Latest / Identity at the Center / #247 - Big Areas of Identity to Solve with Matt Caulfield of Cisco

Transcript

#247 - Big Areas of Identity to Solve with Matt Caulfield of Cisco · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:25
Hey, Jim. Hey, Jeff.
0:27
How are you? Oh, not so bad.
0:28
Yourself doing great. I think today's going to be a
0:31
big day for banter because, you know, I always usually have one
0:36
idea that I want to go off on, but today I've decided that
0:40
they're actually 4 things I wanted to go off on or at least
0:43
mention. So the first thing is our
0:46
YouTube channel. You know, props to you because
0:50
you've used technology to get all of our past episodes
0:54
uploaded onto YouTube and now YouTube must realize that I'm a
0:58
fan of the show. I'm subscribed to the show and
1:01
it's letting me know about all these great past episodes that
1:03
are out there on YouTube. So, you know, for us, I think
1:08
you know, props to you. But also I would say to all of
1:11
our, you know, regular listeners, please go out there
1:14
and subscribe to our YouTube so more people can find it.
1:19
And I think YouTube does really good job of like pushing content
1:23
at people, right. I mean, that's kind of what
1:25
Google's good at, is knowing your.
1:27
Preferences, yeah, you're at, you're in the algorithm
1:30
somewhere, somewhere you you must watch a lot of identity
1:34
stuff as an identity nerd like I am.
1:36
But yeah, it's been the way it works is basically three per
1:40
day. So we're not like killing feeds
1:42
and stuff like that. It'll catch up and then it'll
1:44
become, you know, one a week or so based on how or often.
1:48
However, often we record an episode, but that's, that's it.
1:52
Yeah, I'd like to put the word out there also for you know
1:55
folks who are in the industry maybe on the marketing side like
2:00
use YouTube, get content out there.
2:03
I, you know, I worked with, I probably shouldn't name the
2:08
vendor, but it let's just call it a legacy.
2:10
I am vendor. I worked pretty heavily with
2:12
that with their technology, like 10 years ago.
2:15
And I was meeting with a client earlier this week talking about
2:18
that technology. I'm like, hey, let me brush up
2:20
and go out there to the YouTube channel and all the videos were
2:23
like uploaded 10 years ago. I'm like, these are the ones
2:26
that was pushing me. I was like, man, that's really,
2:29
really bad. So, yeah, yeah, make that
2:33
investment, folks. Yeah, it's some content is
2:37
timeless and some is not. It's probably the best way to
2:40
say it, yeah. Demos are demos are not
2:43
timeless. So topic #2, Thanksgiving is,
2:49
you know, right upon us. It's a great time to get a
2:51
break, especially from the road. I mean, it's probably going to
2:54
be the first week you haven't traveled in months, maybe the
2:57
only week you don't travel until, you know Christmas time,
3:01
right? Yeah, let's see.
3:03
I'm recording right now from a hotel room in Minneapolis area,
3:07
and the Wi-Fi sucks, so I'm hopeful that this comes through.
3:12
OK, so far so good. We'll see how it lasts, but.
3:16
Yeah, I think this is my either 12th or 13th week.
3:18
I think on the road going somewhere, got a break next week
3:22
for Thanksgiving. So today is November 14th as
3:25
we're recording this. And then let's see.
3:27
And then, yeah, I'm going to New York City and for December 1st
3:33
event that we're going to talk about here in a second, yeah,
3:36
Yeah. So that's going to be something
3:38
that's also on my list. But #3.
3:42
So a client mentioned to me today like, hey, it found that
3:47
you do a podcast and I've been listening to podcasts and that's
3:51
awesome to hear. Of course, you know, new people
3:54
are finding the podcast all the time.
3:56
And that's why we spend such a a large amount of our effort
4:00
focused on, you know, getting the word out there or making
4:03
sure that we show up in all the algorithms and because there's
4:08
new people looking for this type of content all the time.
4:10
So please go out there, you know, and like I don't want to
4:15
like shill for, you know, likes and subscribes and all that.
4:19
But that's unfortunately. Unfortunately, that's how it
4:23
works. Hit that button, Smash that like
4:25
button. Yeah, terrible.
4:28
But also I talked to this client today and I mentioned, you know,
4:33
we're going to have Matt on the show.
4:34
We're recording with him later today and he's one of those big
4:38
brains in the industry and because this person is not like,
4:42
you know, necessarily directly in our industry, he he didn't
4:49
know Matt. Matt does a great job of, you
4:52
know, getting his name out there.
4:53
But I said look, you know, he's going to be a fantastic guest.
4:56
Make sure you listen to this episode.
4:59
So these, this episode is going to be one of those really good
5:03
ones. And then the last thing I wanted
5:05
to bring up was just, you know, one of the things I've got a lot
5:10
of gratitude in my mind for, you know, the company we work for,
5:14
RSM sending us to all the conferences over the past year.
5:18
Because I realized like I'll be talking to clients and bringing
5:22
up things from a conference perspective and like what's hot
5:25
and like what You know, really when you go to these
5:28
conferences, you're being exposed to the cutting edge and
5:31
you're being exposed to what's happening in the industry,
5:34
what's happening next. And when you talk about those
5:37
things and folks who aren't going aren't on the IEM
5:40
conference circuit, they're not aware of those things sometimes.
5:43
So you know, it's it's a major benefit to be able to go to
5:49
those conferences and play a part and hear those things more
5:52
than one time a year because that's really where our
5:56
industry's heading. Yeah, I mean, it's a good, it's
5:59
a good time to, you know, learn more what the industry's doing,
6:01
I think. You know, I spent the 1st 12
6:04
years of my career in Identity, you know, working for two
6:06
companies. And you'll really learn how
6:09
Identity works at the company that you're at.
6:11
And going to conference is a great way to see how other
6:13
people are doing it and try to get those ideas and, you know,
6:15
stay current. I think that's the challenge
6:17
that most organizations have, is staying even just current with
6:21
where things are at. You know, there's a lot of
6:24
legacy thinking still out there. I still see a lot of, oh, we
6:27
change our passwords every 90 days.
6:29
OK, well. That was cool.
6:31
Like four years ago. Hasn't been a standard or even
6:35
recommended by like NIST for the last like three or four years.
6:38
I think it is so, but there's still a lot of people just
6:40
haven't gotten that word out there.
6:41
So definitely a good way to like learn stuff.
6:43
And I think that's a good segue into where I'm going to be on
6:46
December 1st. Is it OK if I bring that up?
6:50
Yeah, go for it, man. I'm I'm through my list now.
6:52
I Those are my my random topics of the day.
6:56
All right. So I'm going to be in New York
6:59
City on December 1st. Identiverse is hosting regional
7:03
events December in New York and Chicago.
7:05
If you're not familiar with Identiverse, it's one of the
7:07
best identity conferences of the year.
7:09
And what they've started to do is the smaller kind of regional
7:11
events. So hopefully if you're in New
7:13
York, you'll see me, I don't know, walking around the
7:18
whatever, whatever the venue is. I have not been one of these
7:20
before. So I'm interested to see how it
7:21
kind of turns out. But it'll be Friday, December
7:24
1st in New York. And then there's another one in
7:26
Chicago that I will not be at. So you can like just join
7:29
yourselves, I guess, on Tuesday, December 5th.
