28:12
But when you take it for additional cyber, I can stall
28:15
from that perspective, just will be sort of speak revolutionary
28:17
because it's really something way bigger, very different.
28:21
I think, for most vendors in this space, it's a loser because
28:24
they are already on their Journey.
28:26
These are from the Secrets are the key more the Tricia pan
28:31
space but they are sort of rolling their products.
28:38
Yeah it kind of feels to me like we've got to traditional Pam
28:42
vendors that have focused on the Enterprise for many years and
28:46
it's now this rapidly evolving Cloud infrastructure model AWS.
28:52
Google Cloud azure. And it's creating opportunities
28:58
for innovators to come in for for start-up companies to come
29:05
in and solve specific problems. That larger firms are will
29:09
ultimately have to catch up to. I also think there's some new
29:14
capabilities, you know, like, you know, we talked about that
29:18
Kim space to me. The biggest thing that comes out
29:21
of that is finding identifying over-provision accounts and to
29:27
me that approach has been the over-provisioned account is the
29:31
account that has roles has access assigned and it's not
29:35
using them. Yeah, it's not using the access.
29:38
Yeah. And then by the way, that means
29:41
that, that showcases its that only Pam that relates to Keen,
29:45
for instance, it's also, I Che because right, what what you're
29:49
talking about, this at the end, that's an X components
29:52
challenge. That's right.
29:55
And it's over so and we tend to First vendors moving from sort
30:00
of speak access governance for humans and the traditional
30:06
static access, chewed-up world of systems except accessing
30:13
resources. So I think we will see a lot of
30:15
a lot of change here. And I'm I'm very convinced that
30:19
neither the past nor the IGA Market will look the same in
30:23
three or five. It's from now.
30:24
Yeah, I've said it a few times on the podcast that I think the
30:29
way that the IGA Market evolves because, you know, we kind of
30:34
like point to that Gartner stop doing their magic quadrant on
30:38
it. In other words, the space was
30:39
mature and there's not enough Innovation happening in the
30:43
space to keep doing a magic quadrant.
30:47
To me that that might be true. But I feel like the definition
30:54
of IgA, you know, having one place to go to know who has
30:57
access to what it's got to be more.
31:00
It's who has access to what, and what are they doing with it?
31:04
Or they have access to what and is that the appropriate access
31:08
right? Are they using the access?
31:10
You know, you see a lot of things happening around AI am L,
31:13
whatever it is in Iha, for instance, we see Things like was
31:19
one of the topics, I see, I trusted put finalized my, my
31:24
leadership competitors on the case.
31:27
Risk management Access Control tools for sap and find a lot of
31:30
business applications of who separate ones fun focusing,
31:33
really on the sap space. One more heterogeneous, line of
31:36
business applications. That it's interesting to see
31:38
that several vendors from that space are are expanding into.
31:43
I j. So, to speak.
31:44
For, also, the whatever. Sort of traditional, Ash
31:50
radiactive director and so on what work.
31:52
But you also see IGA Wonders that are shifting like 88 Point
31:56
mr. Erp master that position
31:58
shifting into the outer space, the aiarm space.
32:01
And so I Che is not standing. Still, this Market is still
32:06
evolving. I think I will be way more
32:09
Evolution. There's weight was a need for a
32:11
more Evolution to go more into just, in time, access and Sarah,
32:15
but And so that's why I say it'll look very differently
32:20
differently in three years from now or five years from now.
32:23
But we need still a means to to manage identities and accounts
32:30
and title months and access. Maybe not primarily for static
32:37
entitlements. We push it to systems wire
32:39
connectors, but basic Travelers, including the access governance
32:43
charge. And is it then governance for
32:47
forced Adding a title, montsouris.
32:48
A governance for policy based Access Control to access
32:51
governance. This will not go away.
32:54
Yeah, so that's the, that's the next topic that I wanted to
32:57
bring it into, was authorization authorizations now on the front
33:02
page, you can. And if I think the industry has
33:06
been in love with role based access control, it has warts,
33:10
it's not perfect, but people conceptually understand.
