Latest / Identity at the Center / #226 - Board Conversations with Baber Amin of Veridium

Transcript

#226 - Board Conversations with Baber Amin of Veridium · Identity at the Center

0:05
This is identity at the center. If it has anything to do with I
0:11
AM, This is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Steadman. Welcome to the Identity at the
0:21
Center podcast. I'm Jeff and that's Jim.
0:23
Hey, Jim. Hey, Jeff.
0:24
How are you? Not so bad yourself.
0:27
Good. Hey man, I'm going to throw it
0:28
back to you today because you just opened my eyes to a new
0:32
product and we're not a commercial for any one product,
0:35
but this thing looks kind of cool.
0:37
Flipper 0. Yeah, I you know it's it's been
0:40
out for a while. I don't, I'm not technical
0:43
enough to know all the ins and outs of it.
0:44
It literally just came into my mailbox like less than an hour
0:48
ago so but I eagerly ran down to it to grab it once I got the
0:52
notification. It's a little like multi tool
0:55
for. Variety of different tasks if
0:59
you think about it like from I don't want to say hacking
1:03
because that's probably not the like the best way to do it but
1:06
you know it's designed to do like wireless signals,
1:10
Bluetooth, infrared it's called Flipper 0.
1:13
Don't ask me any more questions about it because they literally
1:15
just opened up but it's been making the the news for a little
1:18
while now. I think it actually got like
1:20
some sort of like maybe stop shipments into the US or
1:23
something like that at some point while people trying to
1:25
figure out what this. Thing is, but it's Flipper 0 I'm
1:29
just reading for the website. Flipper 0 is a portable multi
1:31
tool for pen testers and geeks in a toy like body.
1:34
It loves hacking digital stuff such as radio protocols, access
1:38
control systems, hardware and more.
1:40
Fully open source and customizable.
1:42
You had extended a bunch of ways, got a memory slot so you
1:44
can put your memory card in there.
1:46
So I saw the access control thing as they found interesting.
1:49
Let me see you know what this is all about and kind of play
1:51
around with it and see what interesting things.
1:55
I can get in trouble with basically, yeah.
1:58
Well, it looked like a like a little carry in your pocket
2:01
buddy for geeks like us. And I I saw like the on the web
2:07
page there's like a screen where it was like a little picture of
2:10
a dolphin head. It reminded me of that toy that
2:12
kids used to carry around, where it was like you had to feed your
2:15
your friend. Oh, that.
2:17
Yeah, that was it. Tamagotchis or like Neopets or
2:21
things like that, yeah. I never had one of those.
2:24
I just, I, I, I think I was like in that generation or age range
2:27
where it was like after that. And so I was like kind of not
2:31
right in the right age for that. Yeah.
2:34
Well, I have mine right now and he's very hungry.
2:36
So maybe we should get on with the show and I'll feed him and
2:40
then I'll jump back in. Yeah.
2:41
That's probably a good idea. We don't want your virtual pet
2:44
to die. Who knows, maybe at some point
2:46
that's like AI. We could talk about AI, but like
2:49
the virtual assistant type thing.
2:52
Yeah, we got a pretty interesting show today.
2:53
I know we're going to talk about sort of how do we talk about
2:56
identity with the board and stuff like that.
2:59
But before we get to that, you and I have a lot of different
3:03
engagements, speaking wise, conferences and things that will
3:05
be at. So I've got a few.
3:07
I've got one coming up in Cincinnati, OH on September
3:10
14th. It's called the Cybersecurity
3:13
Midwest Summit 2023. It's put on by COM Spark and
3:16
CDO. So I'm not sure how large it is.
3:18
Seems like kind of a regional thing.
3:20
But I'll be there. I'm part of a panel to talk
3:22
about identity and access management.
3:24
Something you haven't figured out what the topic will be?
3:26
What is I am? I don't know.
3:28
It's the existential question, as always, So we'll figure that
3:31
out probably as we get closer. But if you're in the Cincinnati
3:34
area, come on down, Check out the link I'll have in the show
3:38
notes to come say hello or show support or whatever it is.
3:41
I don't know if I have any stickers left, so I think next
3:43
time you and I connect. I'll need to get some stickers
3:46
from you because I feel like I gave almost everything out I had
3:49
at the at the Identifiers Conference.
3:52
So, yeah, yeah. Well, we'll split them up.
3:54
I don't think we're going to get into 2024 with very many.
3:57
At the rate we're going, we're giving away pretty good.
4:00
Yeah, we're going to have to add some more.
4:02
We've got Identity Week, America that's coming up.
4:05
I'm going to be out in Washington DC October 3rd and
4:08
4th. And we're going to be, I, I, I'm
4:11
going to be hosting a panel there around identity and access
4:15
management pass keys. We kind of talked about that in
4:16
our last episode with Andrew Shikiyar and sort of the
4:20
conversation we'll just kind of have around that.
4:22
Again, I still need to firm that up, but I'll be out there for a
4:25
few days. We've got a discount code for
4:27
that one, which is very exciting.
4:28
You get 30% off of your conference pass.
4:30
If you use the code Ida C30, you can hopefully, you know, use
4:36
that, take advantage of it. It's Washington, DC.
4:39
October 3rd and 4th, Identity Week America.
4:41
I'll have a link in our show notes and then we've got you and
4:45
I will be at the Authenticate conference.
4:48
We've got a code for that one as well I D AC15 podcast that could
4:52
shift 15% off of your registration.
4:55
I'm really looking forward to that one.
4:56
I I like it because it's, it feels like, I don't know, more
4:59
like a community style event. I don't know if that's right,
5:03
but it's in Carlsbad, which is just a little bit north of San
5:07
Diego. It's on a nice resort.
5:08
There's golf, there's the beach. That's gonna be a lot of fun, I
5:12
think, and we're part of the keynote type thing.
5:15
We're gonna end up doing something like a live show as
5:18
part of the. Part of the festivities here, So
5:21
that'll be interesting, nerve wracking, but hopefully people
5:25
enjoy it and we put on a good show.
5:27
It'll be the first keynote that I've been a part of and I don't
5:30
have to be as nervous because I'll be up there with you.
5:32
And we're just doing our thing. We do it every week.
