Latest / Identity at the Center / #236 - Identity Week America 2023: Ian Glazer & Steve Hutchinson

Transcript

#236 - Identity Week America 2023: Ian Glazer & Steve Hutchinson · Identity at the Center

• 0:05
  This is identity at the center. If it has anything to do with I
• 0:11
  Am, this is the go to podcast now your hosts Jim McDonald and
• 0:17
  Jeff Steadman. Welcome to the Identity at the
• 0:24
  Center podcast. I'm Jeff and this is my cohost,
• 0:27
  Ian. Hi, Ian.
• 0:28
  Hi. How are you doing?
• 0:30
  I'm doing great. This cohost chair is super
• 0:32
  comfy. It is.
• 0:34
  So we're here at Identity Week, America this week, and Jim is
• 0:39
  across literally the country in San Francisco at the Octane
• 0:43
  Conference. So you're filling in.
• 0:45
  I didn't know that you two could actually be physically
• 0:48
  separated, like I didn't know what happens.
• 0:51
  Is there a weird magnetic field that forms between the two of
• 0:53
  you and you have to be scrunched back together?
• 0:55
  Like how does that work? Well, what's gonna happen?
• 0:57
  So we've been a part. For so long, there's actually
• 1:00
  going to be an emergency broadcast alert later today just
• 1:03
  to warn people about that. So if while we're requiring
• 1:06
  this, you hear a whole bunch of things going off, yeah, that's
• 1:09
  that's why that's happening. Literally, a national podcast
• 1:12
  emergency. National podcast, global, I
• 1:15
  would say Galactic Podcast Emergency.
• 1:17
  It'll probably go out on channels, out into, you know,
• 1:19
  space and whoever is out there, if anyone is out.
• 1:24
  So what they're saying is like, was it Star Trek One or a
• 1:27
  Voyager? But you lost me now.
• 1:29
  Was sending signals way out into like deep space, and it summons
• 1:33
  like a whole big ship like it. Wait, your broadcast signal.
• 1:37
  If The Signal, if the podcast Signal goes out that far and
• 1:40
  aliens show up, are we blaming identity at the Center for that?
• 1:43
  We're not going to be here for it.
• 1:44
  This is true right? At that point, too late.
• 1:46
  Doesn't matter. Or somebody else's future
• 1:47
  problem. Sorry about that.
• 1:49
  I'm happy to kick that can down the curb.
• 1:52
  So yeah, we're here at Identity Week America.
• 1:54
  Ian's here. He's guest Co hosting with me.
• 1:58
  He's brought along a friend, Steve Hutchison, aka Hutch.
• 2:02
  Welcome to the show, Hutch. Thank you.
• 2:04
  So you're a director of security architecture with Mitsubishi
• 2:07
  Bank of Tokyo, Which one? That's a mouthful.
• 2:10
  I'd like to understand a little bit about your identity
• 2:13
  background. So we've gone through Ian's.
• 2:15
  We're not going to put people through that misery again.
• 2:17
  We're ready to torture them. But we'd love to hear from
• 2:20
  people first time on the show, and hopefully not the last is
• 2:22
  how did you get into the space of identity?
• 2:25
  Actually. I think Ian mentioned this like
• 2:28
  when we were first pitching ID Pro is that nobody really got
• 2:34
  into identity by like studying identity.
• 2:37
  You ended up backing into the the art by doing something else.
• 2:41
  And I'd started out as a C++ programmer with a healthcare
• 2:46
  company. They said, oh, you're the PC
• 2:49
  guys, so we're also going to put you in charge of networking.
• 2:54
  We've got. Seven PCs in a room downstairs
• 2:59
  here, take this and make it work, which was a a box of
• 3:03
  Netware 215. I'm aging myself and that's
• 3:08
  where I first got my introduction into identity
• 3:14
  management. You know, having to do user
• 3:16
  management and the security around logins and
• 3:19
  administration. And plus it was a it was a
• 3:23
  really good background. For the the networking piece of
• 3:28
  it was all kind of in that security realm and from there I
• 3:33
  went to Enterprise Architecture and then Enterprise Security
• 3:38
  Architecture. Still all with that same company
• 3:42
  or with the companies that bought the company is it?
• 3:46
  In 2011, I got the job of a lifetime at GE at their
• 3:51
  Information Security Tech Center.
• 3:54
  Which was kind of the global cybersecurity office and they
• 3:57
  wanted me to focus just on identity, which I thought was
• 4:01
  going to be really narrow, wasn't going to be big enough
• 4:04
  for me. And it turned out to be a little
• 4:08
  bit more narrow, but hundreds of miles deep.
• 4:11
  And that's when I first got involved in kind of the larger
• 4:16
  identity community and I met people on the the, the
• 4:19
  conference tracks that. Cloud Identity, Summit and
• 4:24
  Identiverse and Gardner and Twitter Conversations.
• 4:29
  And that's where I met Ian and Pam and Andrew and Nishant and
• 4:33
  all of those. Definitely part of the original
• 4:35
  identirati as we call it, right? Definitely and and fell in love
• 4:41
  with what was happening with it. It wasn't.
• 4:45
  There was. There was a world that was
• 4:46
  opened up. To me, because of them and
• 4:49
  because of what was going on and the thing that I wasn't aware
• 4:51
  of, and when I became aware of it, I didn't want to do anything
• 4:54
  else. So you kind of validate.
• 4:56
  Something that I've posited here very early on was that most
• 5:00
  people in Identity today did not pick Identity.
• 5:03
  Identity picked them. It chooses you.
• 5:06
  And yeah, backed into it, fell into it, you know, didn't really
• 5:10
  realize, you know, kind of how you got started it.
• 5:13
  And I think there's still some people today who are in identity
• 5:16
  and don't really know it. I'm gonna point back to the
• 5:18
  conversation I had yesterday with Molly Taylor from Identity
• 5:21
  Week. I you know, I asked.
• 5:23
  It's like, so before we hit record, I had said OK, so
• 5:26
  Johnny, Molly, do you guys consider yourself identity
• 5:28
  people? Is like no consider conference
• 5:29
  people and it's OK. Well how many you know, Molly,
• 5:32
  how many times have you done identity conference Like this is
• 5:34
  my 6th one. Like, I hate to say it, but you
• 5:37
  might be an identity person, and there's plenty of room for
• 5:40
  identity people that are technical.
• 5:42
  Versus non-technical in every shade in between, there's an
• 5:45
  inexpensive home test you can take and actually.
• 5:47
  Find out if you're not. Does the government fund that
• 5:49
  well? Can I go to the USPS?
• 5:51
  And yeah, everyone's gonna get two tests at home and not in a
• 5:53
  month. You too may have identity
• 5:55
  disease. We did a we did a series of
• 6:00
  recordings at a Identiverse couple of years ago where one of
• 6:05
  the topics was what was your background?
• 6:08
  And it was great because there were like eight of us who did.
• 6:12
  Different ones. And only two of them really had
• 6:15
  like a a science or computer science background.
• 6:19
  I mean, mine is history. I mean, thank God I had a
• 6:22
  computer science minor because that's the only thing that's
• 6:24
  paid the bills for 35 years. But it's amazing the the breadth
• 6:30
  of diversity in backgrounds that people in the identity space
• 6:34
  have. And it's important, I think it's
• 6:36
  important to have that. I think the other thing about
• 6:39
  that is, I mean some of the best identity architects and product
• 6:43
  managers I know don't have college degrees.
• 6:46
  They're journey people. I don't have a degree and.
• 6:50
  I learned entirely on the job. I did not know that.
• 6:53
  And now like you continue to add to this case which is there's a
• 6:57
  lot of things about being an identity that you're a you're a
• 7:01
  journey person, you're a trades person in some regard and you
• 7:03
  learned and I think I think this is somewhat still the same,
• 7:08
  you're learning on the job in a very pragmatic way and then sort
• 7:15
  of making that more abstract and more applicable inside of your
• 7:19
  business division, your enterprise, your industry.
• 7:22
  And is there something very satisfying about that versus and
• 7:27
  sort of academic approach, you know, a more academic let's?
• 7:30
  Say, approach doing interviews for.
• 7:33
  People who are going to move into that identity space I the
• 7:39
  college education pieces like the last thing that you look at
• 7:42
  you want to see what's their experience and it it most of the
• 7:46
  things aren't things that they teach in a college program.
• 7:50
  So what you need to do is need to hire people who are smart,
• 7:54
  who have shown that they're agile and, you know, learning
• 7:58
  and picking up new skills because.
• 8:02
  That's what you're going to end up having to do.
• 8:04
  And in most of the identity programs at different companies
• 8:09
  are, I mean we we use similar tools and we use similar
• 8:12
  concepts. But the the there's there's a
• 8:16
  there's a ton of instruction that has to go on to learn a
• 8:21
  particular company's identity, right?
• 8:24
  Even after decades of doing it, most recently Mitsubishi.