33:15
Role-based Access Control Where's policy based access?
33:20
Control is really more focused on Dynamic grouping of access
33:26
Dynamic, grouping of users, providing them access and
33:30
expanding the data that could normally be used within a IG, a
33:37
or Nexus management tool to develop roles, that would go
33:40
into role-based access control. So it seems like policy-based
33:45
access solves so many problems. Alms.
33:47
But my concern is that it's held back by the fact that people are
33:53
would be nervous, not understand it.
33:55
And that I think you've got another perspective.
33:58
Also around the auditability of it.
34:02
Yeah so I think that we need to differentiate.
34:05
I think what organizations best for takes a multi-speed
34:09
approach. Because policy-based access for
34:13
legacy applications is definitely more difficult.
34:16
It's not impossible but it's more challenging but on the
34:20
other hand we see a strong adoption for instance around
34:23
opat open policy agent so developers of Digital Services
34:27
laughs this concept because they don't want to care for
34:30
authorization. They want to ask the system.
34:33
They want to rely on policies and just this is facing a strong
34:38
uptake. So I think it depends really On
34:40
the audience, how fast it's going forward.
34:44
So basically I think as an organization what you do today
34:48
is you should think about how can I move forward towards the
34:51
policy based access future. And you know, we need to be
34:57
clear. This is not a new thing.
35:01
Tim, you know what has been released in 1976 as a product?
35:05
What's right? IBM, Rockettes Russell's access
35:09
control facility. So 1976 this is 47 years ago,
35:14
policy based access control. So to speak, in some sense and
35:20
the externalization of authorization already was
35:23
something that was coming to into the market back then, so
35:29
it's nothing fundamentally new. I think we, there's Surely some,
35:35
this will use also from exact meal that was hot for a while
35:39
and it didn't become as broadly used as a lot of people expected
35:44
in the industry. But I see a huge potential as he
35:47
also very significant benefits and policy pays taxes.
35:52
And as I said, when we when you develop your applications of all
35:55
the stuff you do around Digital Services, I think it's the
35:59
logical thing to do and then this is the fast track so to
36:03
speak and then there's the slow track which is Modernizing your
36:07
legacy which takes longer and in between you know we using
36:10
policies for Access Control, 40, trust everywhere there are
36:13
policies. So we do a lot around policy
36:15
based access already and this is so to speak somewhere between
36:19
the fast track and the slow track, where we have where we
36:24
have. A lot of things.
36:25
We've actually do. What we need to do is we need to
36:28
to to combine that we need to set up the governor's.
36:31
I think the governance is definitely very interesting
36:33
point because We have one thing where it simplifies a lot.
36:38
So policy, power analysis policy, lifecycle.
36:42
Policy governance is way way simpler than roll.
36:45
Based governance a role based environment policies are easy to
36:50
understand. You can write an natural
36:52
language or something which is very close to natural language
36:55
and you can implement the life cycles, all that stuff and then
36:59
do a super reviews because people understand it because it
37:02
potentially are less our policies.
37:04
All good. The other point is policies.
37:08
Make decisions based on data they receive from certain bond.
37:12
That means that what we also need is.
37:15
We need Ate our governor to ensure that we have the correct
37:21
data. We are basing our decisions on.
37:24
So data governance from that perspective, must be one of
37:27
them. Next, big things that are at
37:31
rest. Yeah, I think you're right.
37:33
I mean, the example, I always use with the policy based access
37:36
control is say, you have data in a financial system which is
37:41
maybe your account balance. And if you're a high net-worth
37:44
client-server over a million dollars in assets with this
37:48
firm, then you get access to a policy based.
37:54
Grouping or roll and you can access certain portions of an
38:00
application or things like that, but that's that data.
38:04
And from a data governance perspective, you need to make
38:07
sure that the inputs into that data that it's not going to be
38:11
changed by some application. You weren't aware of and now,
38:15
all of a sudden, it starts, giving people access that they
38:17
shouldn't have access. Yeah, so yeah.