5:35
So, I mean, what to get nervous about?
5:38
I mean, yeah, we talked to, you know, what millions of people
5:40
every week about identity and access management all around the
5:44
world and the universe. There's just something I think
5:47
different about being on stage, the bright lights and, you know,
5:52
microphones and hearing your own voice amplified, which nobody
5:56
likes the sound of their own voice.
5:58
I think we'll have a good time. I think hopefully it's
6:00
entertaining and hopefully, you know, people enjoy it.
6:02
So that's why I'll be cautiously optimistic for.
6:05
I think we'll do a good job. Yeah.
6:07
And and the other thing is, if you're at that conference, we're
6:11
going to be recording probably like six other podcasts.
6:15
And the way The Room is going to be set up, the idea is that
6:19
there's going to be able to be live studio audiences for all
6:22
those episodes. Yeah, I'd love to have something
6:29
where we can like engage with people, you know, in addition to
6:31
our guests and stuff like that. So we have a opportunity to have
6:25
a lot of fun that. Answer questions, you know,
6:34
stuff like that. So hopefully people are there.
6:36
Check us out. I'm gonna make signs to say
6:38
like, applaud, applaud or laugh. Yeah, we have like something
6:42
that comes down from like the top, right?
6:44
And it lights up like when people should be doing their
6:46
action like a talk show. Maybe we can set it up like
6:49
Kramer when on that Seinfeld episode where he had like the
6:53
couches and things like that. That would be a lot of fun.
6:56
Yeah, right. He really got into that one.
7:00
Okay. So that's all the stuff we got
7:01
going on. Plenty of stuff.
7:02
Over the next few weeks, hopefully people come and check
7:05
us out. Hopefully people take advantage
7:06
of all the different discounts we've been able to secure our
7:09
show. We'll have all that information,
7:10
links and codes and stuff in our show notes, but let's talk about
7:14
how we talk about identity with the board or other kind of
7:19
senior executives. I kind of loosely thinking the
7:22
title of the show will probably something like Bored
7:24
Conversations about I am. And when people hear that,
7:27
they're like, you know, how do you spell board scenario, But,
7:33
you know, try to be clever to help us with this conversation.
7:36
Someone who has had a lot of conversation with boards, not
7:38
boring conversations, but board conversations BOARD.
7:43
We've got Bob Ramin. He's the chief product and
7:45
operating officer at Viridium. Welcome to the show, Bobber.
7:48
Thank you, Jeff. Thank you, Jim.
7:51
Thank you for having me. It's great to join you guys and
7:53
we're not going to have bored conversations.
7:56
No, we we do our best to not be boring on this show.
7:59
I think people, we kind of realized like, OK, we have some
8:01
personality here and yeah, identity is a topic, but we try
8:05
to be entertaining about it. You and I actually met through
8:08
mutual friend Andy Hindel who introduced me to you at the
8:11
Identifiers conference. So shout out to Andy for making
8:13
this connection and we just start kind of talking in the
8:15
hallways like, hey, you know what?
8:16
We should probably record this. This would be a good one.
8:19
So let's. Let's do that.
8:22
Before we get into that, we always like to have the origin
8:25
story of people who are in the identity business when they join
8:28
us for the first time. So maybe you can kind of explain
8:30
to us how did you get into the identity and access management
8:33
field? Is it something that you chose
8:35
or did it choose you? So I actually chose it pretty.
8:45
Thoughtfully, I guess so. I've always, I've always liked
8:48
security. I've always liked, you know,
8:52
secret writings. So.
8:54
So I was, I was a big fan of encryption and you know how it
8:59
worked and you know, the whole, you know, that led me to
9:01
authentication. And you remember the whole way
9:04
people used to talk about authentication.
9:05
Still, do you know there's the Bob and the Alice?
9:09
Conversations that happened and then you know a colleague of
9:13
mine introduced you know the the in the middle we call it the
9:17
evil duck of darkness so that was the that was the that was
9:21
the person in the middle who was trying to get in the middle of
9:23
that communication. So so that's that's where I
9:26
started. I started with the with
9:28
authentication protocols and and had a great great mentor there
9:34
Roger Shell and and he. You know, he's still pretty
9:39
active in the industry. Amazing, amazing person and just
9:43
a great mentor. And I learned so much from him.
9:46
Fast forward from that, you know, eventually I decided to
9:52
move up from just the technology side of things and I focus more
9:57
on the business angle. And that's where I realized that
10:01
a lot of people don't really understand, you know, what is it
10:05
that we're doing? And partly because we make it so
10:09
complicated, you know, people just want to, you know,
10:13
understand things in simple terms and and how it relates to
10:17
them and how it affects them. So the last few years, my focus
10:22
is really to, you know, turn the whole process into storytelling
10:27
and. And simplify the conversation,
10:30
simplify the message and have people understand why something
10:33
is important, especially cybersecurity and identity being
10:37
a crucial aspect of cybersecurity now.
10:40
And that's the conversations we're having at the C level,
10:42
that's the conversations we're having with at the C level with
10:46
our customers and also how to educating our customers how to
10:51
have that conversation with their boards because.
10:55
You know those those conversations need to happen for
10:57
them to get the funding for them, to get the alignment for
11:01
them, to get the support they need.
11:05
So you're with an organization called Viridium.
11:07
For people who aren't familiar with Viridium, can you give us
11:10
sort of like the 30 to 62nd elevator ride?
11:13
What do you guys do? What problems do you want to
11:16
solve? That sort of thing?
11:18
Yes. So, you know, going back to, I'd
11:21
like to make things simple. At a high level, what we do is
11:27
we make security invisible. What does that mean?
11:31
Right? So invisible security is not bad
11:34
security or less security. It basically just means that you
11:39
remove the friction and make it less obvious and not in your
11:43
face. We do that specifically for
11:46
authentication for credentials. So we remove passwords from the
11:49
user experience, right? So where we enable password less
11:52
authentication? And we do that with a variety of
11:58
factors And then we have two of those factors are our own in
12:02
house factors that are developed for biometrics.
12:08
We use computer vision for biometrics.
12:10
So that's a key factor for us. But yeah, we make security
12:15
invisible, remove anxiety from the login process.