7:33
So they have kind of things coming back up right around the
7:35
time I started looking at the speaker's list.
7:38
So like, Andy Hindle's going to be there.
7:39
Who's been on the show a couple times.
7:41
They got some other cool folks who are going to be there.
7:42
So it seems like kind of a cool little thing.
7:44
And the best part is that it's actually free.
7:46
So it's a free conference. It's in New York City.
7:50
It's in Chicago. Space is pretty limited though,
7:52
so you want to make sure you get registered.
7:54
And we of course have a link that we can share with folks.
7:56
It's a Bitly link, which I'll be honest, I'm not a fan of because
7:59
you never know what's behind the Bitly link.
8:02
But I don't know if this, you know, I assure you there's
8:05
nothing nefarious back there. But yeah, I should take my word
8:07
for it, but it's a bit dot LY slash ID VR23-ID A/C.
8:14
I know it just rolls right off the tongue, so I'll have a link
8:17
in our show notes so people can kind of check that out.
8:20
It includes breakfast, so score there.
8:22
And for people who are scrambling at the last minute
8:24
for any like CPE credits, you actually get 3 credits for
8:28
attending. So pretty pretty cool option
8:31
there for people who are interested.
8:33
I wasn't sure if I was going to be able to New York, but I'm
8:35
going to try to get out there for the first.
8:37
The same goes. There's no such thing as a free
8:39
lunch, but apparently there is no such thing as a free
8:43
breakfast. You know, I think it makes more
8:45
sense for local people because I started book hotels today and Oh
8:49
my gosh, they are crazy right now.
8:52
So fortunately I have a couple of client meetings and things
8:56
like that to kind of tie it all together.
8:59
But the money that you save on your registration maybe goes
9:03
towards, I don't know, cab, train, air, hotel fare, whatever
9:08
it may be. Yeah.
9:10
I think there's there's two benefits.
9:12
One is the benefit you get yourself, but also if you're in
9:15
the area like support this kind of thing, you know, I I think
9:21
it's great that identivers is reaching out and starting to do
9:24
regional events and I hope there are more of them in the future.
9:29
If we're if this happens and they get a very poor turn out,
9:33
they're less likely to do it again in the future.
9:36
And I think that would be a shame.
9:39
Oh yeah, for sure. I think like I like Identiverse.
9:41
I think it's one of my favorite. I think it's the best or one of
9:44
the best identity conferences in the US at least.
9:47
And I'm not aware of them doing this in the past.
9:50
And we kind of find out found out about this kind of late in
9:52
the game. You know we're only a couple
9:53
weeks really since you know till the first one.
9:55
So I I don't know if it was primitive for because I hadn't
9:58
heard of it until what, a couple days ago.
10:01
I think when you know they reached out, you know, asking if
10:03
we'd help get the word out, so. I'm curious to see what it'll,
10:07
you know, what kind of environment it'll be and kind of
10:09
who shows up and kind of things like that.
10:10
But yeah, it'd be interesting to see how it goes.
10:13
I'm sure it'll go well, like the the speaker list is great.
10:16
The people who are presenting are all good speakers and
10:19
usually have pretty good content.
10:20
So I'm not concerned about the content.
10:22
I think it's more right now just kind of awareness is probably
10:25
the the struggle like anything, right.
10:27
People are still discovering identity and this podcast and
10:30
other things like that. OK.
10:33
Why don't we turn to our guests, cuz you kind of teased them
10:35
already. Let me introduce Matt Caulfield.
10:38
He's the founder and CEO of Oort, which is now part of
10:40
Cisco. Welcome to the show, Matt.
10:43
Thank you, Jeff. Happy to be here.
10:44
Thanks for having me. Yeah.
10:46
Thank you so much for taking the time.
10:47
And I feel like I've we've seen each other a couple conferences
10:50
earlier this year and it's like hey, glad to go finally get this
10:54
conversation going. One of the first, one of the
10:57
first things we do when we have someone out for the first time
10:59
is kind of talk about identity, backgrounds and.
11:01
How people got into the space? How did you get into identity?
11:04
Is it something that you chose or did it choose you?
11:08
I've kind of fell backwards into identity.
11:11
I'm a networking guy. That's my background networking,
11:14
distributed systems, cloud, virtual networking.
11:17
I I started ORT in order to solve this problem of
11:23
distributed access and when we started talking to Chief
11:27
Security officers about how they secure remote access.
11:30
And actually accomplish zero trust.
11:33
Everything kept pointing back to identity as the linchpin, as the
11:38
foundation. And it turns out, like getting
11:41
packets to the front door of an application or a resource is a
11:46
lot easier than this big hairy problem, which is identity.
11:51
And so, me as an entrepreneur and my Co founder Didi, we
11:56
gravitate towards these big audacious problems that we need
11:59
to solve. And I suddenly transformed over
12:03
the course of the past few years from a networking person to the
12:06
identity guy. How much does that networking
12:08
background help you on the Identity side?
12:12
I think it gives me an outside perspective.
12:15
Like I see identity today as where networking was maybe 20 or
12:21
30 years ago, where there's a realization that, oh shoot, if
12:25
someone gets into your network, you're screwed as a business.
12:29
And now we're having the same conversation all over again,
12:32
except we don't have all the tools that networking has built
12:34
up over the past 20 years or all of the discipline and regimented
12:40
concepts of like network topology and network architects
12:43
like we do in networking where there's like this plethora of
12:48
training around. I think people now are realizing
12:51
like, no, this is like a true discipline in in the enterprise
12:55
world and we need to give it just as much, if not more
12:58
attention. In terms of identity security,
13:00
as we've put into network security, Amen.
13:04
Yeah, preach on, brother. This is an easy crowd.
13:09
Yeah, you're you're talking to a very friendly audience of this.
13:12
I I imagine people listening to, you know, are in the space right
13:15
there come from all walks of life.
13:17
And I think I think the it's sometimes easy to draw the
13:21
parallel like I can see the direct connection right between
13:23
like networking and identity. But sometimes there's
13:26
backgrounds we come across as like, oh, I didn't really kind
13:28
of think about that. I mean, customer service, you
13:31
know, waiting tables, bartending.
13:33
I have a lot of background on that.
13:34
You know, that a lot of that goes to program management and,
13:36
you know, making sure we understand, you know,
13:38
psychologies of people and things like that.
13:40
So it's very cool to kind of hear those backgrounds.
13:42
I'm very curious about the ORT name because the Ort Cloud is
13:46
theorized to be a vast cloud of icy plantacism surrounding the
13:50
sun. The concept of such a cloud was
13:52
proposed in 1950 by the Dutch astronomer Jan Ort.
13:55
And that's why this is named After that he proposed that the
14:00
bodies in this cloud sort of replenish and keep constant the
14:04
number of comets that are entering this inner solar system
14:08
where they get eventually consumed and destroyed by the
14:11
sun. So that's me being very clever
14:14
and pulling things from Wikipedia.
14:15
I'm not that smart normally. How did the name war come about?
14:18
Is there anything any relation to there or is it something
14:20
different? That level of detail, we have
14:23
not got it. We've gotten all kinds of
14:27
questions on the name, like how do you pronounce it?
14:29
Is it an acronym for something? But no, you are 100% correct.
14:34
We are named after the Ort Cloud, which is in turn named
14:38
after Yan Van Ort, Dutch astronomer.