• 8:30
  I was really fortunate to have somebody who is in that program,
• 8:36
  Mitch Klein, who spent the time to teach me.
• 8:40
  That's like, OK, here's how we do this here.
• 8:43
  And it's only once you have that, if you want to modernize a
• 8:46
  solution or if you want to introduce new things, you
• 8:49
  understand how to lay those out and what stories are going to
• 8:52
  resonate with the business. And I think underlying that is
• 8:57
  you've got, you've got to have really good active listing and
• 9:01
  empathy skills, right, Because you're going into these
• 9:03
  businesses, you know, whether it's your own or someone else
• 9:06
  you're helping. And like, oh, yeah, I know how
• 9:09
  to apply all these tools to do all these things on paper.
• 9:13
  That's all theoretical until you get into the, hey, why is this
• 9:19
  one system over here not hooked up to the privileged account
• 9:22
  management system? Well, okay.
• 9:25
  So about that. Right.
• 9:26
  And if you're not there in a non judgmental moment just to simply
• 9:30
  say like tell me about why this is and then I can understand it
• 9:36
  and then I can identify like can I help you make this better
• 9:39
  versus here. Here's some tech.
• 9:41
  Go deploy and have a nice day. I see that quite a bit where
• 9:44
  people go off and you know, my day job is consulting and I feel
• 9:48
  like I've had let me come back to this in a second because I
• 9:50
  feel like I've had three educations throughout my career.
• 9:54
  The first was food service. I did 10 years of food service,
• 9:57
  so everything from busboy to bar manager and everything in
• 10:01
  between. So I learned customer service
• 10:03
  there. So if you don't give customer
• 10:05
  service, you're not making anything for tips.
• 10:07
  Then I went to work at an enterprise and the help desk and
• 10:11
  we moved over to these information security space
• 10:14
  before there was really kind of anything.
• 10:16
  So I learned enterprise identity sort of on the ropes there quite
• 10:20
  a bit learning you know how things work.
• 10:22
  And then the next phase of my career is consulting.
• 10:24
  And that's where I learned, oh, OK, there are more than one way
• 10:27
  to do this thing. And let me relearn everything
• 10:31
  that I thought I knew about identity all over again, because
• 10:33
  now I'm seeing more and more out there.
• 10:35
  And the the biggest mistake that I see with the organizations
• 10:39
  that I work with is they went off and bought a tool think it
• 10:41
  was going to solve the problem? They didn't think anything about
• 10:44
  the people in the process. They just all we've got.
• 10:46
  We've got a budget for Privileged Access Management
• 10:48
  that'll take care of that problem.
• 10:50
  And then they go off and buy it and it sucks.
• 10:53
  But this is, this is. I was just thinking about this
• 10:56
  in this context, which is you buy an amazing vacuum cleaner.
• 11:02
  Are we talking Dyson? What do we Let's say you're
• 11:04
  going talking, Dyson. Let's say you're going for like
• 11:06
  super bougie vacuum cleaner and you've got it all unpacked and
• 11:10
  charged. And then you just stare at it.
• 11:14
  You're like, why are my floor? You're still filthy.
• 11:16
  I don't. Want to get it dirty?
• 11:17
  Like, exactly why I spent way too much to get this, but like,
• 11:22
  a little bit of an extreme thing.
• 11:23
  But like, the the mechanics of this don't just happen, right?
• 11:29
  You buy a really efficient hot water tank.
• 11:31
  It doesn't Plumb itself. And the thing that's always
• 11:35
  interesting to me about identity is because it touches every part
• 11:38
  of an enterprise. No matter what sector, no matter
• 11:40
  what industry, no matter what geography, there is an
• 11:44
  opportunity afforded you to actually understand the whole
• 11:48
  business. What blows my mind and hutch,
• 11:50
  I'd be curious if you see this, is that in your experiences that
• 11:55
  the identity teams tend to know the most people in the
• 11:59
  businesses? Because at a necessity like I
• 12:02
  certainly found out my own experience, but I'm not sure you
• 12:04
  know if that was unusual or not, that you you were always talking
• 12:06
  to new people in new places. No, I would say so.
• 12:10
  When I move into a company, I tend to be there for a while.
• 12:14
  I was at my first role for 20 years.
• 12:18
  GE for 10 years just finished year three at Mitsubishi, but I
• 12:25
  would say it all three of those companies that that was
• 12:27
  absolutely true, if only because there are unique identity use
• 12:33
  cases in each business department division what have
• 12:39
  you and you need to understand how all of those use cases can
• 12:46
  be. Can the the needs of those use
• 12:49
  cases can be met by a single identity, ecosystem, fabric,
• 12:55
  whatever thing. So yeah, I I totally agree with
• 12:59
  that. That's that's been my experience
• 13:01
  as well. I think the one thing that you
• 13:03
  probably learn, I'd love to get your thoughts on this is
• 13:06
  diplomacy and really working with other parts of the
• 13:09
  business. Because when I grew up in the
• 13:12
  security space, it was at the time information security was
• 13:15
  seen as the Department of No. Oh, you can't do that.
• 13:18
  We've got to put a fire roll on there, blah, blah.
• 13:19
  All right. And then I loved this concept of
• 13:22
  identity. And it's really where I got my
• 13:24
  start was because it didn't feel like it was a no.
• 13:26
  It's like, yeah, here's how we can do it.
• 13:28
  Here's how we can, you know, enable the business or whatever
• 13:30
  it may be and and building those relationships.
• 13:33
  And now when I look at a role like an I M program manager,
• 13:36
  which some organizations may have, some may not have that by
• 13:40
  title and maybe just someone wearing that hat on the side.
• 13:43
  And I feel like a lot of the work that that role does is
• 13:46
  diplomacy. You're out there shaking hands,
• 13:48
  kissing babies, right? All that stuff to build those
• 13:51
  relationships. Do you see the same thing?
• 13:53
  Yeah, it. Ian mentioned empathy before and
• 13:57
  you really have to kind of understand the the needs of the
• 14:00
  the business and and I would like to think that I do that
• 14:05
  relatively well. I know I do have my own biases.
• 14:09
  And that's not to say that the job can't be incredibly
• 14:12
  frustrating at times and there are people and departments that
• 14:15
  will frustrate you. But you're not going to be
• 14:20
  successful unless you're a partner to the business.
• 14:23
  And the only places we've really had, like, serious arguments
• 14:29
  about is when the business starts trying to do solutioning
• 14:32
  instead of trying to get them to, you know, kind of thoroughly
• 14:38
  define the the business requirement that they're trying
• 14:41
  to solve. It's like, tell me, tell me what
• 14:43
  the business requirement is that you're trying to solve and I
• 14:45
  will. Tell you how we can get it done
• 14:48
  using the strategy that we've already defined or I'm totally
• 14:52
  willing to modify this if it's not something that can be met by
• 14:56
  it. But you have to do that with the
• 14:59
  entire business and Department A may not care what department C
• 15:04
  is doing, but you have to. So you you are, you are correct
• 15:09
  when you say it's. It's one of the few places where
• 15:13
  you're going to meet everybody but.
• 15:16
  If if, if you can't be diplomatic, then people are
• 15:20
  going to stop coming to you with their business requirements.
• 15:24
  You're not going to be successful, you're not going to
• 15:26
  get your program money. I need the businesses to be
• 15:29
  champions of our services just as much as the I Am team is a
• 15:34
  champion of them. Yeah, I'm not using it.
• 15:38
  I was always. I always got nervous in my
• 15:41
  experience when for a given initiative we were operating
• 15:45
  with a mandate because that meant it was a push, right.
• 15:50
  There's a thou shalt business. You got to go do this or
• 15:53
  division. You got to go do this versus the
• 15:55
  pull right where it's like, hey, I got this thing, they used it
• 15:59
  over here and they reduced XYZ by this percentage or you know,
• 16:04
  you know, saw this efficiency, what have you reduced audit
• 16:07
  burden by this much and then becomes the pull right then then
• 16:12
  the other. But a lot of times there are
• 16:15
  some things. Sometimes it has to do with
• 16:17
  compliance, some has, sometimes it has to do with it.
• 16:20
  You know, from a actual very critical security situation
• 16:23
  where you're like, Nope, this is a thou shalt.
• 16:25
  And those are the ones where you go back on those relationships
• 16:28
  and be like okay, so. Let's go to lunch.
• 16:33
  Yeah, we're going to need to Let's let's take that walk
• 16:36
  because like, no one in this situation super happy about it.
• 16:39
  But there's a real critical need and it's going to kind of be
• 16:43
  miserable for all of us and let's just push through it.
• 16:46
  But you got to build up that that currency to do that.
• 16:50
  Very difficult to walk into a situation and be bad cop
• 16:53
  immediately. It's like, OK, we got to do all
• 16:55
  those things. That's I think that's where
• 16:56
  historically you've come from is that information security
• 16:58
  mindset and I've seen a real flip on that in the last 1015
• 17:02
  years. I feel like for me at least
• 17:06
  those those have been the easier ones to to solve because if I've
• 17:10
  got. Like an audit team or a
• 17:13
  regulatory team that's coming and saying you have to do this.