38:20
Now I want to have, you know, getting better than what we have
38:23
today. It's also static entitlements,
38:26
that's not step difficult. So because at the end when we
38:30
look at what is the root cause of most of the challenges, we
38:33
have an identity traditional identity management in our
38:36
static entitlements. We need these complex role
38:39
concept because we need to manage that entitlement they get
38:43
out of control. So all the recertification stuff
38:45
is because of talent. So some of the most painful area
38:49
you're dealing with our because of these static entitlements.
38:53
Yeah. I think Is that the reason Robb
38:57
are back. So attractive is so many people
39:01
are starting at Ground Zero and it seems like such a major
39:04
Improvement of her where they are today.
39:07
They understand it, but let's move on because I thought it is
39:12
questions, we were talking and I really think that this is an
39:17
area of concern for me is that I hear a lot about the All these
39:24
schnoor, the idea of companies kind of building a suite of IM
39:33
capabilities. So rather than I'm an IGA vendor
39:37
and I continue to improve my product and build out the
39:41
functionality that I'm going to improve by also having single
39:45
sign-on by also having privileged access management.
39:49
My concern is that comes with the cost of innovating within
39:53
your course space Us, and we get less Innovation, the course
39:56
space, and we just get up a bunch more sweets.
40:02
Do you think about that? I like I said, you know, I see
40:05
so many startups and probably more startups never.
40:08
So when we found that compared called analysts several people
40:12
that, you know, that is too narrow space.
40:14
So few vendors did weren't that many identity management
40:17
vendors, back them. Nowadays, we have probably ten
40:22
times as many vendors as we had when we founded a company called
40:28
some close to twenty years ago. So I think that that means we
40:36
see, always startups coming up. And yes, we see Wenders to go
40:40
into we provide more capabilities.
40:43
She got very fundamental difference to two to four.
40:47
More days has Tweets are very different than Suites have been
40:52
so to speak. These are the Commander's call
40:54
it platforms. You may like the term will not.
40:57
But what in a world where we talk about container-based,
41:03
diplomats very talk about microservices very talk about
41:05
apis. It is that we don't talk about
41:09
big monolithic systems anymore. So what happens in The
41:13
Innovation is usually that smaller services are added that
41:18
can communicate that are integrated via dashboards and
41:21
biotic by a consoles Vallarta abilities that have a consistent
41:25
set of apis and that makes it simple.
41:28
And I think from a customer perspective, we introduced this
41:32
concept of identical bricks a couple of years ago.
41:35
And this is not about saying I have one product, but it's about
41:39
saying, I have a very good understanding about which
41:42
Services, I need, which, how they are provided, and how they
41:46
interoperate. And this is always has always
41:48
been Based on the assumption that this goes into is based on
41:56
all these modern architectures based on apis based on micro
42:01
Services based on its of that container based employment Etc.
42:05
And I think, in that way, you can well-balanced these two
42:11
challenges of on one hand saying I want Innovation, I want to be
42:14
able to add Innovative Parts into it.
42:17
And this is way easier than in the past, you know, you can
42:20
address examples. I'm frequently talking with
42:25
taking westerners and when I go back a couple of years, then
42:30
then one of the biggest concerns were that if it.
42:32
Okay, I have here, one in, Western, in my portfolio.
42:35
I wender a dad. Like to purchase one or two.
42:38
All right. I'd like to acquire winter.
42:40
A be a to vendor. B is why I have a, I want to
42:43
eat. But unfortunately, my render a
42:45
Builds on Soft that and went to be built in China.
42:49
Travel, for instance, in this area is extremely complex.
42:53
This is not a big issue anymore because you say, okay, these are
42:57
services that runs a, the cloud to communicate where IP is, who
43:02
cares about the other pod. That's very long as you can
43:06
maintain as, but there's also the I feel like we need to for
43:13
the I am practitioners out there.
43:16
Yes. Everything you said is true, but
43:18
I also think that we we can't fall into the Trap of thinking
43:22
because we put something in the cloud.
43:24
We've absolve themselves of the responsibility for being secure
43:29
because I think ultimately the buck still stops on our plate.