14:40
It's pretty interesting guy reading about him, the things
14:43
that he accomplished and discovered.
14:46
But the reason why we're named ORT and after the Ort Cloud.
14:50
Is because you can think of that or cloud of these kind of comets
14:53
and asteroids and tiny planets orbiting the solar system.
14:57
In the same way you think about all of the identities that orbit
15:01
the typical enterprise organization.
15:03
And the fact that if you knock any single one of those
15:07
identities off course, you can send it hurdling on a collision
15:11
course with the inner solar system, with your data and your
15:14
applications, and you know the rest of your user base.
15:16
Like that's where that analogy comes from.
15:20
I wonder if Yan Hort thought that you know however many
15:24
years, 50 years later there would be a company made after
15:27
him around identity. I feel like this is a question
15:30
we should always ask. You know any of the any of the
15:32
technology vendors we have like I'm always fascinated to hear
15:34
like where names come from, from the company perspective and you
15:38
guys got acquired by Cisco. Can you describe your role at
15:41
Cisco and how has your, I don't know, day-to-day changed with
15:44
that transition? Yeah.
15:46
So Cisco's an incredible acquirer.
15:49
They they've done over 250 acquisitions.
15:53
They know what they're doing and we're really happy with the
15:56
outcome to be part of Cisco. My role has evolved from being
15:59
founder and CEO of ORT, which is sort of an all-encompassing role
16:04
where I need to worry about setting the vision and hiring
16:07
the team. And not running out of cash and
16:10
pursuing investors to being enabled to just get focused on
16:15
where the market and identity is going.
16:18
And the reason for Cisco acquiring Wart is the same
16:22
reason that I fell into identity in the 1st place, which is that
16:26
there's a realization that identity is new perimeter, but
16:30
it's a horrible perimeter. It's it's not even chain link
16:33
fence. I was talking to one of the
16:35
executives at. And the security group here is
16:38
like, yeah, identity as a perimeter today is like a a
16:41
string of rose petals across a lawn.
16:43
That's where we're at today in terms of defending the identity
16:47
perimeter. And Cisco is a security company
16:50
and as a networking company realizes that they have a pretty
16:53
important role in the market to. Bring together an identity story
16:59
that works with security and that works with networking.
17:02
It's like that's the reason for the acquisition and my role
17:05
within Cisco now as AVP of product within the security
17:09
business group is to help realize that identity first
17:13
security vision inside of Cisco and help bring that power to our
17:18
customers. And Matt I started off in the
17:21
call calling you one of the big brains and you know I not to not
17:27
to make your head big or anything, but you know we're
17:29
we're prepping for the show and obviously knowing that the
17:33
background of art was it was a ITDR play if you will.
17:39
And so my mind was tuned to let's talk about ITDR and and I
17:45
do want to talk about ITDR because I still think it's one
17:48
of the biggest advancements in the past five years in our
17:53
space. But I want to talk about all
17:56
these other subjects as well. But maybe we just do start with
18:00
ITDR. Can you, before you kind of go
18:03
deep, just stay real shallow and give us a, you know, what is
18:07
ITDR and is it the same thing for everybody?
18:11
Right. But what is ITDR?
18:13
And then why do you think it's going to be like, what was your
18:17
mentality that like this is what we're going to focus on because
18:21
this is the game changer? Yes.
18:23
So ITDR is near and dear to my heart as an acronym just because
18:28
we built our business around it. That was the wedge that we used
18:31
to become successful in the market.
18:34
That's a lot of the reason why a company like Cisco invested in
18:37
US and eventually acquired the company was because of all this
18:41
momentum about this four letter acronym.
18:45
ITDR to me is like one piece of the identity security puzzle.
18:50
And so I usually start top down. So I appreciate you saying the
18:53
big brain comment, I don't know if that's good or not.
18:56
But I I think in terms of like top down first principles, we
19:00
need to build an identity security pillar in enterprise
19:04
security just as much as we have e-mail security, network
19:07
security, device security, endpoint security, we need an
19:11
identity security pillar and what is that pillar made-up of?
19:15
There are three. Sub colors.
19:18
I often say Legs of the Stool and identity security and I'll
19:23
get to itdr. I'm not forgetting that the
19:25
first leg, though, is just the identity attack, Surface
19:28
discovery, the ability to see what are your identities?
19:32
What do they have access to? What are they doing with that
19:34
access? That visibility is the first leg
19:37
of the stool. The second leg of the stool is
19:39
this other new acronym that a few startups are talking about
19:42
that nobody's quite claimed yet. Which is identity security,
19:46
posture management, this idea that and there's everything has
19:51
security posture management, You have data cloud, whatever.
19:54
Now we have identity security, posture management.
19:56
That's the second leg. And that's more of the proactive
19:59
part of finding vulnerable identities and fixing them.
20:03
And then the third like the stool which is sort of a catch
20:05
all if you don't have great visibility and you don't have
20:09
great kind of posture management for your identities at the very
20:12
least. You can do identity threat
20:15
detection and response ITDR, and the reason for that is even if
20:20
things get through, you can catch them by looking for
20:22
specific patterns. And so the reason why ITDR is
20:25
popular is a few reasons. One is because UEBA got sort of
20:30
a bad name for itself over the past few years as being a very
20:33
noisy way to detect user anomalies like that's one
20:37
reason. The other reason is that with
20:40
the pandemic and everybody moving to working from home
20:44
suddenly this phrase identity is new perimeter became a reality
20:48
overnight. And then the third is that there
20:51
were a slew of acquisitions last year with with a TiVo for
20:58
example and pre EMPT before that that kind of kicked off this new
21:02
wave of identity threat detection that caused Gartner
21:07
again last year I think around February or March to say that
21:10
ITDR identity threat detection and response would be one of the
21:16
major security trends in 2022 and now in 2023.
21:21
So that's that's kind of all the background.
21:23
The reason why we got into it was actually from the posture
21:26
angle. We started with hey, how do we
21:28
help our customers detect inactive accounts.
21:30
Remember I got into this from zero trust networking.
21:33
So how do we help a customer become zero trust ready?
21:36
It's by cleaning up their vulnerable identities so that
21:39
when somebody authenticates, they can trust that that
21:42
identity is truly who they say they are.
21:44
And you can get the policy to do zero trust from there.
21:48
We evolved from posture management into ITDR at the same
21:52
time that ITDR was taking off as a category and it just for
21:57
whatever reason is a way more interesting starting use case
22:01
for security teams than the posture management thing.
22:05
It's posture management is hygiene.
22:07
It's like brushing your teeth. It's not that exciting.
22:09
The ITDR piece is really what gets people excited.
22:12
It's looking at attackers. It's looking at their patterns
22:15
in a way that we haven't before. So I'm really glad that you
22:18
brought up the UEBA kind of, you know, to use that Gartner term,
22:23
the through of disillusionment because it felt like, oh, this
22:27
is this is potential. And like when Jeff and I thought
22:31
about identity at the center, UEBA was a big part of that
22:35
picture where it's like it's going to.
22:38
Detect the anomalies and then I don't know.
22:42
So to me that was where the UEBA, the disillusionment was
22:47
and then it's going to what, throw it on dashboard.
22:50
But I feel like you tied the lineage of ITDR back to UEBA.
22:56
But the ITDR, the R is very important, right?