• 17:17
  It's not me saying you have to do it.
• 17:20
  All I'm doing is saying okay, this is this is the way that
• 17:24
  we're going to meet that regulatory requirement.
• 17:26
  The businesses may not like it, but they have to go along with
• 17:30
  it. But I feel like that's maybe 10%
• 17:34
  of the work that we actually get done.
• 17:35
  The other 90% is trying to use peer leadership.
• 17:41
  Where I can't tell somebody to go do something I need.
• 17:45
  I need them to get on board, and the only way I can do that is to
• 17:48
  sell them on. This is how this is going to
• 17:51
  make your life easier. This is how you're going to.
• 17:55
  Be able to sell more services, you're going to be able to
• 17:58
  deploy to a larger customer base, those type of things.
• 18:02
  I think it's really freaking out.
• 18:03
  What's your Field of Dreams moment?
• 18:06
  We've built it. We are sure how people will come
• 18:08
  out and attend. It's it's a balance.
• 18:11
  It goes through that. I'd love to talk a bit more
• 18:13
  about your role as a director of security architecture.
• 18:16
  What the heck does that mean? What do you?
• 18:19
  Do so I got into architecture at at GE which was it was still a
• 18:30
  lot of hands on work but it was more that's when you start
• 18:33
  moving up a A level and looking at it the enterprise in a more
• 18:38
  holistic manner. Mitsubishi is a really good
• 18:42
  company in that they recognized that they needed that.
• 18:46
  So I'm part of a a larger architecture team that's made-up
• 18:51
  of just a bunch of brilliant architects, each within their
• 18:57
  own domain. Identity and security tend to be
• 19:00
  my my focus points. So like one of the first things
• 19:05
  I was handed going through the door was.
• 19:09
  Hey, we need you to look over our identity ecosystem and tell
• 19:15
  us what you would start with to to make improvements which
• 19:19
  turned out to be identity governance, administration and
• 19:23
  privilege access management. And you know we're we're
• 19:26
  continuing to work on on both of those, but the architecture
• 19:29
  department is the, we're in domain architecture.
• 19:35
  So there's enterprise architecture, which is more
• 19:37
  about the governance. And the process and the that's
• 19:40
  what they manage. Domain architecture takes all of
• 19:44
  those enterprise rules and we kind of decompose them down into
• 19:49
  our domains. And then like for the identity
• 19:51
  domain, I would talk about here the the standards that are in
• 19:54
  play. Here's for something like
• 19:57
  directory services, Here's what we're using now.
• 19:59
  Here's what's in containment. Here's some stuff that we think
• 20:04
  is coming down the Pike in a few years.
• 20:06
  And then. You know, the future state
• 20:08
  stuff, the things like at a conference like this that
• 20:11
  they're they're talking about that we're going to keep on our
• 20:13
  radar. And I've actually got that for,
• 20:16
  you know, about two dozen individual buckets within that
• 20:20
  identity space. And then we have solution
• 20:23
  architects who take the patterns and everything that we develop
• 20:27
  in the domain and put them together to actually build
• 20:30
  solutions for them the the developers and such.
• 20:36
  So you also work with ID Pro? And yes, how did you get
• 20:40
  involved with ID Pro? It was.
• 20:42
  It was your cohost, he and he and.
• 20:45
  What'd you do? I knew.
• 20:47
  Hutch as a He was my client, right?
• 20:50
  That's right. Yeah.
• 20:51
  That's how we That's how I first got to know you is when I was
• 20:54
  Burton Group days, you were my client and I just knew he was a
• 20:58
  good guy, forgot about Burton Group.
• 21:01
  That's the way we haven't heard what a great organization that
• 21:04
  was. There.
• 21:07
  You know, The funny thing is you mentioned Novell.
• 21:09
  Well, I was a Novell 311 administration, so that dates me
• 21:13
  relative to you. And a lot of old school identity
• 21:20
  folk are kind of children of Novell.
• 21:22
  There's there's actually one walking around here.
• 21:25
  I know Jim is too. But Burton group was very much
• 21:29
  that Jamie Lewis and and Craig Burton and we're both at Novell.
• 21:34
  So, like, there's an interesting.
• 21:36
  Heritage about Novell, both as a company but also as an identity
• 21:40
  company and its influence on a certain generation of of people.
• 21:44
  And but anyway, we digress. This is about Hutch.
• 21:48
  Well, let me let me tie it back to me.
• 21:52
  The first session at the first conference I ever attended was
• 21:59
  the 2013 Clyde Identity Summit in Napa, CA, and it was The
• 22:04
  Hitchhiker's Guide to Identity with Nishant Pam Dingle and Dale
• 22:10
  Olds. And I didn't know Pam, and I
• 22:13
  didn't know Nishan, but I kind of knew Nishan.
• 22:17
  But Oh my God, Dale Olds. Dale Olds was invented to NDS.
• 22:23
  Novell Directory Service. He's right there.
• 22:26
  He's standing on the stage. Signed my directory, right?
• 22:30
  Could you sign my root node like, Oh my God, you got an
• 22:34
  address book? So how did you get into ID Pro
• 22:37
  then? So we're going to blame Ian for
• 22:38
  it. Well or or I don't know
• 22:42
  compliment. I don't know.
• 22:43
  We'll find out the story. So Ian did, I think was the one
• 22:47
  who was instrumental in getting the there was a mailing list
• 22:51
  that the Cantara initiative agreed to, to host.
• 22:56
  Which is very. Which was still very
• 22:57
  appreciative. Yeah.
• 22:59
  Which was the the first set of discussions about what would an
• 23:04
  professional organization look like for identity practitioners?
• 23:09
  And that mailing list went on for a little over a year.
• 23:15
  And then I was on that mailing list, and I don't even remember
• 23:21
  what the circumstances were, But Ian came to me at one point and
• 23:25
  said, we're getting ready to kick this thing off and we're
• 23:29
  forming a board and we would like you to be on it.
• 23:34
  And once I realized I wasn't dreaming and this was like,
• 23:41
  really happening, yeah. Oh, I I I jumped at the chance.
• 23:46
  I remember the I remember the first Facetoface board meeting
• 23:51
  and around Ian dining room table.
• 23:54
  Yeah, so, so from not too far from here.
• 23:56
  No, no, not at all. Just a couple stops in the
• 23:59
  metro. So you know from my perspective
• 24:02
  like we were getting the legal entity created and like one of
• 24:06
  the things and I've learned aren't too much about governance
• 24:09
  of organizations in this process over the years.
• 24:12
  And I continue not to learn my lessons from that.
• 24:14
  But that's Okay and we needed a Board of Directors and it was
• 24:18
  very important for that first board.
• 24:21
  That we had a nice blend of people that were working in
• 24:24
  enterprise, doing the work because it felt very incomplete
• 24:32
  if we just had people that worked at technology providers.
• 24:36
  And so I was thinking about like, who are some of the folks
• 24:40
  that are, like, just so demonstrative of a practitioner
• 24:47
  and who I know can get. Shit done.
• 24:51
  And who I think would be good together and you know we we were
• 24:57
  lucky to get a a really wonderful group of individuals
• 25:01
  hutch among them. And yeah.
• 25:05
  And then it went from there, yeah.
• 25:08
  And now you are on. You are aboard Emeritus now of
• 25:12
  ID Pro. Yeah, Emeritus Island.
• 25:14
  We call it Emeritus Island. Where we send our our elders off
• 25:19
  and they go and there are tiki drinks we've been told, although
• 25:22
  none of us have actually had them together, which is awkward.
• 25:26
  But one of the things that was important about the board for me
• 25:31
  and the organization was we needed to have, and I think this
• 25:35
  is still true, a continuing change over in leadership to
• 25:40
  bring new experiences, new people, new demographics to that
• 25:45
  board. And so we had.
• 25:46
  Still do have term limits, so I was moved on to the island a
• 25:51
  couple years ago. Hutch and the remaining members
• 25:54
  of the original board have joined us now.
• 25:57
  I went with you. Oh, that's right, you were.
• 25:59
  That's right, you were You, me and Lance all went right.
• 26:02
  That's right. We were the first.
• 26:03
  Well, Alan, who was our? Alan Foster?
• 26:07
  Yep. Who was kind of the the Kantar
• 26:09
  representative? Yep.
• 26:10
  First year. We sent about first, yeah.
• 26:13
  He scouted out locations. He's miserable.
• 26:16
  He's miserable at building log cabins.
• 26:18
  But that's an entirely different conversation.
• 26:21
  And then you, me, and Lance. And just recently, this past
• 26:25
  July, the last of the original board has gone to Ameritus
• 26:30
  Island. So what happens on Ameritus
• 26:32
  Island? Do you guys have like a secret
• 26:34
  handshake? I know you mentioned the tea
• 26:35
  drinks, but you can't talk about it.