12:22
And and help organizations get you know stronger and and have
12:26
better overall access control. OK.
12:31
So the elevator doors just opened up.
12:33
You've explained what you do or what we're idium, you know, does
12:36
take us through sort of a week in the life of someone who's
12:40
responsible for both product and operations, for an identity
12:44
organization like yours. Can you just kind of help us
12:47
walk us through and kind of appreciate you know, what are
12:49
the types of things you do work on that sort of thing?
12:51
Yeah, so you know it is and you and I were talking about this
12:58
earlier it it is wearing a two different hats.
13:02
So the product side is really focused on you know what is it
13:06
that we're doing on the product itself, how are we, how are we
13:09
advancing the state of of the product, how are we, you know
13:13
making sure that you know we're we're supporting standards and
13:18
and we're doing all the integrations with the existing.
13:21
I am infrastructure that our customers have in their
13:24
environments how we're supporting legacy applications,
13:26
cloud applications. The operational side focuses
13:33
more on demand generation, marketing, go to market, channel
13:39
development, the other areas that are also touch points for a
13:46
customer. But they're not directly related
13:50
to the product. So the overall goal really is to
13:54
remove the friction from every touch point you have with the
13:59
customer, right? That means when a customer comes
14:02
to your website, or when a customer engages with you, or
14:05
when a customer is trying to buy something, or when you're trying
14:08
to explain to them you know the value of what you're providing
14:13
to them. When a customer is trying to do
14:15
procurement, when they're trying to do a renewal, all of those
14:20
are touch points and you can have the greatest product
14:23
experience, but you can have the worst procurement experience.
14:29
We've all seen that in our normal lives.
14:33
So the operational part of the job is to smooth that aspect
14:40
out. And make sure that the business
14:42
is able to scale as as we grow. And since you bring up all those
14:48
facets of it, I think everyone probably has a story of like,
14:51
oh, this is a great product, but oh, procurement was a real pain
14:55
or, you know, the sales team wasn't responsive or, you know,
14:58
whatever it may be. And that can really kill the
15:01
experience, overall experience, right, with an organization.
15:03
So it's interesting to hear you talk about that.
15:05
Do you ever find yourself in conflict where?
15:08
Because you own? You know, responsible for the
15:11
product side and the operations where you know, I think most
15:14
product managers are like, yes, it's going to do all these great
15:17
things and the budget's unlimited and you know, we don't
15:20
have to worry about support, you know, this other stuff.
15:23
But obviously in the operations side, you've got to be able to
15:25
smooth that stuff out and make sure you actually can deliver a
15:27
product that not only works but works well and has all those
15:31
other different parts. Do you ever find yourself sort
15:33
of in a conflict like that? No, I I think just like what you
15:38
just said it, it actually it actually forces me to think
15:42
holistically in a 360 way and you know look at things from the
15:49
most pragmatic point of view, right.
15:51
It's not about the shiny toy, it's about how much value and
15:56
what's the fastest way the customer can achieve value from
15:59
that. That is the number one focus,
16:02
right. So, so for everything we do that
16:05
is the number one focus is how do, how does the customer
16:08
achieve value in the fastest possible way because if there's
16:12
just sit on the shelf then it's doing nobody any good.
16:15
So Bobber, I've been thinking about these, you know, bringing
16:18
these topics to the board and I think it's two things, right?
16:24
Kind of classified as like you're selling an idea.
16:28
And the second thing is by the time you get to the board,
16:31
you've already had this conversation.
16:33
You've already done this presentation a number of times.
16:36
So now you're refining your story.
16:40
And I think that that word intentionally picked that word
16:43
story. I think you're telling a story,
16:46
right? You're talking about we have the
16:48
problem, we have a solution and then here's what we need in
16:52
order to implement that solution.
16:55
So I guess what I want to do is throw out some of those ideas to
16:59
see, do you think that's the effective way to approach that
17:04
board conversation? We have some other thoughts that
17:07
need to be added or in place of that.
17:10
I think the first thing and and I think Jeff and I spoke about
17:14
this, The first thing to do is to really make the board
17:20
understand and and educate them as.
17:24
You know, they don't know what they don't know.
17:27
In fact there was a survey and we'll we'll put a link in there
17:32
from diligent survey as to what directors think.
17:38
And you know they they ranked, you know different things that a
17:42
board member is concerned about. And board members in that survey
17:46
ranked cybersecurity, which you know identity and access, is a
17:50
critical part of, as the most challenging.
17:54
Issue to oversee right. This came ahead of digital
17:59
transformation, this came ahead of innovation, capital
18:04
allocation and and why is that right.
18:08
So, so that becomes really the the biggest issue because most
18:13
people don't really understand what that means and and I
18:18
frankly, I blame our, you know. Profession for not doing a good
18:24
job in explaining that we use too many acronyms.
18:30
I've had conversations where, you know, it's like the whole
18:33
sentence is full of three letter acronyms with a proposition
18:36
thrown in there just so you know, it sounds like a sentence.
18:40
So really, it's. Educating the board on
18:44
cybersecurity on identity and access, right.
18:47
So first of all, you have to explain to them, and by the way,
18:50
a good way to do that is board decks.
18:53
Board decks are always provided up front to the board, and it's
18:56
a great place for them to get educated on with a lot of
19:00
material and data they can read up on beforehand so that they
19:04
come to the conversation more prepared and they're not feeling
19:08
on the spot asking questions that they don't want to ask or
19:11
you know, you're. Being put on the spot either,
19:14
but helping them understand that, one, cybersecurity is much
19:18
more than data protection. So if you ask 10 board members
19:23
out there, I'm making this number up, you know, what does
19:27
cybersecurity mean? Most of them will say, oh, it's
19:30
data protection. Well, you know what?
19:32
It's more than data protection because and I didn't a
19:36
cybersecurity attack, you know, that is you know.
19:39
Basically an identity breach or something like that.
19:42
It can be way more than data extraction.
19:49
It can affect your supply chain. If it affects your supply chain,
19:55
it affects your ability to deliver product if it, that is
20:00
going to your bottom line immediately, right?
20:04
So if you can't deliver product, you can't.
20:06
You can't. Sell thing.