22:59
The R is like, now we can answer that question, what are we going
23:03
to do? Or at least we have a way to
23:06
configure it to do something. Because to me it's like, oh, now
23:10
we spotted some anomaly. Now we can disable an account,
23:15
kill off a session, things like that.
23:18
That's a really important observation.
23:19
UEBA, user endpoint, behavior analytics, I guess if you're
23:23
doing analytics like So what like what are you going to do
23:26
with that? Just stare at a dashboard all
23:28
day? To your point, ITDR kind of
23:30
builds in this concept of both the detection and the response
23:34
and that's something that at ORG we got really good at was was
23:37
doing the combination of high fidelity detections that were
23:40
not noisy and really clear recommended response actions
23:45
including actions like quarantining an account, killing
23:49
active sessions, opening tickets.
23:52
Things like this become really natural once you have that R in
23:56
the ITDR. Yeah, they are so important, I
23:59
kind of feel like. At the core of identity is about
24:02
trust, right? And if you have somebody coming
24:05
in and they can present the credentials and you let them in,
24:10
it's missing an element. Or the trust gets destroyed when
24:13
someone can do that or some machine can do that, and there's
24:18
nothing realizing like, OK, this is a machine.
24:21
So to keep things simple, I kind of think of the ITDR.
24:27
Especially around authentication systems because I think that use
24:31
case just makes sense to people. In other words, oh, I have the
24:34
headless browser coming in or have something where it's like
24:38
the IP address just changed or something that is like a very
24:42
clear indicator. The reason I also think about
24:46
that use case is I was just at the Octa conference and I've
24:49
talked about this on the podcast quite a few times.
24:52
You know, this is something that Okta said, oh, well, we're going
24:56
to right now they have Threat Insights and they're moving to
25:00
identity, Threat protection. It's going to be a new feature
25:04
and they as much as made the statement, you will not need an
25:08
additional ITDR system. Our system's going to have it
25:12
built in. So is that, is that what we're
25:16
going to see more and more or? Is, is there still that use case
25:20
out there that people should be investing in ITDR?
25:25
It's a great question. So First off, yes,
25:28
authentication systems are a really good choke point to do
25:32
detection and response like 100%.
25:35
It's kind of like the the gateway, the network gateway, to
25:38
use that analogy, 20 to 30 years ago is like a good point place
25:42
to put your firewall because all the traffic's going through it.
25:45
Now that perimeter is the identity.
25:48
And so putting ITDR around the authentication, looking at the
25:52
telemetry makes a whole lot of sense.
25:55
Now will the IAM platform providers like Okta and
26:00
Microsoft just make ITDRA feature of the platform.
26:06
I think they need table stakes capabilities to check that box
26:09
and that's really important. And we have a great relationship
26:12
with the teams at Microsoft and at Okta, and we respect them a
26:15
lot. I don't think that security
26:20
teams are going to necessarily trust those vendors to secure
26:24
themselves 100% of the time. So you might buy an Apple
26:29
MacBook, you might buy a Lenovo Windows machine, and you might
26:37
trust to some extent like Windows Defender, maybe for a
26:41
small business up until a certain point.
26:42
But a lot of companies will go and invest in Crowd Strike, have
26:45
something else that's looking at these different systems and just
26:48
getting a different view into whether there are endpoint
26:52
problems, threats. Same thing is true in Identity,
26:57
where you might invest in a whole slew of different identity
27:02
tools in your architecture. You might have like work day
27:05
where identities are born and then Cell Point copying them
27:08
into Active Directory and then from there they're picked up by
27:11
your SSO system like an Octa. No single IAM system has really
27:17
become that top of stack and that's where ITERA good ITDR
27:22
solution can really help beyond the built in capabilities that
27:28
like Microsoft's risky users feature might have beyond what
27:32
Octa might be doing with threat detection.
27:34
A good ITDR can take all of those risk signals and create a
27:38
kind of a lower noise, truer or higher fidelity signal out of
27:44
them, so you have a lower rate of false positives.
27:47
And so as we are preparing for this episode, you know, going
27:51
beyond itdr, you started to bring up some of the areas that
27:55
you know you feel are like these are the the main things
27:59
identity, digital identity, industry that the industry needs
28:03
to solve. You brought up one that hasn't
28:06
been on the tip of my tongue anyway.
28:09
So it was data plane side of identity, the data plane side of
28:13
identity. So explain for us what that is.
28:18
Yes, again, my my network background is kind of leaking
28:21
into how I think about identity. So in the networking world, we
28:25
think about the data plane, the control plane, the management
28:29
plane, the analytics plane or policy plane.
28:31
Like these planes of existence loosely tie into this idea that
28:36
everything is just layers like the OSI model in the TCPIP
28:40
stack. So when I say data plane of
28:42
identity, what I'm really referring to is the actual
28:46
protocols that make authentication authorization
28:48
work. I think there's a realization
28:50
right now that the lack of kind of continuous trusted access and
28:55
the lack of, you know, continuous access evaluation is
28:59
leading to this whole new pedigree of threats around
29:04
session hijacking And a whole lot of ways to pull that off
29:07
where we need to start rethinking how that data plane,
29:10
the fundamentals of those protocols are actually
29:13
implemented to support more of a continuous trust model rather
29:17
than a one time authentication model.
29:19
Two things you said there really trigger me, which is the session
29:23
hijacking, which is very real, right?
29:25
I mean, we've seen in the news very recently and it's.
29:31
Something that needs to be addressed and the continuous,
29:35
which I think kind of like you know that that champions the
29:39
ITDR because a hijack session should be something that you
29:45
pick up that hey, the person, the device that started this
29:49
session is no longer the device that's trying to use the
29:53
session. That should be a major red flag
29:55
and immediately caused some kind of re authentication.
29:59
And then the continuous authentication.
30:01
And I just feel like we need a grounding of everybody agreeing
30:05
on what's the definition of continuous authentication.
30:09
So I've seen some really cool technologies where like you go
30:13
up to a computer when somebody leaves the room and your
30:16
keystroke cadence kind of like. That the the system realizes
30:21
that's not the same person or if you look at like the improvata
30:25
solution with the prox cards, log in, log out based on your
30:29
proximity. I mean that's certainly
30:32
continuous authentication. And then there's kind of like
30:35
the risk based authentication. You're moving from you know, one
30:39
risk level to another or you're increasing your own risk and
30:44
therefore you're triggering a re authentication.
30:46
So it's more of a. A simplistic model, but you know
30:50
are the are, is that really both continuous authentication?
30:54
Because they're they're quite different, right?
30:57
So I think that one model that makes sense to mitigate this
31:01
risk of session hijacking is the first thing you describe.
31:04
Which is all right if we're not going to fix it at the data
31:06
plane layer. Let's fix it at the analytics
31:09
layer by using ITDR to detect when we see a session being used
31:14
from two places, two devices at the same time, and then using
31:18
that to trigger some action. Whether that's quarantining the
31:22
user or just killing all their active sessions so they're
31:25
forced to re authenticate. I think that that is a good
31:29
catch all solution because no matter how many features we add
31:34
to the the underlying protocols to the data plane, there's
31:37
always going to be some new novel way that someone will get
31:40
around them. So having a catch all like an
31:42
ITDR that can find and fix problems is important.
31:45
Now that to me as a Band-Aid I think we need to fix the
31:49
underlying protocols themselves to not just.
31:53
I guess continuous authentication kind of implies
31:56
that you still have this kind of a session.