• 26:36
  Okay. Let's move on to next question
• 26:39
  then let's talk about Identity Week, America.
• 26:43
  You and I were on a panel today. Or we were.
• 26:45
  Ian, a lot of people on it. Yeah, really good panel.
• 26:48
  Thank you very. Much thank you.
• 26:50
  First time doing a panel, or at least be moderating ones like.
• 26:52
  That see, that blows my mind, because now I feel you.
• 26:56
  Need to be a professional monitor cuz it was really well
• 26:59
  and I'm not like buttering you up because I wanna be on the
• 27:01
  podcast again. It's because like there's a
• 27:05
  general ease that you ask questions and I think there's
• 27:07
  some similarity to what you do here, but like also.
• 27:11
  The sort of sprinkler, in fact, right?
• 27:12
  Like make sure everyone gets a little bit of time.
• 27:13
  You did that. All very natural.
• 27:15
  I did. I did.
• 27:16
  I did prep for it quite a bit, just to make sure it's funny
• 27:19
  because, you know, I've done this podcast now for over 4
• 27:22
  years. This is episode #237, I think.
• 27:27
  And we've grown, yeah, we've grown from like nobody listening
• 27:32
  to literally thousands of people around the world.
• 27:34
  And I'm not nervous doing this really anymore.
• 27:39
  I don't think I ever really was. But getting up on stage is a
• 27:42
  totally different beast. I don't know.
• 27:44
  I just haven't done it enough. I I'm critiquing myself as I
• 27:47
  went through it. I just started us off.
• 27:49
  I didn't even introduce myself which is like here's all the
• 27:52
  people on the stage and which is kind of get into it and that was
• 27:54
  it. I think it's oh crap.
• 27:56
  I forgot to introduce myself like 101 I guess for for
• 27:58
  presenting. But we did have a good
• 28:00
  discussion. We did have a lot of it was a
• 28:02
  rowdy bunch. We had yourself Spicy.
• 28:05
  We had Megan Shamus from Fido. We had Jeff Rich from the IDSA.
• 28:09
  We had Tim Meyerhoff from Iris ID and we had Julie Mad from
• 28:14
  LinkedIn and you guys mixed it up.
• 28:18
  It was great. I felt like I had the easiest
• 28:19
  job up there cuz I was just asking questions and then trying
• 28:23
  to make sure whoever was giving me the nod or, you know,
• 28:26
  different visual cues, that he had something to say and try to
• 28:29
  pass it around. The measure of a panel is
• 28:31
  whether you have people saying I agree with the previous
• 28:33
  panelist, and that's like, oh fail oh fail you want.
• 28:38
  You want some interchange, you want some interplay.
• 28:41
  And because otherwise the audience is like, well, why are
• 28:44
  there all of you up there? Can I just have one of you?
• 28:45
  If you're all going to agree, that doesn't make a lot of
• 28:47
  sense, but we were we should actually tell people we're
• 28:49
  talking about authentication, and notably modern
• 28:53
  authentication. Modern and quotation marks
• 28:55
  we're. Definitely doing that in and.
• 28:56
  I and I started with you. I said tell me what modern
• 28:58
  authentication is. Right.
• 28:59
  And then I was like, well, there's contemporary, which is
• 29:02
  S&SOTP, and that's a sad, sad thing for all of us.
• 29:05
  And then I alluded to the concept there might be
• 29:07
  Postmodern Authentication, which is really, you know, I don't
• 29:10
  even know what that is, but we'll come up with it.
• 29:12
  And somewhere, somewhere there's a startup.
• 29:14
  Right now, a guy handed me his card as we're getting off the
• 29:16
  tape, just like we do Postmodern Authentication.
• 29:18
  I'm like, I feel like I should have trademarked that on the way
• 29:22
  up. I'm like I'm not really sure how
• 29:23
  that works, but like I should have done that.
• 29:26
  But we we we talked about state of play where we want to go and
• 29:29
  I I don't know you were in the audience how did how did it go
• 29:31
  Hutch I thought it was fantastic.
• 29:33
  I was I was telling I I feel even worse now that that was
• 29:36
  your first point. I've moderated panels before and
• 29:39
  I don't do them that well. I I like being on a panel like
• 29:45
  moderating the the the panel. But I'm I'm doing one this
• 29:49
  afternoon on customer I am which is become near and tear to my
• 29:56
  heart and there's some really good panelists on the way people
• 30:01
  from Hilton and PNC Bank and Nationwide Insurance and for
• 30:05
  truck ping. For truck ping.
• 30:07
  We're going to get something. We should get a talk about that
• 30:09
  in a second, yeah, but a good wide-ranging.
• 30:14
  And I do have questions in there about and you know how how ACIM
• 30:19
  use case is different between those different pieces.
• 30:22
  But yeah, no, I thought you handled it very fluid again,
• 30:27
  maybe because of the podcasting experience.
• 30:29
  That's why I'm going to blame it on why it's not that I'm it's
• 30:33
  not that I'm not good at this. It's so on the topic of CI AM, I
• 30:38
  do want to put a plug in for ID Pros body of knowledge there has
• 30:43
  been so for those of you who don't know, the body of
• 30:45
  knowledge is a vendor neutral set of articles and ranging in
• 30:50
  various lengths and detail. About different topics inside of
• 30:53
  Identity and it's really quite far ranging and it and there's
• 30:57
  always been one gap in the body of knowledge and it has just
• 31:04
  bothered me and to the point where I'm like, fine, I'll do
• 31:09
  something. About it, I'll do it myself.
• 31:10
  We'll do it live. We'll do it live.
• 31:13
  So coming soon to a theater to you is a what I think we're
• 31:17
  calling part one of a Customer Identity and Access management
• 31:20
  body of knowledge article. It's a huge topic.
• 31:24
  I mean, it's like as prepping for your panel.
• 31:26
  I'm like, Oh my God, you can go in so many different ways of
• 31:28
  this thing. But we're trying to lay out, you
• 31:31
  know, a little bit of a who you need to be aware of, What are
• 31:35
  the things you need to be aware of, What are the basic building
• 31:38
  blocks because there's so much deeper things we'll get into
• 31:43
  eventually. But I'm super excited for that
• 31:45
  one to hit the streets. We're in DC right now.
• 31:48
  I don't know. Did we mention that we're in DC
• 31:50
  and? Heather Flanagan, who is the
• 31:54
  acting executive director of ID Pro and principal editor of the
• 31:57
  Body of Knowledge, happens to be in town for another event.
• 32:01
  And when we get out of here, I'm going to make sure we go talk to
• 32:04
  me like, when's it coming out, when's it coming out?
• 32:07
  Because it's that's a place I feel like as an industry we
• 32:12
  don't have enough material in that topic space.
• 32:16
  So I'm stoked to get some more out there.
• 32:18
  Talk. Talk about a slice of the
• 32:22
  identity ecosystem that you need to have the business involvement
• 32:27
  in. Yeah, I mean forget what I said
• 32:29
  about having trying to get business requirements from them,
• 32:33
  but this is a place where the your identity ecosystem is going
• 32:39
  to help drive business strategy. I mean it it's it's all wrapped
• 32:44
  up in customer retention and user experience.
• 32:47
  And it's it's not just a, it's not just a big topic, but it's a
• 32:53
  super important topic that I don't know in my my previous
• 32:58
  lives wasn't as big a deal, didn't seem to be as big a deal
• 33:02
  like as it now working for a a bank where you know you're
• 33:07
  dependent on not just your your consumer customers but your
• 33:12
  business customers as well. It is huge.
• 33:15
  There's so many places to go with that.
• 33:17
  Well, you hit on a really important point, which is that
• 33:22
  the experience, the friction, whether you need to add it or
• 33:25
  remove it, all of that is not a separate conversation from here.
• 33:32
  The business priorities for this year like they're directly tied
• 33:35
  in and that to me is super exciting, it's nerve wracking
• 33:39
  and you have a whole new set of stakeholders speaking a whole
• 33:41
  new language. But it's such a growth
• 33:44
  opportunity if you can tap into it, yeah.
• 33:47
  And trying to decide as you're trying to reduce friction for
• 33:52
  your customers, you're also trying to beef up security so
• 33:57
  you don't get breaches, you don't have fancy new AI systems
• 34:03
  that are trying to imitate the users, your customers coming in.
• 34:08
  It's where where is the sweet? I'm, I'm super excited to be
• 34:12
  asking people this afternoon in all these different industry
• 34:15
  areas where where do you see that sweet spot where you had to
• 34:20
  figure out where that is? I'm again, I'm interested to see
• 34:25
  where that conversation goes. Well, I find interesting is is I
• 34:29
  very rarely see people in the real world enterprise, whatever
• 34:33
  it may be, who are doing both. Enterprise Identity Access
• 34:37
  Management or Workforce Identity Management, the internal side
• 34:39
  and they're also doing customer or consumer IM.