20:08
You can't make revenue, Your customers will go to somebody
20:10
else, your customers will find an alternate product.
20:14
The other aspect is what happens from a reputation damage and a
20:19
business disruption perspective. So again, talking in the
20:24
language of business becomes really, really important, right.
20:30
Does your board understand what are the different disclosure
20:33
acts? Because each disclosure act for
20:35
your industry is going to cost X amount of time, effort and money
20:42
to to process that and to make that happen.
20:45
So what is happening that you don't have a set of people
20:48
sitting there that are doing nothing waiting for, you know, a
20:51
disclosure act or a disclosure to happen so that they can do
20:55
their job. These are the same people who
20:57
haven't nine to five job and now you're asking him to prepare
21:00
information because there was a breach and you have to do some
21:03
disclosure. So.
21:05
So it's taking away from somebody else.
21:09
Does that does that make sense Jim?
21:11
Does that, is that what you're hearing also?
21:14
Yeah, absolutely. I think one one thing that a
21:17
trap people fall into is they look at these Board of director
21:22
meetings where they're going to get up and speak about a topic,
21:25
something like I did in the access management, which could
21:27
be. Tremendously technical or like
21:30
you said, you could tie it to the business speak, but all you
21:34
know the business outcomes and rather than thinking of it in
21:38
terms of I'm here to make this understandable and to inform
21:43
people they think of it as this is my opportunity to show that
21:46
I'm the right guy for the job. I really understand this issue.
21:51
That is the wrong way to look at something like that.
21:55
You know, kind of one of the things I was thinking was, you
21:59
know, what are you, what are you hearing when you go to board
22:02
meetings or when you work with people who are presenting to the
22:05
board? What are, what's the board
22:08
asking about in terms of identity?
22:10
What is kind of that that understanding level that they
22:13
have today Or what do I, I think kind of going in there with like
22:18
that that understanding of here's what I'm here's the level
22:22
of knowledge that I'm likely to be dealing with.
22:25
So that you're not trying to make it so basic that OK, you're
22:29
boring the heck out of me. Or you're making it to advance
22:33
that they're not understanding what you want to do.
22:36
When you say we're going to use SAML to connect to our Idp to
22:39
issue a token, yeah, and you said it right.
22:44
They don't really care that level of detail because board
22:49
members are not operators. Board members are a governance
22:53
function that is helping an organization steer
22:57
strategically. So for board members, it is more
23:03
important to understand how cybersecurity identity and
23:07
access affect the organization at a global or at a company wide
23:16
at an organizational level. So when you look at it from that
23:20
perspective, what is, how does, how does any of this affect an
23:25
organization at an organizational level?
23:29
Well, the first thing is, is it going to disrupt my business?
23:36
Like the business continuity becomes really, really
23:39
important. It doesn't matter if you're
23:44
using tool A, Tool B or tool C What's more important is
23:51
business continuity and the disruption to the business.
23:55
That could be from supply chain, that could be from people not
23:58
being able to access something. That could be people, employees
24:02
not being able to log in. Or that could be your data is
24:06
locked up because somebody encrypted everything.
24:10
So then the conversation happens, OK.
24:13
So it's not a matter of, it's not a matter of if, it's a
24:19
matter of when, because cyber attacks are opportunistic.
24:25
So what is the mitigation plan? What happens when it happens?
24:35
So what is the mitigation plan? Another thing to do there is to,
24:40
I don't know if you're familiar with tabletop exercises.
24:44
So do a tabletop exercise with your board.
24:50
Because what that allows it is to that everybody is you know
24:56
it's a non threatening environment because you know
24:58
it's a collaborative exercise at that point.
25:01
And it also identifies if there are gaps between what is it that
25:07
is going to happen in case of a disaster, in case of a problem.
25:12
And everybody understands what their role is and you find out
25:15
if there's a gap and then who is going to fill that gap and what
25:18
kind of people we need to bring in to fill that gap.
25:21
Does that make sense, Jim? Yeah, that's good.
25:24
I think another thing that is helpful is working with people
25:30
who maybe know the individuals on the board, what angle they're
25:34
coming from, because it might be somebody on the board Golfs with
25:40
the CEO of Super Platform. And they want to know why aren't
25:43
we just using Super platform? It can solve all of the problems
25:47
that we have. We should use Super Platform.
25:51
I think the other thing is, you know, and I knew this more,
25:59
maybe not as a fact, but I hear it a lot, is that board members
26:04
tend to get wrapped around certain industry buzz terms like
26:08
zero trust or a I. And they might not really know
26:12
what those things mean like zero trust almost.
26:15
You feel like the the way it works is implied by the name,
26:19
like we don't trust anybody so it must be bad or something like
26:24
that. But I wanted to get your
26:26
perspective, especially around the second point, Like how do
26:29
Zero trust or a I or some of these industry buzzwords wind up
26:36
getting ingrained to people's thinking and.
26:39
Do we have to like kind of get ahead of that, debunk some of
26:42
those things or explain some of those things ahead of those
26:46
questions coming? So that's a great question.
26:52
One way to actually elevate the conversation is to attach the
26:57
conversation to larger initiatives which you know zero
27:02
trust digital transformation. Those are you know some of the
27:05
some of the some of the major initiatives that that happen at
27:09
at at a board level. Zero Trust is extremely
27:13
important to everybody right now.
27:15
So and and it's OK that you know people they they might have
27:21
slightly different understanding of what Zero Trust is, right.
27:24
That's less important. The more important aspect is
27:28
that you can tie the everything that organization is doing from
27:36
a cyber security perspective, from an identity and access
27:39
perspective. You can tie that to the work
27:44
that is going on to the work going on around zero trust.
27:47
And you can say, well, you know what, this is what we have to
27:50
report. Like if zero trust becomes part
27:54
of the messaging, if zero trust becomes part of the reason that
28:00
your customers and your partners feel more confident about what
28:05
you're doing, then that's great, right?
28:10
So it's less about, it's less about that they have to
28:13
understand all the nuances of zero trust.
28:17
But it's more important is that they understand that there are
28:23
well thought out frameworks like there's a NIST framework for
28:26
zero trust. So attaching, you know what
28:30
everything that is going on inside the organization and you
28:33
know saying that look, this is attaching it to this framework,
28:37
this framework is already defining what is 0 trust.