31:57
We really need to stitch this whole thing end to end from
32:02
authentication into the back end application and how it manages
32:06
sessions in order to be successful.
32:08
Because if we're continuously authenticating but whatever
32:12
Slack or your e-mail client is just continuing to use Long live
32:15
session tokens, it doesn't really do much good.
32:17
The whole thing needs to work together.
32:19
Absolutely. So the next topic you brought
32:22
up, which really resonated with me was around machine identity.
32:27
You kind of talk about where your brain is in in terms of
32:31
machine identity. So honestly I'm trying to wrap
32:34
my head around this space. Machine identity is a bit of an
32:38
enigma to me. So I break it down into the
32:42
device identity and workload identity.
32:44
Those to me are kind of this two subcategories within the the
32:49
taxonomy here and device identity has become pretty clear
32:53
like how we handle device authentication.
32:56
If that device is tied to a user, we know how to use, you
33:00
know, hardware modules, TPMS, etcetera, to develop device
33:04
trust and to work that into how the user is authenticated tied
33:10
to a device. I'm not saying that most
33:12
organizations have successfully successfully rolled that out.
33:15
I think there's a lot of work to do to operationalize that in
33:20
most environments, but I think the solutions are pretty well,
33:23
well known there. Where it gets murky for me is
33:27
more on the, you know, workload identity side of the world.
33:31
How we manage the identity of processes and containers and
33:36
virtual machines and servers and Lambda functions and all these
33:40
fun things is whether or not there's really a need to
33:43
centralized IAM for those types of identities, like we've
33:47
centralized identity for humans and devices.
33:53
Is it necessary in the workload world?
33:55
Is there actually a buyer for a solution like that?
33:58
Or is it really just the domain of developers and the CTO to
34:02
manage workload identities and I don't know the Chief security
34:06
officer and the security team offloaded to them and make it
34:10
part of the security development life cycle.
34:12
That to me, is is is murky. But I do see a slew of startups
34:17
in this space starting to tackle machine identity and managing
34:21
workload Identity. That means there might be
34:24
something there. There's good validation when you
34:26
see multiple companies going after something that there might
34:29
be a problem to solve, and I've no doubt there's a problem to
34:31
solve. The only question in my mind is
34:33
whether there's going to be a big successful Unicorn of a
34:38
machine identity company five years from now.
34:41
I don't know. So many ideas here.
34:44
First off, you're taking on a problem that has not been
34:49
solved. The problem is there, and I can
34:51
tell you that every organization tries to deal with it, the the
34:55
management of human identities has been solved.
34:59
That doesn't mean everybody's doing it perfectly or anything
35:02
like that. But you know, we we get the feed
35:04
from an authoritative source. You have good governance around
35:08
who works here with those authoritative sources, and then
35:11
you map identities to accounts. The problem is, is you look at
35:16
the Active Directory, almost everybody has an Active
35:19
Directory, and there's way more accounts than there are people.
35:24
What the heck is going on? Well, there's all these machine
35:26
accounts and there's all these machine accounts and all the
35:29
other places in your network. And by the way, I want to make
35:32
draw the difference between an account and an identity.
35:36
They're not one in the same. So that's what I think you know,
35:40
as much as we talk about machine identities like we have. 50,000
35:44
machine identity accounts, that doesn't mean we have 50,000
35:48
machine identities. That that's my perspective.
35:51
Now, you know, what does that really mean?
35:54
I don't think this has been solved, but I do think that the
35:57
answer is that these are are very difficult for humans to
36:03
manage. I think there's going to be some
36:05
element of artificial intelligence that's going to be
36:09
required for for the management of the identities.
36:13
But ultimately, the machines have to be drawn back to a
36:17
human, and the AI has to be able to inform the human on how the
36:22
account is being used. The identity is the human.
36:28
This is what I mean. There is a machine and it uses a
36:32
bunch of accounts. I just don't know if like, there
36:35
really is a machine identity per Southeast.
36:39
Yes, yeah, my Co founder and CT. So you're brave.
36:44
I'm not saying I'm tackling that one.
36:46
I just think it's interesting. I think it's white space in the
36:48
market. But my Co founder and CTODD
36:51
would totally agree with you that every, and I think I agree
36:54
at this point. Like every machine identity
36:56
needs to eventually somehow be tied back to dotted line into a
37:01
real human being who is responsible for it or a team
37:05
that's responsible for it. So if something goes wrong, like
37:08
you have someone to reach out to someone who can actually take
37:10
action to do something with these identities.
37:13
I think we've been in so many customer environments where
37:17
service accounts outnumber human identities.
37:21
Like, it's it's not uncommon and it's also not uncommon to, like
37:25
you said, have many accounts that are tied back to a single
37:29
identity, even for humans. Like we find that a single human
37:32
can have five different accounts for different purposes within an
37:35
organization. One of the challenges that we
37:38
solve with orders linking those all together.
37:40
So you can think of them as one user with one identity just
37:45
instantiated multiple times, but actually bring all that together
37:49
in one place. It's it's a hard problem to
37:51
solve, but a very necessary problem to solve.
37:54
I don't know if I agree. I'm going to take the contrarian
37:57
view because I think you guys had me until we started talking
38:01
about mapping. A machine identity back to a
38:04
human and having that person somehow claim ownership over an
38:10
account. I don't know if that is actually
38:14
viable. I think there's a definition
38:17
between responsible for making changes versus truly ownership
38:23
over an account, which I think is, you know, maybe I'm maybe
38:27
I'm not hearing it correctly, but I don't know if I agree with
38:28
the the mapping of it back to a human.
38:31
I can think of plenty of use cases where there's just so many
38:34
of these little micro service accounts, machine accounts, and
38:39
trying to map those back to humans.
38:41
Every single one. How dare you?
38:43
How dare you disagree with us, Chef?
38:45
So I I think about application owners and every single
38:48
application in most enterprise organizations goes back to
38:51
somebody in IT who's we're a group with an IT who's
38:54
responsible for that application.
38:58
I I got to think that identity we need at least somebody to pin
39:02
these things on. I agree that it's not an easy
39:07
problem and there are usually so many of these identities that
39:09
it's hard to imagine doing it manually.
39:11
But I think that there is AAI driven option here where we can
39:17
get some level of assignment, some sort of racy matrix for
39:21
those machine identities. Yeah, you know, and.
39:25
The way I think about it, I do want to be clear that I don't
39:29
think it should be a hard tie. Like, hey, I've got a a Active
39:35
Directory ID, I've got a Admin Active Directory ID, maybe I've
39:40
got a couple more, and then when I leave the organization, you
39:44
shut this off. That's the problem with these
39:47
machine identities and why they proliferate is because you can't
39:51
do that. You know, that's not sensical,
39:54
but I I think of it more like when you have one of the
39:58
problems, which is very common is group proliferation.
40:02
So you might have an organization where they've got
40:05
50,000 employees and 200,000 groups and they say this is out
40:10
of control. You need to clean this up.
40:13
You know, first step is like set up an Evergreen process so the
40:16
problem stops getting worse. Then it's you go through and
40:20
you. Start to clean up the groups and
40:23
groups that are legitimate and need to continue on.