• 34:43
  What I typically see in my experience is there is one group
• 34:47
  that's doing CIM and another group that's doing inside of
• 34:51
  things, but I'm starting to see more blending of those two
• 34:55
  groups. Historically, I would say like
• 34:57
  ecom and marketing were Mark, which we're much more involved
• 35:01
  with doing the CI, the Cyam stuff.
• 35:04
  Whereas, OK, I work on the enterprise and I don't have to
• 35:06
  worry about that kind of stuff. It's changing.
• 35:08
  I think we're starting to see a lot more blend between the two
• 35:11
  and. Wait, you mean that there might
• 35:12
  be, there might be a Chief Digital Identity Officer in the
• 35:15
  offing? The Cheeto could.
• 35:17
  Cheeto could make a presence. Still sort of torn on that.
• 35:21
  Hutch is shaking his head like you guys are dorks.
• 35:24
  Stop trying to make chief identity start.
• 35:27
  Up. That's like that meme image,
• 35:28
  right? It's not going to happen.
• 35:30
  I'm I'm torn on it too. So we can we can leave it at
• 35:33
  that and move on to other topic. All right.
• 35:35
  Let's move to because we we talked about Ping and Ford Rock
• 35:38
  briefly. News broke relatively recently
• 35:42
  that first of all Ford Rock was acquired by Tomo Bravo and then
• 35:46
  now Ping which is another Tomo Bravo company is acquiring Ford
• 35:51
  Rock. What does that mean?
• 35:54
  What do we think is going to happen between Ping and Ford
• 35:56
  Rock? And this is certainly.
• 35:59
  You know we're all, I don't think any of us have any inside
• 36:00
  information, we're just kind of thinking about it.
• 36:02
  But I think it's questions out there is who survives, you know
• 36:05
  this consolidation of two different companies because I
• 36:07
  can't imagine that you'll continue to have both Ping
• 36:10
  products and Ford Rock products doing which do very similar if
• 36:13
  not the same things. Yeah, I I'm, I will say I know a
• 36:20
  lot more about the Ping side of the house than I do about the
• 36:24
  for the Ford Rock. But I honestly thought it was
• 36:28
  good news for both of those companies because I I have to be
• 36:36
  concerned about what I say because I want to make anybody
• 36:38
  upset. But.
• 36:40
  Opinions our own do not reflect our employers blah blah blah.
• 36:42
  So I mean for the for the longest time it's like the the
• 36:46
  people who were the the Champions for me in that space
• 36:50
  where you know again Brian Campbell who's still there and
• 36:55
  Pam and all all the people who were at Ping and they Ping a
• 37:01
  great company. Ping was there.
• 37:02
  They were always on the cutting edge of they if you if new
• 37:05
  standards were coming up, Ping was there.
• 37:07
  They seem to be the the, the kind of the technology company
• 37:12
  centering ourselves around Ping Federate when I was at GE was
• 37:16
  just a smart thing to do but you had to build like a lot of your
• 37:21
  own stuff around it. It wasn't a complete stack. 4
• 37:26
  truck seemed to be the you know if if airlines were, if identity
• 37:34
  companies were airlines, 4 trucks seemed to be the one that
• 37:37
  everybody shows up at the airport with a different part of
• 37:40
  the plane and then you you kind of put it all together and then
• 37:45
  but they did have it. It was more like a full blown
• 37:49
  identity and access management. You could build a kick ass plane
• 37:52
  that way, yeah. You could right.
• 37:54
  But you need you need to have some pretty good talent to you
• 37:58
  know I I honestly think there's a there's a lot of baggage
• 38:04
  that's going to fall by the the wayside but that you can build a
• 38:09
  a really nice solid identity stack from the the components of
• 38:17
  those two companies And something that's something
• 38:21
  that's easy to use still technologically advanced solid
• 38:26
  when it's you know when you're doing the even the the the more
• 38:30
  advanced standards the the newer stuff that's coming out.
• 38:33
  I think the other thing that tends to get overlooked in these
• 38:38
  kinds of situations is now you've got one company with who
• 38:43
  both of them had amazingly talented people in their
• 38:47
  organizations, and now it's an embarrassment of riches in a lot
• 38:51
  of ways. And so I think that's an
• 38:54
  interesting opportunity. I think the the road will
• 39:00
  probably be rocking and like this moment, right that the, the
• 39:02
  announcement is less than maybe a month old, give or take.
• 39:08
  You know it's uncertain for everybody inside the
• 39:10
  organization and outside I'm sure.
• 39:11
  And you know, the negative thing that happens in markets and it
• 39:17
  has nothing to do with Fort Rock and Ping specifically, is in
• 39:20
  these moments of uncertainty. Less scrupulent vendors will
• 39:24
  start going and targeting these called out on customers on both,
• 39:28
  right. I'm sure paying and forge.
• 39:29
  Our customers are getting calls. People are like, hey, you're
• 39:32
  screwed. You don't know that yet.
• 39:34
  So we're going to have our thing come in, right.
• 39:36
  Like I'm sure it's just a market reaction that happens.
• 39:38
  It's really, really unfortunate. And you know, I think one of the
• 39:42
  most important things is if you had a principled architecture to
• 39:46
  begin with and everyone does, but you know, hopefully we're
• 39:49
  all aspirational trying to get that that.
• 39:53
  The product that is scratching the particular itch is part of
• 39:57
  the story, but it's not the whole story.
• 39:59
  I mean, we literally started this conversation like, hey, you
• 40:01
  bought a thing and it didn't solve the problem because it has
• 40:03
  to be part of the whole. I think what will come out of
• 40:09
  this, much like what Hutch was saying, is it'll be a better
• 40:12
  outcome over the the arc of the story and and patience and not
• 40:17
  freaking out in the moment is really important.
• 40:20
  I think it's going to be a rocky couple years.
• 40:22
  I think it takes a few years to do an integration.
• 40:23
  I mean I went through the same thing with OFF 0 for example,
• 40:26
  you know relatively recently. By the end of the day, I think
• 40:28
  there are stronger products because of it.
• 40:32
  Yeah, I feel the same way then any other big acquisitions we
• 40:36
  want to make predictions around, like how do we feel about some
• 40:39
  of the other players and identity anybody else going to
• 40:42
  get bought up, snapped up by someone else?
• 40:44
  They're they're companies that hope get bought up.
• 40:49
  I would love to see Microsoft by like a real identity governance
• 40:56
  administration company and integrate those systems into
• 41:03
  Azure, but isn't that what Entra supposed to be?
• 41:06
  It. I mean, if I read the marketing
• 41:09
  from Microsoft, Entra will do everything that I needed to do
• 41:12
  and I don't have to drive my car anymore.
• 41:15
  I was about to say. I'm not sure it was.
• 41:19
  As as big a technology leap as it was marketing.
• 41:23
  Very diplomatic. Which is, Which is That's not to
• 41:26
  knock Microsoft, because over the last few years I I will
• 41:31
  admit I I I didn't jump on the Microsoft bandwagon until later
• 41:36
  in my career. But I remember in 2016 Clyde
• 41:41
  Denny Summit in New Orleans, Alex Simons saying.
• 41:48
  You know, no, really we're we're we're going to standardize on,
• 41:52
  we're going to adopt fully adopt real industry standards.
• 41:56
  We're we're committed to to doing this.
• 41:59
  And I was kind of like, yeah, well, I'll believe it when I see
• 42:01
  it and and I believe it now they made huge investments and not
• 42:06
  just the the systems but in people the the identity stuff's
• 42:11
  gotten easier to use. It's got I'm really impressed
• 42:13
  with. How they've integrated it to
• 42:16
  their cybersecurity tools and at my own company we've we've kind
• 42:25
  of adopted a strategy of, you know, we would love to use Azure
• 42:30
  tools where Azure tools are mature, but there's still some
• 42:34
  places where they don't solve for everything.
• 42:39
  Identity, governance and administration is one of them.
• 42:42
  It's historically been one of their pain points because I
• 42:44
  remember I think it was at a Gartner in 2015 or 16.
• 42:47
  Microsoft was on the stage and they gave like an identity
• 42:50
  governance demo of part of their product and haven't seen it
• 42:54
  since then. They've done really well with
• 42:57
  the authentication like I think you know they've definitely
• 43:00
  consumed a large market share through office services and
• 43:03
  things like that where absolutely the authentication
• 43:06
  product is world class, you know definitely you know one of the
• 43:11
  best options out there. But they've really struggled on
• 43:13
  they got any governance side of things.
• 43:15
  I think it's interesting that you mentioned that is an area
• 43:17
  you like to see them prove because historically their track
• 43:20
  has been well we go this far with IGA and once you get past
• 43:24
  that, hey, let me introduce my good friends over here.
• 43:28
  At first it was, I think Omata and then it was sale point and
• 43:32
  then it was Savion. And they've kind of bounced
• 43:35
  around between who's their IGA partner of choice since then.
• 43:38
  And I have to, and I've been wondering for years, when are
• 43:40
  they actually going to do IGA well enough that isn't so
• 43:45
  myopically focused on Microsoft products and services that they
• 43:48
  can support more than just Microsoft.