28:40
So we're doing XY&Z or we're using these tool sets to attach
28:44
to that. That's the more important aspect
28:48
because they don't really need to understand the nuances, but
28:50
they need to understand that you're thinking about it in the
28:53
right way and framework thinking is the right way because then
28:58
you're not hung up on a single tool, you're not hung up on a
29:01
single vendor, but you're looking at things more
29:03
holistically. That's been my experience.
29:07
That's my advice to everybody is to use frameworks.
29:11
I'm with you on the framework thing.
29:13
I think 2 areas where if you can attach your thinking to a
29:16
framework where it's kind of shows that, all right, this
29:19
isn't just some you know idea that we're we're throwing in to
29:24
the mix or replacing everything we've always done, but it's
29:28
actually is part of a bigger ecosystem of a way of attacking
29:32
the problem. I I also think that Board of
29:37
Directors are also very interested in what are our peers
29:40
doing. So if you can collect that
29:42
information and say, Oh yes, our peers are going down the zero
29:47
trust route and we have a, you know folks that are focused on
29:55
identity at these peer organizations.
29:57
We have a a monthly touch point or a quarterly touch point where
30:01
we just talk about some of these issues and this is the general
30:04
direction that we're heading. I think that's.
30:07
That buys a lot of value as well.
30:09
I actually wanted to shift the discussion a little bit to an
30:12
idea that was talked pretty heavily about at Identiverse,
30:15
which was the idea of the Chief Identity Officer.
30:20
We had Ian Glazer on the podcast during Identiverse.
30:23
He talked to us about this and we we joked around.
30:26
So what is how do you shorten the name of Chief Identity
30:30
Officer? We came up with Cheeto CHIDO.
30:34
Joking all joking aside. I.
30:37
Love your. Vote that.
30:38
Let's make this a thing. Let's make this a thing.
30:40
It's Cheeto. It's Cheeto.
30:42
It's Cheeto. You heard it here first.
30:45
So Bobber is your vote. That organization should have a
30:49
Cheeto. That's an interesting question.
30:54
Without thinking about it too much, I think that yes,
30:59
organizations should have a Chief Digital Officer.
31:02
And the reason behind that is that, you know, everything that
31:06
organizations do nowadays is in some way, you know, associated
31:12
with digital, for lack of a better word, right?
31:15
So Cheeto would be Chief Identity Officer, just for
31:18
clarity, fair enough to me. To me they are, they're, they're
31:24
similar, right. And the reason I say that is
31:28
that identity becomes the gate and becomes the, you know, the
31:35
the front door before you can really do anything, before you
31:39
can access anything, before you can give somebody access, before
31:42
you can know what is going on in your organization.
31:46
So identities started in the HR system because identity was used
31:52
to make sure that people got paid so you knew who to pay.
31:57
But now because we've got so much, you know, digital
32:02
transformation and we've got so much digital stuff, identity
32:09
becomes crucial to interaction, you know, day-to-day
32:13
interaction. So my vote and my opinion really
32:17
is that you know, Chief Identity Officer and Chief Digital
32:20
Officer are two sides of the same coin.
32:25
Obviously the Digital Officer has slightly more
32:27
responsibility, but but they are two sides of the same coin.
32:31
I don't think you can have a Chief Digital Officer without
32:34
understanding identity and I don't think a Chief Identity
32:37
Officer without you know how this is going to affect the rest
32:41
of the organization, which is more and more digital is also
32:46
not not going to be very useful. Yeah, I mean, the heck we call
32:52
it. Identity at the Center for a
32:54
reason. So to kind of close this
32:58
conversation out around communicating to the board, I
33:02
think the most nervous you get when you're going to speak to
33:05
the board is the first time. So what are your tips for that
33:10
individual who's getting, you're getting ready to do their first
33:14
time in front of the board? Yeah.
33:15
So I'll come down to the really the basics.
33:21
The Board first of all is there to help the organization.
33:25
So you know they the more information they have the better
33:31
they can help and the better they can help make that
33:34
decision. Now knowing that you know and
33:38
knowing that the Board is there for governance and not
33:41
day-to-day operations, that's important also because that's
33:43
how you frame the conversation and frame the frame the
33:48
information to them. So what does the board care
33:52
about, right, That's important. So you have to frame the
33:54
conversation in those terms and that comes down to, you know,
34:00
risk assessment. What are you going to do if
34:03
there is an incident? How are you going to respond to
34:05
it? What kind of measures you're
34:07
going to put to protect me from an incident and then you know
34:15
that can go you know break down into you know how is this
34:19
affecting my supply chain, How is this affecting you know and
34:23
supply chain can go to vendor management.
34:25
How is this you know affecting employees because if you start
34:30
putting too much friction on the employees then that creates you
34:33
know, people, people you know find ways around things.
34:37
We've all seen that. And then, you know, what is the
34:41
investment that you're going to need and how is that investment
34:46
going to, you know, give me a payback.
34:50
So, so that's what the board is really caring about because if
34:55
you go in there and you say, hey, the sky is falling, the sky
34:58
is falling, the sky is falling, I need, you know, $20 million to
35:02
make sure I shore it up. And then you say, well, yeah,
35:06
it's showed up. But now, you know, the other
35:07
part of the sky is falling. You know, it's, it's
35:12
reactionary, right? It's not proactive.
35:15
So the best advice I have for that is that you provide upfront
35:21
information, lots of information.
35:23
And so that that's the education aspect.
35:26
But then tie what you're trying to achieve there.
35:29
Why is cybersecurity important? Why is identity and access
35:32
important? Tie that to the business and
35:36
business continuity, increasing the top line, increasing the
35:40
bottom line, customer satisfaction, making sure that
35:44
you're going to pass your audit, make sure that you're going to
35:47
be, you know, pass your regulatory requirements.
35:52
That's how you have that conversation.
35:55
I think it's helpful too that when we're having those
35:56
conversations is that hopefully it's not the first time people
36:00
are hearing it. Everyone in the room, if you can
36:04
brief somebody ahead of time, you know, someone to be aware of
36:07
that and kind of bounce things off of whether it's.