43:33
Your foot do a one of your your podcast to that.
43:36
It was my colleague, Mike, small and talk with him about tenant
43:41
and provide a responsibility and all these things.
43:44
I'd love to. I'd love to.
43:46
I think there would be A great topic.
43:48
Martin I don't want to not get through our full list here and
43:53
so what I'm going to propose is that we do a lightning round.
43:56
Now I'm going to throw a topic out there and then, you know,
43:59
take 60 seconds to two minutes to kind of give your thoughts on
44:03
each one. So one of the topics that's been
44:06
really hot and it feels like we have unanimous opinion that this
44:11
is good. Great for the industry is Fido
44:14
to you know, passkeys web. Fan excetera.
44:18
What are your thoughts? Yeah.
44:20
So I think path keys are just making things more convenient
44:23
for users. That's good.
44:25
I think that it's erupted too. Disruptive thing is really
44:29
webathon, because web Austin means that you go from the user
44:35
and the device directly to the service.
44:38
You don't go through access management system.
44:40
You don't go through gateways anymore, at least not
44:42
necessarily you stood potentially could use them, that
44:46
means but But that that you have potentially a couple of
44:49
applications that are excess directly and so you need to
44:53
rethink the way how you manage access and control access across
44:57
these applications where again policy based Access Control
45:01
definitely would help that that we also have our options.
45:04
But you this this will change a lot in the way we interact to
45:08
applications and which components we use for work or
45:12
need for what? In our?
45:14
I am infrastructure. So this has a A disruptive
45:17
potential. Great second one it wouldn't be
45:20
an. I am discussion.
45:22
We didn't bring this up generative AI.
45:26
I've seen cool things really cool things there.
45:31
We I think we are all aware of the risks that are in there.
45:38
There are things that are definitely over high and you
45:42
know, imagine everyone trusts would use trap GPT for creating
45:48
output. Then there would be nothing new
45:51
anymore, so to speak at a certain point, you know, if it
45:56
would become a self-contained system.
45:58
So there are limits there are risks.
46:00
We should be aware on the other hand.
46:02
They are really extremely smart Solutions.
46:05
I've seen based on generative. A I specifically, when you
46:08
combine that with for instance log data in security analytics
46:12
etcetera. So that just conversational but
46:16
really bringing together a Lot of information, then this is
46:22
something which is very helpful. I believe that, for instance,
46:26
the way we are and already starting it's the way we are
46:30
using search engines change fundamentally.
46:33
So the typical prompt we used as you can, whatever, one year, two
46:40
years, three years. Maybe we won't see it anymore.
46:44
Yeah, I think, you know, I've used the generative AI, the chat
46:48
GPT a few times. I say, you know, write me a
46:51
summary of something and it seems to take that something and
46:56
form it into a really good search gets the data back and
47:01
then forms it has pros and like this pretty cool.
47:05
I don't know that this part is revolutionary but I've also seen
47:09
demos of where entire legal documents at least you know, if
47:14
you took the 80/20 rule of, I'm a lawyer, I need to create this
47:17
document. I put it in a report.
47:20
Request for a document, it spits out 80%.
47:24
Now I just have to edit and do 20%.
47:27
I've made myself potentially much more productive.
47:30
Yeah, that's I think that's what we should should understand.
47:34
It has a potential for making us more productive.
47:38
Making up. If you use it the right way, it
47:40
will be a journey as usual. Okay, next one.
47:44
All right, last one orchestration.
47:47
Yeah, cool thing we see. So many good orchestration
47:51
Solutions, nowadays. How's it going Beyond?
47:54
Sort of certain use cases into really more generic solution.
47:58
The one thing I own, I'd like to bring up here is what?
48:02
Let me use. All these are consideration
48:03
tools. What about, for instance
48:06
staging? So development test production,
48:12
which is still needed. What about code?
48:15
Versioning coding quotas. What about documentation?
48:21
You know, I started with very traditional programming
48:25
languages and I used I learned that we need to commend every
48:29
line of code more or less or every section of code at least.