• 43:51
  Because that's been the knock on Microsoft with everyone that
• 43:54
  I've talked with. And all the points that I've
• 43:55
  seen and done is once you leave the Microsoft ecosphere, really
• 43:58
  a lot of the stuff kind of falls down and the open standard helps
• 44:00
  for the authentication standpoint.
• 44:02
  But when you start talking about identity governance, you're
• 44:04
  talking about hundreds of apps that may or may not be cloud
• 44:09
  the. Problem is, everything skimmed
• 44:11
  in so we can solve it, right? Yeah.
• 44:14
  And it's like, OK, well, I want to be able to know who has
• 44:16
  access to what. Well, great, we can tell you
• 44:17
  that for these five things. OK, but what about these other
• 44:20
  200 that I have? You know, the interesting thing
• 44:22
  about the IGA market itself is much like I think certainly in
• 44:29
  the markets I've looked at the Microsoft.
• 44:32
  Octa duopoly is a thing like the sale point kind of savviant
• 44:36
  duopoly is kind of a thing and I have to wonder if that's sort of
• 44:40
  the next sort of space where we're going to see some
• 44:43
  interesting entrance. I think one thing that's also
• 44:45
  just a weird dynamic going on or maybe a not foreseen dynamic is
• 44:51
  there's a lot new there's there's some new potential
• 44:55
  acquirers that I don't know if I would have picked, for example.
• 44:59
  Cisco buys ort ort is all of nine months old I think when
• 45:03
  they got acquired maybe a year or so and the nascent shall I
• 45:07
  say identity, threat detection, response, recovery, rinse
• 45:11
  leather, repeat. I'm not entirely sure what it
• 45:13
  all means. And then they go by Splunk,
• 45:17
  which and back in the day one of one of my good friends and and
• 45:24
  friend to identity. Bob Blakely always referred to
• 45:27
  Cisco as where software goes to die and there's many examples of
• 45:32
  software being acquired where they've not sort of survived
• 45:36
  long at Cisco. So I'm very curious about what
• 45:38
  is different now. Certainly Cisco is making more
• 45:41
  investment in the United space, both in acquisition and actually
• 45:44
  just straight up investment and the other one that so that's
• 45:48
  like a space to watch. The other one is Crowd Strike.
• 45:55
  And because you're seeing them really push into ITVR through an
• 45:59
  acquisition that they had made and you know, you know,
• 46:01
  protecting endpoints and now identity infrastructure, that's
• 46:06
  I I don't know actually how to process that.
• 46:08
  I'm just not entirely sure what to do with that.
• 46:10
  But it is interesting to see new acquirers get into the space
• 46:15
  because at some point, like you know, you looked at the classic
• 46:17
  acquires the oracles of the world.
• 46:21
  IBM's, the Hba's, the HP, IBM CI, and it really was like that
• 46:25
  part in in Monty Python where it's like we're looking for the
• 46:28
  holy grails, like, oh, it's too bad we already have one, right?
• 46:31
  Like, it's like Oracle had there we go.
• 46:36
  That's the that's the warning for the emergency alarm coming
• 46:38
  up. This is the pre alarm, right?
• 46:41
  Just in case we weren't sure, we are actually at a conference
• 46:45
  recording. Run by a a particular a British
• 46:48
  organization. Thus the British accent that you
• 46:50
  might have heard if you're confused.
• 46:52
  They they don't speak like that here in DC, but like these
• 46:55
  vendors, I mean Oracle had I don't know how many like
• 46:59
  essentially Ivp's or federation servers in their stable at any
• 47:04
  one time like 50 or something and it's not really true.
• 47:07
  But. Those acquirers now have got
• 47:09
  multiple. They've digested them over the
• 47:10
  years, they've repurposed them and they've done other things.
• 47:13
  So I think we're seeing a new generation of that, which is
• 47:14
  actually really interesting to watch as a market dynamic.
• 47:17
  It's very cyclical because you get these platforms right.
• 47:19
  It was oh, we have Oracle, I can do everything.
• 47:22
  And then there were the reaction to that was, well, let's go off
• 47:26
  and get sale point because. They're the new debris best of
• 47:28
  Stack. Yeah, exactly.
• 47:29
  And now guess what? We're back to this thing called
• 47:31
  Converged IM, which is to me sounds and smells a lot like
• 47:36
  another platform play. It is interesting to see other
• 47:39
  companies cut into this because they're not the typical
• 47:41
  platforms that you would expect like an IBM or CA or whatever.
• 47:44
  Maybe it is crowd strike. It is Cisco other folks that you
• 47:48
  wouldn't normally associate with identity.
• 47:50
  As a as a practitioner, I've I've seen the journey from the
• 47:56
  the consolidation. In my own particular instance,
• 48:00
  I'm glad you brought up CA. I was just feeling old that we
• 48:03
  weren't talking about. Should we say BMC and then we've
• 48:06
  like now like hit for the cycle or something there?
• 48:08
  I. Control SA baby.
• 48:10
  I had really wanted to to stay at GE until we shut the last
• 48:14
  site minder server off, but I didn't make it.
• 48:17
  It's still out there. I missed it.
• 48:19
  I missed it by like 6 months. Not at GE, not at actually, but
• 48:23
  there are plenty of installations still out there.
• 48:27
  But there was the consolidation but then and one of the reasons
• 48:31
  we were off of it but was because we were we were we were
• 48:34
  breaking back out. Best of we're going to do.
• 48:36
  Best of breed we're going to do ping.
• 48:39
  We're going to do sale point we're going to do you know it
• 48:41
  was we were buying it now I see it exactly what you kind of
• 48:45
  talked about I see it coming back again but I I see it this
• 48:50
  time we'll. Get it right.
• 48:53
  I I'm not going to claim to be naive enough to believe that
• 48:56
  it's it's all good, but in my opinion it's it's been better.
• 49:02
  Like when I feel like we can talk about CA because they're
• 49:06
  not around anymore, but like when CA bought Siteminder, all
• 49:12
  the engineers left and Siteminder was just kind of
• 49:16
  there, but it. You didn't see the development
• 49:19
  and the improvement of it going forward.
• 49:21
  I feel like that's different now with companies like, right, I'm
• 49:25
  knit right off the top, I'm a huge crowd strike fan.
• 49:28
  But when they've when people have these large companies have
• 49:34
  acquired other companies, it seems to be more strategic.
• 49:38
  It's not just a purchase for market share, obviously that's
• 49:41
  part of it, but it's really to fill a niche into, hey, we
• 49:45
  really don't have a service here.
• 49:48
  That can solve for this thing and I feel like they're better
• 49:51
  integrated. You see like engineering
• 49:54
  resources that the oh gosh I'm going to forget the name of the
• 50:01
  the directory begin with EU that Ping bought unbound unbound.
• 50:06
  Yeah, like when ping bought unbound ID, those engineers
• 50:10
  didn't leave and because of that ping directory I feel was like
• 50:14
  really good. And and absolutely.
• 50:17
  I I see a lot of that similar thing going forward with again
• 50:20
  companies like Crowd Strike. Well that's why I think it's so
• 50:23
  critical these stages when these, you know this this next
• 50:27
  couple years, right for Ping and Ford track could be really
• 50:28
  important. Who is going to be left, you
• 50:30
  know still within the organization.
• 50:32
  I mean, Can you imagine if Victorio had left off 0 when
• 50:37
  they got bought by Octa? Octa would not be you know, the
• 50:41
  same company without that type of talent being there.
• 50:44
  So I think it is interesting to see strategic acquisitions that
• 50:48
  are that makes sense, right? You're not just the shell
• 50:50
  company picking up different parts, maybe that's Toma Bravo,
• 50:53
  I don't know. But you know they're they're
• 50:55
  collecting the Fanos ring of all the different services that are
• 50:58
  out there. But when you see these other
• 51:00
  organizations come through, it's like OK, yeah, I can kind of see
• 51:02
  how that would work because you're already in this space and
• 51:04
  it's adjacent to where I want to be.
• 51:08
  But I think it, I think it's a critical time right now where
• 51:11
  you do these massive, you know, integrations between two large
• 51:14
  companies. I mean a lot of talent we've got
• 51:17
  you know tons of people we know from both companies if they all
• 51:21
  stick around and have a cohesive strategy, I mean nothing's off
• 51:25
  the table as far as world domination goes, you know for
• 51:27
  that group and and I think it's great because historic I think
• 51:31
  for the last couple years at least it's really been a
• 51:32
  Microsoft Octa dog race on the authentication side.
• 51:36
  Almost every organization I've worked with is one of those two.
• 51:40
  It's very rare that I see Ping actually out being used in the
• 51:44
  real world. Usually it's a Ping Federate
• 51:46
  because they've got that, you know, legacy and they've kind of
• 51:48
  gone through there. But from my experience just
• 51:51
  having done, you know, hundreds of consulting engagements, it's
• 51:53
  pretty rare that actually see Ping out there.