36:10
Be a member of the board itself or maybe somebody at the
36:13
C-Suite. I find it helpful to have
36:15
already talked about it and have an ally going in to the
36:19
conversation. At least it understands sort of
36:22
the, you know, what the direction is rather than just
36:24
walking into, you know, this I imagine like the cold corporate
36:28
board room, right? It's all steel and glass and you
36:31
know, frowny faces and you know it's it's a difficult spot to
36:36
walk in cold right off the street, right, without any sort
36:39
of. Relationship ahead of time or at
36:42
least prep. And I think that's where the
36:43
board deck comes into play as well.
36:45
Sending pre preread information is always helpful, right?
36:49
They'll probably get better, come better armed with questions
36:51
and things like that. I imagine one of the things that
36:54
comes up is around cyber insurance because it's getting
36:58
more and more expensive. The questionnaires that are
37:02
coming out are far more comprehensive than they have
37:04
been in the past. It used to be.
37:06
Oh, do you have MFA? Check the box.
37:08
Right now it's. You know, do you have MFA?
37:12
What kind of MFA? What are your rule sets?
37:14
Who's using it? Right.
37:15
They've gone a lot more detail and think we're starting to see
37:18
things more around privilege access management starting,
37:21
starting to make its way into those sort of questionnaires.
37:24
What are boards and other C-Suite type executives asking
37:28
about this and how the organization is going to be able
37:32
to, you know, retain those insurances or things like that?
37:35
And I guess maybe even more importantly, what are they
37:37
actually doing about it? Yeah, so there's a couple of
37:40
things happening there. You're absolutely correct that
37:44
cyber insurance companies and reinsurance companies are asking
37:48
the question, hey, what are your, you know, what steps do
37:53
you have put in place, right. And and some of those steps are
37:57
just simple blocking and tackling.
38:00
One of you know you mentioned questions changing.
38:02
So one of the questions that used to be asked was do you have
38:06
a password manager in place And if you replied yes to that
38:10
question, that was considered good.
38:13
Now the same question is being asked, but if you reply yes to
38:17
it, that's considered a point against you, right?
38:20
Because if you have a password manager in place, that means
38:23
that you know you're you're, you don't have, you know, a
38:27
Federated single sign on. That means that you still are
38:31
relying on password. That means that you probably
38:34
don't have MFA in place either. So so there's a lot of
38:38
implications you know from that perspective and passwords as we
38:44
all know are the are the, you know the most you know fishable
38:50
credential out there. So, so that is that is extremely
38:55
important for the Board to understand that hey, if I need
38:59
to continue getting cyber insurance, you know, sometimes
39:02
your underwriters will actually stop underwriting or try to
39:06
manage my premiums. What are the things I need to
39:09
do? What are the things the
39:10
organization needs to do? And some of those things are
39:16
that you put the right cyber security policies in place and
39:19
the tools in place. And it's not just getting the
39:22
tools in place, but also the practices in place, because you
39:27
can have a tool in place, but if nobody's using that tool, then
39:31
it's not useful, it's not really helping.
39:35
And this is where, you know, cyber insurance companies and
39:39
their questionnaires are becoming more detailed.
39:44
So they're not just asking, hey, do you have this, they're asking
39:48
how you are implementing it and how, what is your processes and
39:52
procedures around this, right. A certain aspect and and a board
39:57
plays, you know, a larger role in that because most boards are
40:01
involved in, you know, if you have to pay ransomware for
40:04
example, or if there's a breach, they're involved in talking to
40:08
the large customers. They're involved in having the
40:11
conversation from a mitigation perspective, from a reputation
40:14
and a risk perspective. Another angle there is that
40:19
another thing that is happening is board members could
40:23
personally be targeted. You know for cyber, cyber from
40:28
cyber incident perspective because they have access to a
40:33
lot more information. So business e-mail compromise
40:36
targets, C-Suite. They also target boards.
40:41
So making sure that you know, your board understands, hey you
40:48
know these things are not just happening, this is not just a
40:52
vague or a hypothetical situation, but this is actually
40:56
real and it's affecting me and especially when it comes to
41:00
cyber insurance as you're talking about Jeff, this is
41:04
affecting the bottom line. This is affecting business
41:06
continuity because if you don't give, you know it is possible
41:09
that without cyber insurance you might not be able to continue
41:12
your, you know business and continue your operations.
41:15
You might not be able to pay your ransomware.
41:17
So, so this is this is affecting continuity and and and
41:24
operations of a business and the ability for that business to
41:26
survive when something happens. Yeah, I think, you know nobody
41:31
wants to get breached insurance is there hopefully as a
41:34
backstop, but it's getting harder and harder and you know I
41:37
think people because the the, the pricing look insurance
41:41
companies don't want to pay this, right.
41:42
So they're doing their part to make sure that organizations are
41:45
doing their part from a security standpoint as best as they can
41:49
and. You know, you don't want any
41:51
position where you're uninsurable.
41:53
It's not a great spot to be in, Bob.
41:56
This has been a great conversation.
41:57
I want to start to kind of wrap things up, but I'm curious where
42:00
do you see AI just taking the identity space overall?
42:04
I think so. I'm pretty excited about AI.
42:10
It it is going to be extremely helpful in everything from
42:15
discovery to forensic analysis to you know, mitigating, you
42:25
know, attacks that, you know, we might not have even thought of
42:29
because you know, the first thing it can do is to figure out
42:34
where everything is like where's your data right now.
42:38
Organizations spend a lot of time, effort, manpower,
42:43
resources, money to identify where everything is, who has
42:47
access to what and they do that over and over and over and over
42:52
again, right? I mean they have to provide that
42:54
for audit reasons. They have to provide that maybe
42:57
to their cyber insurance companies.
43:01
AI can definitely help from that perspective.
43:04
So discovery is a very important aspect of that.
43:08
The other aspect around AI is the being able to query and
43:14
being able to surface information using natural
43:17
language. Up to this point you've seen
43:21
like when we create policies, policy creation is not for the
43:25
faint of heart. And sometimes you know when
43:28
different organizations when you create, when you distribute
43:30
policy creation, one of the problems organizations run into
43:33
is the policies might be interfering with each other or
43:37
canceling each other, right? These are security policies I'm
43:39
talking about and Identity and access policies.