40:26
You need to collect metadata. And one of those metadata is
40:30
who's the owner of that group? Because they are the, the human
40:35
who is going to say, yes, this list of people and the access
40:41
that we have assigned to this group, the access control list
40:44
or whatever is legitimate. And that's really why I say it
40:48
has to be tied back to human. The problem is, is like if you
40:51
have one person who now has 10,000 machine identities tied
40:56
back to them, well, how did they, how did they really
40:59
process whether or not that's correct?
41:01
And that's to me, that's that AI element.
41:05
Well, I think that's where I'm I'm struggle with this, trying
41:07
to get back to a single human. I think it makes more sense to
41:09
map it to. A department or a team or
41:12
something like that. Because I think it's just, I
41:15
think it's a fool's errand to try and say, hey, you know,
41:19
these anywhere from 1 to 7000 machine accounts map back to
41:24
Jeff. Well, what happens if Jeff
41:25
leaves? Because we all know, you know,
41:28
everything's perfect and any world and everything always
41:30
works when people leave the organization.
41:33
It's not like something bad will happen to those accounts through
41:35
automation, right. So.
41:37
I get concerned about trying to figure out that mapping.
41:41
I think it makes more sense to send it to, you know, even if
41:44
it's not mapped to a human, but mapped to a headless account, so
41:49
to speak. That is, you know, owned and
41:51
operated by a team, maybe infrastructure, maybe it's
41:53
marketing or some other application development team.
41:57
That kind of thing makes more sense to me.
41:58
Yeah. Ownership, yes.
42:00
Yeah. Kind of went down the path a
42:01
little bit talking about this next topic.
42:04
This was kind of the the last topic we'll hit on, which is you
42:08
called it Entitlement entropy. What is Entitlement Entropy?
42:14
I'm reusing the space analogies here because there's entropy in
42:17
outer space, like things are constantly moving apart.
42:20
So entitlement entropy, and I'm sticking with that term, is a
42:24
really important concept in identity, where entitlements are
42:28
always added but never really taken away.
42:30
Maybe in small batches, but over time.
42:33
The entitlement entropy increases in any given
42:36
organization, the number of groups, the number of
42:39
identities, the permissions that that group membership or
42:43
entitlements that those bestow upon the members it's ever
42:47
increasing. And so if you look at a graph of
42:50
the number of entitlements an organization it it it's sort of
42:52
exponential as that organization ages as they add more
42:56
applications and more users and more devices the amount of
43:01
things that. Collectively, the population has
43:05
access to this goes up and that is a huge problem.
43:09
And identity that's age-old and doesn't have a good solution
43:12
today. It's like, how do you rein in
43:15
entitlement entropy? How do you prune those
43:17
entitlements in a way that you don't slow down the growth of
43:20
that organization that relies on the ability to access the
43:24
resources that they need, while at the same time reducing and?
43:30
Maintaining a blast radius for each individual that's
43:33
reasonable so that if their account is taken over, you don't
43:37
have to worry about them having access to thousands of systems.
43:41
Maybe it's limited to a handful that you can actually go through
43:44
each one and see what damage was done, not access to, you know,
43:48
2000 different things where you could never actually go and do
43:52
the instant response that was necessary to clean up all the
43:55
damage that could have been caused.
43:57
Yeah, this, this term, entitlement entropy.
44:00
I think of like entitlement chaos.
44:03
I think of it in two perspectives. 1 is what is the
44:06
total basket, the total universe of entitlements.
44:11
And I, you know, this is one of my rabbit holes, right?
44:14
So I went down the rabbit hole on YouTube for the universe, and
44:19
it's like only 100 years ago humanity thought the universe
44:23
was the Milky Way. Well, then what they've realized
44:27
using the Hubble telescope and everything is that there are
44:30
billions of universes, which each universe is made-up of a
44:35
billion stars. We actually don't know how big
44:39
the universe is, and we don't know, you know, what's outside
44:44
of the universe. I feel like sometimes for folks
44:50
in our industry who are trying to wrap their brain around the
44:54
entitlements, it's like there are so many hundreds of
44:58
thousands of entitlements. The good thing is usually the
45:01
the areas where entitlement chaos lives that I find anyway
45:07
number one in the Active Directory, the number of groups.
45:12
And maybe that's a a big part of because well, first Active
45:16
Directory has been around for over 20 years.
45:20
I remember when I get my first MCSD certification in Windows
45:24
2000, it was the first version of Active Directory.
45:27
But so some of the groups are, I mean some organizations still
45:30
have some of those groups that were created way back when.
45:35
But I also think that because Active Directory becomes the IDP
45:41
for so many other applications, it becomes the the
45:45
centralization dumping ground for all these groups.
45:49
The other area that I find is ERP systems.
45:53
And because ERP systems are, we define all these nice neat
45:57
groups. And if organizations get into
45:59
the habit of everybody gets ad hoc access, you know,
46:03
everybody's a snowflake in terms of that.
46:06
You know their uniqueness in their access profile.
46:11
So then the reality of it is even though you have roles, it's
46:15
like those roles really don't tell the tell the whole story.
46:21
So there's the the universe of entitlement entropy but then
46:26
there's also like the individual's entitlement
46:29
entropy. Are people over provisioned on
46:34
what are we doing about that? And I I kind of feel like in the
46:38
cloud space, there's at least a solution out there that's trying
46:42
to take it on, which is the idea around CIEM systems where you
46:49
can actually go into, you know, here's the beauty is like, OK,
46:54
you've go ahead and put most of your eggs in a couple or just
46:58
one cloud infrastructure or platform as a service, right.
47:03
So it puts all of its logs in one place and you can see what
47:08
entitlements are actually being invoked.
47:10
And then you map that back to the person say or to the account
47:15
and say here you're, you know, here's accounts that have access
47:20
that they are not using over X number of days in the
47:24
enterprise, we generally don't have the confidence to say, I'm
47:28
going to go through an account and just start deleting the
47:31
entitlements these people don't need because they obviously
47:34
don't need them. They haven't used them in the
47:36
last year. Well, do you really have the
47:38
logs to show you that? And almost every single
47:41
organization I've ever worked with.
47:43
The answer to that is no, not really.
47:47
That's the problem. I think the solution here is
47:50
that you can be confident about removing entitlements if you
47:54
have an easy way to get them back.
47:56
And so that is kind of the crux of.
48:01
To reduce entitlement entropy and have the confidence to prune
48:04
that graph of entitlements kind of relies on making sure that
48:08
you also have workflows in place that make it super simple and
48:12
have just as enough friction. For people to get them back, but
48:15
not too much friction. Whether that's having you know
48:18
some of these newer Just in time access tools that work in Slack
48:22
or that have nice UIS where you can easily request access to an
48:25
application or resource when you need it for a specific time
48:28
range. Whether it's like a next Gen.
48:30
Pam or a next Gen. IGA solution.
48:33
I think there are a lot of companies, especially on the
48:36
smaller side trying to tackle that side of it And so I think
48:39
we need to do both. We need to find a way to remove
48:42
these unused. Entitlements, while also finding
48:45
a really smart way to give them back when they're needed and
48:50
when they're warranted. That's a great point.
48:52
You know, I also think you know the discussion we get into on
48:56
this podcast laws, like, OK, what is what's AI going to do
49:00
for identity? And when I hear things like it's
49:03
going to do an analysis of you have these entitlements, other
49:08
people in your department have these entitlements, you should
49:12
request this entitlement. I'm like, that is garbage, dude.