• 51:55
  I see actually see Ford rock more than I see Ping.
• 51:57
  I think ping ping probably took too long to really adopt the the
• 52:04
  cloud. Like as a true if if we could
• 52:06
  have gotten ping as a SAS service.
• 52:09
  You know a true SAS service early on rather than you know,
• 52:13
  having. We were very fortunate that John
• 52:16
  Leppman who's now a doctor, he when he was a GE with us, he
• 52:24
  developed some of those first, was one of the first people to
• 52:28
  put ping into Docker containers. Donated all his stuff to to ping
• 52:32
  to say hey look I deployed this to the cloud so you can build
• 52:36
  and destroy. Ping servers and the thing.
• 52:39
  But it wasn't a we still had to, we still had to manage it.
• 52:43
  You still had to have like a really talented identity team.
• 52:47
  It wasn't like going to Octa and saying, yeah, I just want to use
• 52:51
  your stuff and it's like let it swipe your credit card and
• 52:56
  you're up and running. Yeah, I mean that's it's the,
• 52:59
  the transactional nature now of a lot of these different
• 53:02
  services were, yeah, literally, I mean a WS has certainly gotten
• 53:05
  this down to science, right? Add your credit card to your
• 53:08
  Amazon account, next thing you know you're spinning up EC2
• 53:10
  service over the place, right? It's it's very commoditized from
• 53:13
  that perspective. We've got about 10 minutes until
• 53:17
  the alarms go off. Feels like the natural close,
• 53:20
  right? So we have we have set precedent
• 53:24
  on this podcast that when we're at a conference doing this sort
• 53:27
  of thing, something happens to kind of close the show.
• 53:31
  Octane last year we were recording literally as they tore
• 53:34
  the walls down around us and are in an area kind of like this.
• 53:37
  It actually had walls. You didn't take the hit.
• 53:41
  Alright, well we gotta go is literally as walls are falling
• 53:43
  down next to us and I feel like the best way to end this show
• 53:46
  would be to hear that thing going off because I I want to
• 53:48
  get into Dungeons and Dragons because we were talking a little
• 53:51
  bit before we hit the show. I was wondering how you're gonna
• 53:53
  segue this, but there is no clever segue there other than
• 53:56
  I'm fascinated by it. I'm very interested and I'm.
• 53:59
  I'm looking to learn. I recently started playing
• 54:02
  Baldur's Gate, which got me kind of back into that for people who
• 54:06
  are in the video game space. We were talking some of this.
• 54:08
  You know what, How do we want to end on a lighter note?
• 54:11
  And then you mentioned Dungeons and Dragons.
• 54:14
  What's a hobby? And that's our hobby.
• 54:17
  Is is obsession? Lifestyle.
• 54:19
  Yeah. So people who.
• 54:20
  So for people who are not familiar with Dungeons and
• 54:23
  Dragons, how do you explain it to a total newbie?
• 54:26
  It's a it's a game. That exists in large part in
• 54:31
  your imagination. There's there, there is a set of
• 54:35
  rules which you can choose to follow or not follow.
• 54:40
  I feel it helps me to follow them, but where the story goes,
• 54:45
  I mean there's a the the we used to call them the Dungeon
• 54:50
  Masters. Now they're the Game Masters, so
• 54:52
  they're GM's instead of GM's, but the Game Master is really
• 54:57
  setting out. A framework, but just we do an
• 55:00
  identity, it's setting out a framework the particular
• 55:04
  solution. Like pitch talk coming for next
• 55:07
  year? This is gonna be the.
• 55:09
  This is gonna be my Hutch's next like this is gonna be.
• 55:12
  Presentation or. This is gonna be the Identifiers
• 55:14
  keynote. I'm seeing a Dm's guide to
• 55:16
  identity or something like that, or GM's guide.
• 55:18
  We'll try it out at the IC and see how it goes.
• 55:20
  There you go. No the the.
• 55:25
  They're basically laying out you know here's here's the world
• 55:28
  here's the situation I've created.
• 55:30
  But where you go and it is is defined in large parts of you
• 55:34
  know where the characters have and honestly the the
• 55:36
  role-playing is the the most fun.
• 55:38
  You get like a really good group of of people together and
• 55:42
  there's we actually play on ones hour day a month where it's it's
• 55:50
  a lot of former GE people that are.
• 55:54
  That are involved in the game. Anyway, the I started playing in
• 55:59
  1977. I was in 7th grade advanced DND
• 56:03
  which is version two and I played like 77th through 82 when
• 56:11
  I was in high school. I played a little bit in college
• 56:15
  because some of my friends worked for company in
• 56:18
  Charlottesville. I went to the University of
• 56:20
  Virginia. So.
• 56:21
  Company in Charlesville called Iron Crown that had their own
• 56:23
  version of D&D, and I spent a lot of time up in their third
• 56:28
  floor offices playing their new stuff.
• 56:33
  But then I I hadn't touched it until about three years ago.
• 56:40
  We we were on the Joko Cruise, The the cruise that Jonathan
• 56:46
  Cole created. The Nerd Cruise.
• 56:49
  Look it up. It's insane.
• 56:51
  But people were talking about a a a YouTube series called
• 56:56
  Critical Role, which was a bunch of the way they describe it.
• 57:02
  A bunch of nerdy ass voice actors playing Dungeons and
• 57:05
  Dragons, which turned out to be brilliant, became insanely
• 57:09
  popular then and suddenly Hasbro is buying, you know, D&D.
• 57:16
  There are these incredible computer tools instead of.
• 57:20
  Trying to scribble out a a map. I've got a I've got a 50 inch
• 57:26
  OLED TV that's in a case that sits on our dining room table so
• 57:32
  I can have digital maps that I, you know, that I can get other
• 57:36
  people have made. I used to use graph paper and
• 57:40
  that was like everybody did. Was like OK.
• 57:42
  And you'd have to, you know, like, draw your own stuff.
• 57:44
  And you can still do that, and it can still be fun to do that.
• 57:48
  But there's a lot of. Kind of time saving things.
• 57:51
  They're things that, you know, we play with a group that not
• 57:54
  everybody can sit around the same table anymore.
• 57:57
  But now with Zoom, you can have, you can have the the screen
• 58:02
  project, the map projected, you can have everybody's faces
• 58:05
  projected and people can roll dice digitally or in real life.
• 58:10
  It's to me it's the the ultimate nerd and I like being a A50
• 58:17
  something nerd. I I I I love the space.
• 58:20
  I've been playing games for my entire life.
• 58:23
  I never could. I never got into Dungeons and
• 58:25
  Dragons specifically because it was too complex.
• 58:28
  I think for my feet. I actually did like there was a
• 58:31
  Marvel take on dungeons and. I remember that I put that in
• 58:35
  high school and I I had a great time with that.
• 58:38
  We did like a campaign and had a great time with it.
• 58:41
  And then I never touched it again.
• 58:43
  And then I started playing video games.
• 58:44
  It was like EverQuest and then World of Warcraft for still to
• 58:48
  this. Day.
• 58:48
  And that's the day your imagination died.
• 58:51
  Well, I like this. I've always been a gamer.
• 58:54
  Just part of my DNA I guess. And then within the last couple
• 58:59
  of years, Dnd has started to take more public light, because
• 59:02
  I can watch people on Twitch, for example, stream their games,
• 59:05
  and famous actors are doing it. Like Joel Mangionello, right?
• 59:09
  Is like a DM and stuff like that.
• 59:11
  I started watching it actually even more with and I think I've
• 59:13
  mentioned this service before with service called dropout.
• 59:16
  Used to be College Humor people. Dimension 20.
• 59:18
  Yes, and dimension 20 and Brennan Lee Mulligan.
• 59:23
  Brennan Lee Mulligan was on the last Yoko cruise of course the
• 59:26
  one we decided not to go on so we could get to our Route 66
• 59:30
  trip. So if you if you're not here's I
• 59:33
  have no affiliation with dropout but they have a streaming
• 59:35
  service dropout TV. It's like 60 bucks a year, which
• 59:39
  is crazy for the amount of come they put out and they have so
• 59:41
  many good shows on there. They have this one called game
• 59:43
  Changer, but they have the different DND campaigns I guess.
• 59:48
  So I started watching those. It's interesting because it is
• 59:50
  you're watching almost like a play in real time, but players
• 59:53
  have it's a dynamic thing right where they can kind of get it.
• 59:56
  Now they're very good at it from the performance aspect because
• 59:59
  they are all improv type people. I'm curious, so how do how do I
• 1:00:06
  get started in DD? Do I just find like a local
• 1:00:08
  group to play with? Teach me.
• 1:00:11
  Yeah, so there's actually in in almost every city there's there
• 1:00:16
  will be like a a subreddit for like Richmond has one.