43:43
So AI can play a really important role in that aspect
43:48
because it can make sure that you know one your policies are
43:54
not interfering with each other or canceling each other's out or
43:56
creating orphan orphan legs. And at the same time, it can
44:01
also help create policy because you can explain in natural
44:04
language what is it that you want to do and it can create the
44:07
security policy that that is most relevant.
44:10
So that allows you to take that whole process closest to the
44:14
business that you know, the application owner, the business
44:18
owner, the person who is, you know, taking the product to the
44:22
market or trying to do something.
44:25
They can make that policy by explaining in simple, you know,
44:30
English terms, you know, simple language, natural language, what
44:35
is it that they're trying to achieve and the policy can be
44:37
done automatically. Those are those are probably the
44:41
two most important things I think AI can can help a business
44:47
from an identity and security perspective.
44:50
Yeah. I'm real excited to see where
44:52
and how this is going to affect everybody.
44:54
Obviously, selfishly the identity space, that's what I
44:56
pretty much care about, but I'm very bullish on it.
44:59
Well, you know, this shows moniker or we've been told it's
45:04
getting started to be called. A I at the center.
45:08
So we have to have the obligatory a I question every.
45:11
Week you got to you got to adapt, evolve, overcome, right?
45:16
I mean, so as things change, who knows, right?
45:19
Maybe I a I goes away and it's less important, but right?
45:22
Certainly it's in the zeitgeist right now.
45:24
I don't think it will. But who knows, right?
45:26
We can always adjust. Barbara, let's end on a lighter
45:29
note. I wanted to ask you about an
45:32
Iron Man that you just competed in and lost.
45:36
To somebody. Do you want to talk briefly
45:39
about that? Because I also know I want to
45:40
talk about candy after that. Well, I wouldn't say last, last,
45:44
last, last. I'm just impressed that you
45:47
actually did it. We were talking about this and I
45:50
think explain Iron Man because I started asking about what are
45:54
the different fractions of Iron Man and how can I watch them.
45:58
Not necessarily participate. Watch.
46:01
Yeah. So Iron Man is is really a brand
46:05
for for a triathlon. We just did the Iron Man 70.3 in
46:14
Oregon. It's a beautiful venue.
46:17
I encourage everybody to do that one.
46:19
Amazing, you know Salem OR amazing town, amazing people and
46:25
and an amazing venue. So so the three legs of a
46:28
triathlon are you know swimming, biking and running and they
46:32
always do it in that order because you know you don't want
46:35
to do the swim when you're really tired.
46:37
The, the, the, you know prospect of drowning increases as as you
46:44
get tired. So they always start with the
46:46
most dangerous aspect first. So start with the swim, then you
46:50
do the bike, then you do the run.
46:51
Because you know when you get, when you when you fall over,
46:54
when you're running, it's much, much closer to the ground than
46:59
even from a bike. So 70.3 is is what used to be
47:04
called half iron, and that means the 1.2 mile swim, 56 mile bike
47:08
ride and then a 13.1 mile run which is half a marathon.
47:14
And that's what we just did in in Oregon.
47:17
And yes, I was, I was behind considerably like hour and a
47:24
half behind me and my partner. But you know, she deserved it
47:32
because she actually focused on the training and I kind of
47:36
goofed off a lot. So, so the results book for for
47:41
how we how we trained for it. All right.
47:44
Well, I like I said, I'm impressed that even, you know,
47:47
got out there and did it. I certainly should not be
47:51
involved with any of that right now.
47:52
I would probably die of a heart attack like 30 seconds in.
47:55
I want to talk. You should try it, Jeff.
47:58
Start with the start with the Sprint and the and the Olympics
48:04
length triathlons. Right.
48:06
Don't jump into the Ironman, but you'd be amazed.
48:10
You'd be amazed of the support, the community, the, the fellow
48:15
athletes and and the and the feeling of accomplishment as you
48:21
go through that finish line. It is absolutely amazing.
48:26
You're thankful for being able to do those things right.
48:31
We don't think about those things normally, but when you do
48:34
all those things and you're able to do that, you're like, you
48:36
know what? Yeah, the universe is.
48:40
The universe is helping me. I find sports like running and.
48:46
Lifting weights. Boring for me because I like
48:48
competition and team sports. It's like I'll play basketball
48:52
all day long, like literally all day long if I if I could.
48:57
It's just something about like running.
48:58
I find it boring. It just doesn't like mentally
49:00
stimulate me. But like I said, I'll play
49:02
basketball, football, you know, stuff like that.
49:06
You know, all the time we're running short.
49:08
But I want to ask about candy, and this stems from a
49:12
conversation. That Jim and the team here at
49:16
RSM had earlier this week. We try to do like a team
49:20
building sort of thing every other week or so.
49:23
It's just we call it the the mandatory Chuckle club or
49:26
something like that. We used a I to come up with a
49:29
name and it's basically just like an open door where we have
49:32
like a meeting invite set up and we can you know, have people
49:37
kind of come in and just kind of talk whatever, if they can make
49:39
it great. If you can't, whatever.
49:40
And we start talking about candy.
49:43
And Jim has some serious serious, I don't know, thoughts,
49:50
likes just likes. Candy.
49:51
Finally, a subject that I'm an expert on.
49:55
Yeah. So he had a whole like we.
49:57
So I was like, all right, let's let's get serious about about
50:00
this. We put together like a tier
50:01
ranking we had. We showed Jim a bunch of
50:03
different candy pieces and had him rank them.
50:07
Snickers was on top as like S tier along with Reese's.
50:12
Peanut butter cups. And then we started talking
50:15
about candies that we don't like, and Jim had some opinions
50:18
about that. So that's today's lighter note.
50:20
What is a piece of candy or whatever it is that is just your
50:27
least favorite? The least favorite for me would
50:30
be any kind of gummy Berry type things.
50:34
You know, Swedish fish, gummy bears, any of those gelatinous
50:39
things that that you know have that strange gluey structure?
50:47
It's that unnatural. It's not.
50:49
It's not from nature. All right, Jim, tell me, what's
50:53
yours? Because you had a.