48:34
So a lot of things that are essential for for development
48:40
and at the end, its development frequently are lacking in the
48:45
orchestration tools. This is what when just must fix.
48:49
We need to because otherwise you know, imagine you using the
48:52
solution which is orchestration tools for a decayed or so and a
48:57
lot of people have changed who's able to maintain it.
49:01
So I want to shift gears a little bit and I want to
49:04
understand more about what's coming up for Cooper.
49:07
Nicole, do you have any more conferences on the horizon?
49:11
Anything else this year? Or are we looking at next year?
49:15
So we are currently working on launching a Cybersecurity to
49:20
arrange more cyber security conference, in November of a
49:24
shorter run, in mid-november in Frankfurt, which we call cyber
49:28
Evolution. So, the are could be revolution
49:32
or LPS revenue for in cyber and evolution.
49:36
When we look at different aspects of whereas, evolving.
49:42
Also truly a bit, the impact are the intersection between
49:46
identity and cyber security. But also, So surely the impact
49:49
of a I will fiber security but also that positively and
49:52
negatively but also some of the more down-to-earth subject.
49:57
So this is thing and then surely next year in I think next year
50:01
or early June due to all the public holidays we have.
50:04
And in May and tronie, early June European identity
50:08
conference again and Berlin. Definitely did the away.
50:13
You want to miss and up to miss. You should be there.
50:17
So first we'd love to You know, I mentioned a few of the
50:22
leadership compasses that have come out recently, they
50:25
privileged access management. The IGA leadership Compass.
50:30
What else has been published recently or is coming out soon?
50:34
That's how I talked about the application risk or Access
50:38
Control tools leadership come boxes.
50:41
Which I have been working on which are currently, in fact
50:44
Jack. So when the review and We have
50:49
one on software supply chain security which just our work in
50:54
progress attack surface management will be one of the
50:58
other a couple more. We would definitely cover some
51:01
of the upcoming topics, like at end, this threat detection
51:04
response, which probably will be that out in 2024 because the
51:09
true leadership combat takes takes its time.
51:13
I'm currently working on email security topic that I have to
51:17
say really came back. Some way.
51:19
So which is, which is a very important subject.
51:24
So many, many different topics across identity and cyber
51:27
security. So, you guys do the leadership
51:29
Compass? What other types of reports you
51:32
publish? That's what we have.
51:34
We have to execute, give you, which is really product-focused
51:38
thing. We do leadership, brief and
51:40
advisory notes sometimes, which already more conceptual, we have
51:44
a platform Casey open select, which is growing.
51:48
Are we where customers can sort of use information?
51:52
We have from leader to composite cetera, to come up.
51:55
With a short list of products, they want to look at have a
51:58
closer look at which is read online tool to support tools
52:03
choice. And so these are some of the
52:08
format's. We are doing video.
52:09
Also writing a couple of white papers together with vendors and
52:13
stuff like it. Well, I knew you guys best for
52:17
the leadership Compass. Probably all laugh.
52:18
For our listeners to as well. What is this secret to writing?
52:23
A good leadership Compass. If you hire somebody new to
52:27
write one, what do you tell them?
52:29
What advice to give them. Yeah, so when I, when someone
52:33
you starts with the leader to combust L, then we work with a
52:36
very close mentorship, so across the entire process.
52:40
So that is always something where experience analyst is
52:45
guiding a new analyst. What is most important?
52:49
I think most important is, I would say at the end or what
52:53
have really thorough and lasses. So, really got through a lot of
52:57
data. We have this question as we do
52:59
the briefings to cetera but also sort of a critical mind.
53:04
So how do we rate or vendors? Tell us and what do I unders
53:10
ride the questionnaire ecetera. I think this is this together is
53:15
to secret of ethical. And that's right, we have in our
53:17
leadership Composites that we have multiple dimensions of a
53:21
look at market and product and way, should leaders and combined
53:25
leadership and that have spiders, which go more into
53:28
detail. So we take really different,
53:32
different perspectives, which I believe is very healthy for the
53:37
customer as well. I like the breath of the
53:40
leadership compass that the number of vendor solutions that
53:45
get looked at and analyzed and I can imagine the amount of data
53:50
that gets crunched to come up with a 50-page report.