49:16
That doesn't. That's not intelligence.
49:19
That is, that's business analytics.
49:22
I'm sorry that now if you were able to answer much more
49:27
difficult questions like or give much more insightful advice
49:32
like, hey, these people that work for you, now you're going
49:36
to recertify them. You know, John Doe has these
49:40
accesses that he hasn't used in over 2 years.
49:46
I at least now have to have a conversation with John Doe and
49:48
say like, do you really need this?
49:50
You haven't used it in two years.
49:52
But in order to do that, you have to have a certain
49:55
confidence level that you're going to have the logs.
49:58
So the reason we haven't gotten that, gotten the logs all
50:01
centralized, like that's hard work.
50:03
What if AI could actually do that hard work for you?
50:06
Get those logs. Start making sense of them
50:09
crunching that big data now. Now you've done something
50:13
that's, you know, changes the game, I.
50:16
Think we're just now at a point where some of this is possible,
50:19
where those logs are actually exposed via AP is that are
50:22
useful by a lot of these IAM platforms where you can have
50:26
tools that ingest them and analyze them at scale.
50:30
And I think like you're saying, that's a great use of.
50:33
AI is interpreting that graph and helping communicate it to
50:39
the managers and the end users to help them understand what the
50:45
system is doing and how it might change.
50:48
I think this whole thing and identity, unlike endpoint
50:51
security, network security where you're dealing with bits and
50:54
bytes, it's human, a lot of it is human.
50:58
And so communicating with humans, what I've seen.
51:02
In the LLM space and with ChatGPT, and I think is also
51:06
very promising because it means that we now maybe have a more
51:10
programmatic interface that we can use to communicate with
51:12
humans in a way that they'll understand, so they can more
51:16
naturally interface with these complex problems that identity
51:20
presents. Well, I think you kid on
51:22
something there that I find important in the in the stage of
51:25
AI that we're starting to get into is the interface and people
51:28
being able to. Not only get the information
51:32
out, but they don't have to be, you know, technical Wizards.
51:35
They don't have to write SSIS reports or write things like
51:38
that to get data out. I'm looking forward to the day
51:41
when we're like Star Trek and we just ask a question in a natural
51:45
language and the computer just kind of figures it out and gives
51:47
you the answer. Kind of interprets what it is
51:50
you're really asking for. I think that'll be real
51:52
interesting. It's not that far away.
51:53
Yeah, I think we've collected a lot of the data.
51:56
Yeah, I think we're getting pretty close.
51:57
I want to ask one more question and that's I want to kind of tap
52:01
into your entrepreneurial kind of start up, I don't know thread
52:07
that you've got going throughout.
52:09
If you were to build another digital identity company, where
52:14
would you start? Would it be something along the
52:16
lines of starting with like identity, Governance?
52:19
Would it be something authentication based or
52:21
privileged access or or something else like?
52:24
Where do you see a need right now?
52:25
It's a great question. I think we had kind of magical
52:28
timing with ITDR when we built ORT.
52:31
And there's a, you know, the big secret in venture capital is,
52:35
you know, team tech and timing and you need all three of them.
52:39
And so you couldn't recreate that magic again if we tried to
52:42
do it. You know, today in November
52:44
2023, I wouldn't start an ITDR company as much as I like ITDRI
52:49
think that the market is not saturated, but there's a lot of
52:52
good ITDR start-ups. A lot of the big companies now
52:56
have solid ITDR capabilities. There are other areas that
53:01
really need attention that a entrepreneur could use as a
53:05
beachhead into the identity market.
53:09
IGA is interesting, I think. That is a really hairy problem,
53:14
especially if you're trying to tackle sale point with their
53:17
massive library of integrations and their network of people who
53:20
build those integrations. They just have a massive Moat.
53:23
And so I think some of these workflows like Just In Time
53:26
Access are interesting. But again, that's a fairly busy
53:29
market at this point. You know, it's been around just
53:31
as long as ITDR. As a as an area of interest, I
53:36
think machine identity, it's a very fragmented space and so I
53:40
think a company could launch in machine identity but might not
53:44
get to escape velocity because of how fragmented is.
53:48
The area that I think is hottest right now is really.
53:53
Yes, I am. So consumer I am and all the
53:55
tooling around it like authorization.
53:58
This is an area where again, we do see a lot of companies, but
54:01
the market is just massive and still growing and there's such
54:05
amazing innovation going on in consumer.
54:09
I am that I think if I were to start something, that's where I
54:12
would focus. It's still very much unsolved
54:14
problem and a very big untapped market that there's no clear
54:18
winner we had off 0. And All Zero is still the huge
54:21
name in that market, but I think it's time for sort of a next
54:24
Gen. All Zero to take the reins in in
54:27
in CIAM. It's just you bring up off 0, I
54:30
mean they got purchased by Okta, you know a few years back.
54:33
Now. I think the closest probably
54:35
competitor to them is maybe something like Ford Rock that
54:39
has a lot of APIs. But that's been purchased by
54:42
Ping, which it seems to me if you're on somewhere trajectories
54:46
between like Octa and Ping, sort of.
54:48
Having API based ways to do authentication or authorization
54:55
because I think you're right, CIM has a lot of typically more
55:00
of a build IT mindset versus a buy it mindset and you're really
55:03
just kind of trying to get the infrastructure in place.
55:06
I want to tap into again that entrepreneurial spirit to end On
55:12
a lighter note, something not IT related.
55:15
If you could start a business related to something with
55:18
outdoor adventures, what would it be?
55:20
Oh, that's a great question. So I, as we talked about when we
55:24
prepared this show, I I love being out in nature.
55:26
I live in the middle of the woods.
55:29
We we're surrounded by trees and lots of land and it's it's
55:33
really nice to get out and just walk around or you know take a
55:36
drive and go for a hike in the in the wilderness here in
55:39
Massachusetts. It's one of the most reforested
55:41
states. In the country, it's something
55:43
I've learned. It used to be all farmland up
55:45
until the late 1800s. Anyway, what would I do with
55:50
outdoor adventure? You know, to me it's really
55:53
important to combine mental health and nature and I think
55:57
like an app of some kind. Maybe it would be nonprofit,
55:59
because I don't know how you would monetize this, but
56:01
something that combines that idea that you should probably
56:04
take 1/2 hour walk every day out of nature to rejuvenate
56:06
yourself. Maybe with some kind of talk
56:08
track or just simply a reminder to go and do that and why it's
56:12
important is something that I could get behind.
56:14
There truly is an app for everything at this point, right?
56:16
Why not Jim? What about yourself?
56:18
What would you start a business on that?
56:21
We had a relation to outdoor adventures.
56:23
I'm going to, I'm going to feed off of mats a little bit because
56:28
it's an app. It's actually a marketplace.
56:31
A marketplace would be a business like Airbnb or Uber and
56:40
my marketplace would connect people who have outdoor themed
56:45
rental vacations available and people can go and rent them.
56:50
So it could be I've got AVW bus that, you know, you can just fly
56:57
out to Oregon and seeing this VW bus for a week or I've got
57:03
something in Alaska and you can come and but it would be focused
57:07
on that. So we kind of like kind of like
57:10
Airbnb, but it would be more focused for the adventure
57:13
outdoor type. And I also think that, you know,
57:17
I've rented things from Airbnb before and I don't want to
57:20
disparage Airbnb, but man, you know, it's one thing when you go
57:24
in, you see, I'd like to rent this place and it's $200.00 a
57:29
night and three nights it should be around $600.00.