50:54
Few so I have to explain. We have to explain scoping for a
50:58
second, which is you're using this app which lets you create
51:03
like a almost like a magic quadrant, but it was more more
51:07
vertically oriented and the bottom.
51:11
But you only had choice of the candies that they had there.
51:15
There are more, but I think they picked some really solid losers.
51:19
And let me pit tell you some of the real garbage candies that
51:23
are out there. First off, Mike and Ikes, they
51:26
are garbage. Jelly beans are disgusting.
51:31
Whoppers are. Candy corns.
51:36
I don't even consider them candy, so I had to pick what's
51:40
what's up with that, right? Is it corn or is it candy?
51:43
Both. I think it's neither.
51:45
I'm with you, Jim. See, I like.
51:48
Candy corn. You don't eat them, though.
51:49
You like the football thing? I'll eat them, yeah.
51:52
So I I use candy corn to explain football formations to my wife.
51:57
So we would have the candy corns would be like receivers and
52:00
running backs and quarterback and then.
52:03
Around, you know Halloween, you've got the pumpkin candy
52:06
corns. Those have become like defensive
52:08
lineman or offensive lineman, right?
52:09
Stuff like that. So I explained defensive
52:12
formations when, you know, very early on in our relationship to
52:16
help her kind of understand American football.
52:18
I should probably be, you know, clear on that.
52:20
So there is a spot and at least in our house for it and and I
52:23
like candy corn. I I don't can't have too many of
52:25
them. They're just way too sweet.
52:26
But I don't detest them as Jim obviously does.
52:30
Well, here's the thing about this conversation, right?
52:32
This is one of the few areas where we can all sit down for a
52:35
civil conversation, have strong opinions.
52:38
It's not religion or politics, right?
52:40
So you could This is fair game for any party.
52:43
And I'm sure I'm saying some things that some people out
52:46
there are like, no, you are wrong.
52:49
Whoppers are not horrible. But guess what I'm going to say?
52:52
Whoppers are my least favorite candy I could have.
52:57
Packs and packs of Whoppers in my kitchen and nothing else.
53:02
And I would go hungry. They're terrible.
53:05
Interesting. I, you know, I don't mind a
53:08
Whopper. It's not my favorite, but I it
53:10
doesn't feel like it's in that category for me.
53:13
I I don't really like peanut butter.
53:15
So things like Reese's Pieces and Reese's Pieces Bits, that
53:19
kind of stuff doesn't do it for me at all.
53:22
I mean that's I like, I like peanut butter, but only on
53:26
bread, right? I don't really like it when it's
53:30
in it's solid form in a in a peanut butter a.
53:33
Peanut. Yeah, which is crazy because I
53:36
love a Snickers bar and that's packed full of peanuts, of
53:38
course, right? So that's like my favorite
53:41
thing. But I just don't like peanut
53:43
butter. So like Reese's Pieces and those
53:46
peanut butter cups, just, they don't do it for me at all.
53:48
So those those are definitely favorites.
53:50
I don't know if I would say I would go hungry if they were in
53:52
the house and just not eat them, but.
53:56
That was Jelly beans. I don't mind Jelly beans.
53:59
I mean, the black ones are gross, but Jelly beans are fine.
54:03
I'm not a I'm not a Jelly. I mean, they just don't appeal
54:06
to me. Yeah, I would not go seek it
54:08
out, but it was there and someone handed to me.
54:10
You know, I'm taking candy from a stranger.
54:12
I would. I would eat it.
54:14
You know, if somebody gave me a Christmas present and it was a
54:17
nicely wrapped box and there was like an ugly sweater inside a
54:20
pig. Oh, beautiful sweater if someone
54:23
gave me a box of. Jelly beans.
54:26
I'll probably throw it at them. That's how much I hate Jelly
54:29
beans. So I think we have.
54:31
So Jim, there are these Jelly beans, and I just got them for
54:34
Christmas from a vendor. They're champagne Jelly beans.
54:38
Now. I still didn't eat them, but
54:40
what do you think about those? Well, I've never had them, but
54:44
I'm pretty sure I don't like them.
54:47
All right, so here's a community challenge, if you feel like.
54:51
I don't know sending Jim a LinkedIn picture of like Jelly
54:53
beans or whoppers. I'm sure he would totally
54:56
appreciate that. Not too many, you know, maybe
54:59
just one or two here or there sprinkle throughout just to let
55:02
you know that you know, you're thinking of him.
55:04
Maybe next time you have either of them, I'm going to actually.
55:08
So we have this tier list that we put together using some some
55:13
web thing that I found to to help the conversation.
55:16
I'll put it up on our Twitter. Probably before this episode
55:20
airs as sort of like a teaser to stick it for people to stick
55:23
around to the end and hear the the fascinating conversation and
55:27
opinions that that Jim has around Candy.
55:30
We're going to go ahead and wrap things up for this week.
55:32
Bob or thank you so much for taking the time and spending
55:35
with us. I'm glad that Andy hooked us up
55:36
at the Identifiers Conference and we're able to.
55:39
To have a conversation to get to know each other, I'm going to
55:41
have a whole bunch of links in our show notes so people can
55:44
connect with Bob around LinkedIn.
55:45
We'll have a link to viridium.com, VERIDIUMI d.com so
55:52
people can learn more about Viridium.
55:54
We'll have a whole bunch of links around the Cybersecurity
55:57
Midwest Summit, Identity Week America, the Authenticate
55:59
Conference, the discount codes we have for those, and you can
56:02
always find us on the web at IDAC podcast.com.
56:06
We're on Twitter or X or whatever the heck it is.
56:09
Idacpodcast. We're on Mastodon, idacpodcast,
56:14
infosec, dot exchange, Like, subscribe, tell a friend, tell
56:17
an enemy. We don't care.
56:19
As long as somebody's listening. We'll keep doing what we're
56:21
doing. Thanks everyone for listening
56:23
and we'll talk with you all in the next one.
56:26
You've been listening to Identity at the Center.
56:30
We hope you've enjoyed the show. Make sure to like, rate and
56:34
review and we'll be back soon. But in the meantime, hit the
56:37
website at identity@thecenter.com and find
56:41
us on Twitter at IDAC Podcast. See you next time on Identity at
56:49
the Center.