53:54
So what you must start with, to get down to 50 pages, must be
53:58
immense, Martin. You've been super, super
54:02
generous with your time today. And what I'd like to do now is
54:06
to try to do our normal Cadence of ending on a lighter note.
54:12
And one thing I know about you is that you seem to use your
54:15
social media. I follow you on LinkedIn, use
54:18
your social media, very effectively.
54:21
I was wondering if you could share with our listeners, your
54:23
strategy for using your social media.
54:26
Yeah, so so first, I concentrate on LinkedIn because I think fall
54:31
from my domain or unidentifiable Securities is the most relevant
54:37
one. So I don't spend time on other
54:42
social media channels. I think that that is part of the
54:47
secret. And then I've learned as a very,
54:51
very good social media manager, Marina.
54:53
And she gave me a lot of his wives and so I'm currently
54:57
working. So, I had a gap for a bit of a
55:00
plan, B, being on vacation but currently preparing a couple of
55:04
Articles and posts on different subjects, also to become a bit
55:09
more continuous and what I'm covering them.
55:12
Surely us rib. Flying back to comments to
55:15
questions Etc. And so, I think this is
55:20
basically there's not much sort of rocket science in that.
55:25
It is really I think sharing enough of your salt and I was
55:29
asking for feedback asked, if he'd love what they think about
55:34
it, this usually tends to trigger more discussion than and
55:38
in the comments section cetera and this makes it more
55:40
Interactive. So just the way I use it.
55:43
Yeah and I think it's a very conscious approach.
55:46
I try to be conscious as well because I realized that
55:49
sometimes you if you like a message or you comment on a
55:53
message it it's going to potentially end up on somebody's
55:57
feed and you don't want to waste their time by liking somebody's
56:00
like, you know potential like a graduation picture of their kid.
56:04
Nothing wrong with talking about the graduation of your kid.
56:07
I think that's a great life moment.
56:10
That probably is more face. Exam for LinkedIn, right?
56:13
So but it's a balance. I also want to like that picture
56:17
because I like that person and I'm happy for them that they've
56:21
reached that Milestone. So I think that's a big part of
56:24
it is, you know, for me is making sure that things that I
56:29
potentially put out. There are relevant to the folks
56:33
that I'm connected with. So that I'm not taking space on
56:37
their feet with things that they don't care about people, they
56:40
don't know, I This is a good approach just kind of final
56:45
thoughts and takeaways that you might have for everyone.
56:48
Yeah, I think we touched so many topics and I think that the most
56:51
important thing is probably this all this Innovation happening to
56:56
to look at the positive potential.
56:59
So not being scared by all, this is changing, this is changing.
57:03
But speaking about, how can this help?
57:06
In what I'm doing, potentially even without breaking
57:09
everything, because a lot of this Innovative stuff really
57:12
adds, instead of breaks the things likely to rise identity
57:18
with touch this. And this is, I think, the way of
57:19
thinking we should take looking at the potential but not in fear
57:24
of, oh, this will break everything because it will not,
57:28
it will help us to evolve identity management or digital
57:31
Identity or maybe from identity management to digital identity.
57:36
Absolutely. Thank you Martin, for all of our
57:39
listeners, you can visit the show on the web at idac
57:43
podcast.com. I'm follow us at at IDC podcast
57:47
on Twitter, we also have a mastodon setup which is at idac
57:53
podcast at info dot X Change and you can connect with us on
57:58
LinkedIn. Thank you everyone.
57:59
And we'll talk to you on the next one.
58:01
Thank you, Tim for inviting me. You've been listening to
58:05
Identity at the center. We hope you've enjoyed the show,
58:09
make sure to like rate and review and we'll be back soon,
58:14
but in the meantime, hit the website at identity at the
58:17
center.com and find us on Twitter at ivac podcast.
58:24
See you next time on identity at the center,