57:32
And then it's like $850 because of all the fees that get tacked
57:37
on. It's kind of like like it's also
57:41
like, you know, buying tickets to events, the all the fees that
57:46
get thrown on. And I I'd want to keep the fees
57:48
more reasonable because I think they push people away.
57:53
And you know, it feels like kind of like false advertising.
57:56
So I think that's what I would do.
57:59
I create a marketplace for outdoor adventures.
58:02
What are you, Jeff? So I don't I, I think Airbnb is
58:05
trying to get a handle on the fees.
58:06
But you're totally right. It's like, yeah, it's like you
58:08
have $500 cleaning fee like what?
58:10
That's crazy. But that being said, what if you
58:14
were, you know, renting AI? Don't know, like a like, I feel
58:17
like what you described, Jim, was like unique locations to
58:20
like stay in around the world. And it's like, OK, I want to
58:24
stay in like a crashed air airplane in the middle of the
58:27
Amazon. You know something like that is
58:29
that is that kind of like along the theme while you're thinking
58:31
oh that would be great and so yeah the the difference that one
58:36
crash airplane the Amazon you know and and we took all the
58:40
bodies out and we just. No, that's the cleaning fee.
58:44
That's the cleaning fee. That's what you have cleaning
58:46
fee. No.
58:47
But I think the other thing is like, let's just say you were
58:50
going to on a business trip or to a conference or something and
58:54
you want to stay like in the beach or something and stay in
58:58
that like camper or something like that.
59:01
But you don't want to pack a stove.
59:03
You don't want to pack a bunch of food.
59:07
You just want to show up, have everything set up for you and
59:10
basically already have your s'mores there and just start
59:14
camping. And especially if you're only
59:16
camping for a weekend or three days, like you don't want to
59:20
have to go and hit Walmart, like, you know, So what I think
59:25
this marketplace would be like is like enabling people to start
59:29
their own businesses around creating these experiences.
59:33
And we need like a DoorDash for campfires.
59:35
So I can be at home. I don't need to go find wood, I
59:38
don't need to build the fire. It's just.
59:40
I was just thinking they just delivered the fire hot, hot, hot
59:42
coming through. You know I am not an outdoor
59:46
person, but my start up would be bringing the indoors outdoor.
59:52
Or something like that. Or bringing the outdoors indoor.
59:55
I hate bugs. I constantly am getting like
59:58
destroyed by mosquitoes. I like being outside, but the
1:00:01
bugs kill it for me pretty much all the time.
1:00:03
So I'd like to have like some business where I could enjoy the
1:00:07
outside and there are no bugs or things like that that would
1:00:12
cause problems for me. Because I like I said, I am just
1:00:15
a a mosquito feeding machine when I'm out there.
1:00:18
My wife not so bad me. You just love me.
1:00:21
I don't know. My sweet blood, I guess.
1:00:22
Yeah, I talked about the YouTube rabbit holes.
1:00:24
I'm not sure if you guys are have gone down this rabbit hole,
1:00:27
but there's a whole theme of videos where people just show
1:00:30
themselves camping. And usually it's stuff like
1:00:34
they're camping in the winter somewhere and it's like snowing
1:00:38
and it's really cold. And they they have like
1:00:41
elaborate camping gear and you see these videos and they've got
1:00:44
like 2 million, three million hit or views like.
1:00:49
There's interest in this stuff out there, and it's a very the
1:00:52
reason I like them is is like very, like your brain can go
1:00:56
into like very low processing modes, like something you can
1:01:00
watch and like, truly relax. That's that's the secret for
1:01:04
Jeff. Just go go outside in winter,
1:01:06
there's no bugs, right? Well, that's yeah, I lived in
1:01:08
Chicago for 40 years so that was great.
1:01:09
I, I, I winter doesn't bother me at all.
1:01:10
Like the cold doesn't bother me and say, yeah, there's no bugs,
1:01:13
nothing like that. Having moved down to the South
1:01:16
and North Carolina, it's a little bit different story.
1:01:19
But yeah, I don't know. I mean, I would rent like, like
1:01:22
for me if I was going to say, hey, you're going to go camping.
1:01:25
I just remember, like my family when we were younger, we had
1:01:27
like this campground we'd go to in Kankakee, IL for those who
1:01:31
are familiar. And I had, I had no desire to be
1:01:34
outside. I just wanted to play Nintendo.
1:01:36
So, you know, my mom would have to shoe us outside and, you
1:01:40
know, unplug the games and take them away because I just, the
1:01:42
outside never has never interested me.
1:01:45
And I don't know if it if it will at some point.
1:01:47
I think it's, I don't know, it's just not my thing.
1:01:50
I'll go sit on the beach, I'll, you know, sit on a boardwalk or
1:01:53
something like that. But like, I don't, I don't know,
1:01:55
camping just doesn't do it for me.
1:01:57
So that's a good way to have a doubter.
1:01:58
I guess I'm taking over Jim's role as the downer of leaving
1:02:02
stuff here. I was going to say I'm like, I'm
1:02:05
like the positive guy in this episode this.
1:02:07
At first, yeah. I probably stunned you.
1:02:09
I was like, what the heck is going on over here?
1:02:11
Why don't we go and wrap it up? Because I think we're up over an
1:02:13
hour now. Definitely want to thank Matt
1:02:16
for being on the show. Matt, thank you so much for
1:02:17
taking the time. Any final thoughts before we
1:02:19
close things out here? No, I just appreciate the time
1:02:21
here. Jeff and Jim have been a long
1:02:23
time listener and appreciate the opportunity here to talk about
1:02:26
all things identity. Yeah, we appreciate that.
1:02:29
So for folks who are listening, make sure you hit that like and
1:02:32
subscribe button. That's the best and really the
1:02:34
only way that you guys can support us.
1:02:35
So we certainly appreciate that. If you're gonna be at, don't
1:02:39
forget about the identiverse regional events that are coming
1:02:42
up here in Chicago in New York City.
1:02:43
So I'm planning on being at the New York City one.
1:02:46
So if you're a listener and we happen to be in the same spot
1:02:48
feel free to come up and say hello.
1:02:51
Jim is usually the social butterfly and gets a lot of the,
1:02:53
I don't know, FaceTime with with folks but I enjoy it too.
1:02:57
So come up and say hi, we're on the web, idacpodcast.com,
1:03:02
Twitter at IDAC podcast, Mastodon at IDAC podcast at
1:03:06
infosec dot exchange. We'll have links in our show
1:03:09
notes for everything we talked about including a link for the
1:03:11
registration for the Identiverse regional events also linked to
1:03:15
connect with Matt on LinkedIn. So that way if you got questions
1:03:19
and also a link for ort OORT dot IO so you can learn more about
1:03:24
what Matt's been working on and we'll go ahead and leave it
1:03:27
there. Thanks everyone for listening
1:03:29
and we'll talk with everyone in the next one.
1:03:32
You've been listening to Identity at the Center.
1:03:36
We hope you've enjoyed the show. Make sure to like, rate and
1:03:40
review and we'll be back soon. But in the meantime, hit the
1:03:44
website at identity@thecenter.com and find
1:03:48
us on Twitter at IDAC Podcast. See you next time on Identity at
1:03:55
the Center.