• 1:00:21
  Richmond has one that my partner Catherine was moderating for a
• 1:00:26
  while. But there there'll be a
• 1:00:30
  subreddit. And you can literally just post,
• 1:00:33
  Hey, I'm interested in getting into a game and it can either be
• 1:00:37
  a game where you meet up at a a lot of times breweries now have
• 1:00:43
  games that they host and they restaurants and and we'll do it.
• 1:00:48
  But yeah, you search out that somewhere and there there are
• 1:00:50
  some that are in person. There are some that are that.
• 1:00:53
  That's the great thing. It's there's so many different
• 1:00:57
  ways to play it now and the thing you talked about being
• 1:01:00
  complicated. Advanced D&D was insanely
• 1:01:03
  complicated. It was hard to understand even
• 1:01:05
  after you've been playing it a couple of years.
• 1:01:07
  Yes. The new version, starting with
• 1:01:10
  version 5, which is the one that we got back into so much easier,
• 1:01:14
  they they, they really kind of emphasize we're going to make
• 1:01:18
  this as simple as possible. They still get to do, you know,
• 1:01:23
  in Baldur's Gate. Three, I've heard is the closest
• 1:01:27
  thing to. Playing the tabletop like a lot
• 1:01:30
  of people have said. Oh, I just recreated my tabletop
• 1:01:34
  character in Boulder Skate 3 because it all falls the same
• 1:01:38
  rules, follows the same mechanics and such.
• 1:01:41
  So that's what's gotten me interested in having played
• 1:01:44
  through Balders Gate now. And I played a Bard because
• 1:01:46
  that's just what I did. For whatever reason, I'm always
• 1:01:49
  been attracted to the Bard class of like this musician who can do
• 1:01:52
  like magic. So wait a minute, did you then,
• 1:01:55
  as a younger person, did you play Bard's Tale?
• 1:01:57
  I didn't play Bard's Tale. No.
• 1:01:58
  EverQuest is my probably my first real.
• 1:02:01
  I mean, I'm not talking about Nintendo and stuff like that,
• 1:02:03
  but I played a Bard in EverQuest.
• 1:02:04
  I was famous on EverQuest because I could solo things that
• 1:02:08
  you weren't supposed to be able to solo using mechanics that I
• 1:02:11
  guess other people figured out. But I've always been drawn to
• 1:02:13
  that class. So I in Baldur's Gate I created
• 1:02:16
  a Bard and now I'm this. Weird with it.
• 1:02:21
  Thing that can do much different stuff, but it really got me back
• 1:02:24
  and was like, OK, yeah, I really should check this kind of out
• 1:02:26
  again because I I enjoy the storytelling and the
• 1:02:29
  entertainment aspect of it and but I've always been intimidated
• 1:02:34
  of well, I don't know what the heck I'm doing.
• 1:02:36
  I don't know what the rules are. And and again, I think it's a
• 1:02:39
  lot easier not knowing anything as long as you've got somebody
• 1:02:44
  at the table with you who does understand it, it's so much you
• 1:02:48
  can. Where that's identity, also very
• 1:02:52
  well, literally. Identity.
• 1:02:54
  Experience is the best teacher. There we go.
• 1:02:58
  Can we hear it? It's starting.
• 1:03:03
  It's 2 minutes early. That's not a good sign.
• 1:03:06
  If the emergency broadcasting fired early, I feel like someone
• 1:03:09
  twitched. Wait a minute.
• 1:03:11
  Wait. It's true. 5G does turn you into
• 1:03:14
  a zombie hutch. No, there you are.
• 1:03:16
  There's my phone answer. You can see the latency between
• 1:03:18
  different networks. I literally turned mine off.
• 1:03:21
  Well, you're a professional and I'm not, so we'll let that clear
• 1:03:26
  out here. So if you had national emergency
• 1:03:30
  broadcast signal disrupting your conference and podcast, you have
• 1:03:34
  won bingo today. I wonder what's done over at
• 1:03:36
  Octane and how they dealt with it.
• 1:03:38
  I didn't turn my watch on. Well, I think that's a good.
• 1:03:43
  I think that's probably a good spot where we can leave it.
• 1:03:45
  I mean that that's that's tradition.
• 1:03:46
  Can we at least cut it in the ask, Jim, like what's going on
• 1:03:49
  in Octane for the emergency broadcasting?
• 1:03:51
  I'll have to text them and find out if they.
• 1:03:53
  I wonder if they even thought about it.
• 1:03:56
  Maybe, maybe not. I don't know.
• 1:03:58
  OK, why? I would definitely love to talk
• 1:04:00
  more DND, but I said that, hey, let's record like 30 or 40
• 1:04:03
  minutes and it's been over an hour.
• 1:04:05
  So I think it's probably a good spot where we can leave it for
• 1:04:07
  this week. Thank you so much for being part
• 1:04:10
  of this and. Thank you for having me.
• 1:04:11
  This is so cool. Yeah.
• 1:04:13
  I hope you will come back and be part of the conversation.
• 1:04:16
  Okay, how do you think about your guest's Co host spot here?
• 1:04:21
  I am not up for this task. I have learned that Jim does a
• 1:04:24
  very hard job and I. I need either more swings at the
• 1:04:28
  ball or maybe should just be be be demoted to like a junior
• 1:04:33
  podcast somewhere. I thought you were a natural and
• 1:04:36
  I think you did well and we will definitely have both you guys
• 1:04:39
  back on. We'll go ahead and leave it for
• 1:04:41
  this week. We'll have links in our show
• 1:04:43
  notes for Weave identity for ID Pro Connect with Hutch and Ian
• 1:04:47
  both on LinkedIn. Don't forget about Authenticate
• 1:04:50
  conference coming up. It's I think by the time people
• 1:04:52
  hear this I'm going to try to get this out for Friday the what
• 1:04:55
  is tomorrow the 5th or no by the 6th and then we'll be at
• 1:05:00
  authenticate in a couple weeks. They've got a discount code
• 1:05:01
  there. I D AC15 podcasts.
• 1:05:03
  It's getting kind of late in the games.
• 1:05:05
  You probably want to use that your.
• 1:05:06
  Tickets now. Yep, I think you and you're
• 1:05:08
  gonna be at. Authenticate, I will be.
• 1:05:09
  I will be sure you're gonna be authenticate.
• 1:05:11
  I was, but no, I'm not. No, you was or not.
• 1:05:13
  OK, Well, one or two ain't bad. And yeah, so we're going to
• 1:05:16
  leave it for that week for for now, we're on the web, IDAC
• 1:05:19
  podcast.com, Twitter at IDAC Podcast, Mastodon at IDAC
• 1:05:25
  Podcast at infosec dot exchange. Real quick aside, how do you
• 1:05:28
  guys feel about like that naming convention for Mastodon?
• 1:05:31
  I just don't like it. Or you have to like have.
• 1:05:33
  Usernames to observe that you're called it Twitter and not X?
• 1:05:37
  You can. Twitter post Whatever does the
• 1:05:41
  Mastodon thing cumbersome, but it makes sense to nerds.
• 1:05:45
  It does, but it's it's not. I don't feel like it's going to
• 1:05:47
  get mass adoption until it's easy to use.
• 1:05:50
  I'm a little shamed that I. I still haven't figured out how
• 1:05:55
  to use it properly, and then I ended up on a server that nobody
• 1:05:58
  else is. I don't know where to post, but
• 1:06:00
  it's Federated. That's.
• 1:06:01
  The problem I have, I don't know where to post sock shots from
• 1:06:04
  conferences is what I always did and.
• 1:06:07
  Swex feels a little dead to me and I don't know blue sky like I
• 1:06:12
  feels dirty now, so. Yeah, yeah, maybe someday.
• 1:06:15
  Blue Sky, it's very exclusive. I feel like you need to.
• 1:06:17
  Be I do have. I do have Blue Sky, but nobody
• 1:06:20
  else is there. Well, that's because it's invite
• 1:06:22
  only. What?
• 1:06:22
  Happens when you have one fax machine.
• 1:06:24
  You are lonely. All right.
• 1:06:26
  It's devolved into chaos over here.
• 1:06:29
  Thank you so much for the Identity Week America crew.
• 1:06:31
  Molly. Johnny, others that helped kind
• 1:06:33
  of pull this together and brought us in.
• 1:06:35
  So definitely appreciate that. Hopefully we can do more stuff
• 1:06:37
  with them in the future. Yeah.
• 1:06:39
  Thanks for everyone who came up, said hello, got a sticker, all
• 1:06:42
  that good stuff and for support in the show.
• 1:06:44
  So we'll go ahead and leave it. Thanks everybody for listening
• 1:06:47
  and we'll talk with everyone in the next one.
• 1:06:51
  You've been listening to Identity at the Center.
• 1:06:54
  We hope you've enjoyed the show. Make sure to like, rate and
• 1:06:58
  review and we'll be back soon. But in the meantime, hit the
• 1:07:02
  website at identity@thecenter.com and find
• 1:07:06
  us on Twitter at IDAC Podcast. See you next time on identity at
• 1:07:13
  the center.