Latest / Identity at the Center / #274 - Deep IAM Thoughts with John Podboy

Transcript

#274 - Deep IAM Thoughts with John Podboy · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity the
0:23
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff.
0:26
How are you? Oh.
0:26
Not so bad yourself. Not so bad myself looking
0:30
forward to We've been talking a lot about our conference agendas
0:35
for the summer, right Identiverse is a big one.
0:39
And then Authenticate, which I guess is the fall, but we're
0:43
going to San Diego, so it's like it's spring, like year round
0:47
there. It's like perfect weather.
0:49
Actually where I am right now is like perfect weather in Augusta.
0:52
It's going to be Masters week next week when we're recording
0:56
this, and I'm stoked about that, but also stoked about that that
1:00
conference, it's just a a fantastic one.
1:02
Every year we're going to start having discount codes available.
1:07
Soon we'll start announcing that with our our normal line.
1:11
Yeah, I have a placeholder on the website right now.
1:13
So if you go to idacpodcast.com, I added all our codes basically
1:17
right on the homepage. Just Scroll down so you'll see
1:19
codes for Identiverse European Identity and Cloud Conference
1:22
Identity week and a coming soon authenticate.
1:26
And I do love the San Diego area we'll be in Carlsbad.
1:29
Don't have a lot of details right now other than you know
1:33
we're planning to be there. I booked my flight today so
1:36
hopefully I'll I'll be able to use that ticket but San Diego
1:39
weather has gotta be the best on the planet.
1:41
I mean just nothing that matches.
1:42
This weather and I don't know, we're not gonna like, tease what
1:45
we're actually doing. But I will say like what we
1:48
talked about doing today would be like crazy fun.
1:51
So I think that's one thing. You know, we try to be
1:54
educational with the podcast, but we want to have some fun
1:56
too. Yeah, a little about
1:57
edutainment, I think. Yeah, if it if we can pull off
2:02
what we're trying to pull off, I think it'd be an amazingly fun
2:05
and different thing than we normally would do.
2:09
I will give a hint that we've done this in the past, very long
2:13
time ago, but we are looking to do it better now that we have,
2:16
you know, 270 some episodes under our belt and have at least
2:20
a vague inkling of what to do. But that is the Authenticate
2:24
conference. That's October.
2:26
Before that we've got the Identivers conference that's
2:28
coming up. You and I are both gonna be
2:29
there. That's May 28th through the
2:31
31st. It's at the Aria resort in Las
2:33
Vegas. We have a discount code like I
2:35
said on our main page, but if you're listening it's 25% off,
2:39
IDV 2, four dash, IDAC 2/5. I know it's really easy to
2:44
remember, so that's why it's on. Trolls off the.
2:46
Tongue, right. It's gonna be on the main page.
2:48
You know, it'll be easier there. goaheaduniverse.com.
2:51
Use that code. That's how you can show support
2:52
for the show. I think early Bird might still
2:55
be there or not, but it does stack with whatever's available
2:57
right now. Don't be that guy or gal who
3:00
shows up and it's like, oh, I thought I registered, I didn't.
3:02
And then you end up paying like a ridiculous amount of money.
3:04
Or, you know, you're like on the outside looking in through the
3:07
glass. Like, I wish I could be in there
3:09
with all those cool identity people.
3:12
The funny thing with conferences though, I mean especially like
3:15
identiversa, obviously use the discount code, save the money,
3:19
but the biggest expenditure for a conference in Vegas is not
3:23
going to be the conference fee, it's the flight, it's the hotel,
3:26
it's all the the meals. Now I think if you're going as a
3:30
practitioner and you control any kind of destiny within your
3:34
company in terms of what IAM technology, you don't need to be
3:38
buying your dinner straight. Somebody will take care of that
3:42
for you. If you're a real live person,
3:45
come find Jim or I. We'll buy new dinner.
3:50
Make that statement. Yeah, exactly.
3:53
Let's see. A lot of people are hopping on a
3:54
plane. After that's over, they're going
3:56
straight into Europe, into Berlin.
3:57
Specifically for the European Identity and Cloud conference.
4:00
That's June 4th or the 7th. So the Cooper, your coal folks
4:04
have given us a discount for that as well for our loyal
4:07
listeners around the world, EIC 24, IDAC Two, 525% off of that
4:13
registration as well. Again, I'll have it on our
4:15
homepage in our show notes and you should have plenty of places
4:18
to find it. But another way you can support
4:20
the show. And if you're heading out there,
4:21
you know, probably want to register soon because you'll
4:24
want to make sure you take advantage of those codes.
4:26
And then we've got Identity Week.
4:27
Jim, tell us about Identity Week.
4:29
Well, Identity Week America has been one that you've attended in
4:33
the past. I was quite jealous.
4:35
It was actually much better, I think from the description that
4:39
you gave me than I realized it was going to be.
4:42
But I think it you had a fantastic time there, right?
4:45
And I mean, obviously you said this year if you're coming, so
4:50
we're both going to be there. Identity Week America is in
4:53
Washington DC, September 11th and 12th, but they also have two
4:57
other conferences, Identity Week Europe, that's in Amsterdam,
5:01
June 11th and 12th, and Identity Week Asia and Singapore, October
5:06
22nd and 23rd. And this one we got a 30%
5:09
discount code we use for any of the above.
5:12
And that code is IDAC 30. That one actually does roll off
5:16
the tongue. Yeah.
5:18
So if you forget it, it's going to be in the show notes of
5:21
course. And yeah, hopefully for those
5:25
folks who can make it in to the Identity Week America
5:28
conference, make sure to stop by, shake our hands, fist bump,
5:32
whatever you're comfortable with.
5:33
And one of the biggest thrills for me in doing this podcast is
5:38
meeting people at the conferences and you know,
5:40
hearing from them that they enjoy the show, things like
5:43
that. So whether it's in person
5:45
letting us know that you enjoy the show or you reach out via
5:48
social media, either way we really appreciate when we hear
5:51
that. And of course you can five star
5:53
reviews and a full on comment that would even be even better.
5:58
Not that I'm asking for that. Well, you should be asking for
6:00
that, like subscribe all the all the YouTuber stuff, right.
6:03
We're trying to grow the YouTube channel, so trying to put more
6:06
content up there as well. But yeah, that's all stuff
6:09
that's good, even if you're just, you know, a subtle nod
6:12
from across the room like, hey, I know who you are.
6:15
Thanks. Thanks for what you're doing.
6:16
Like that. Even that'll work.
6:17
I'll get a kick out of that. Yeah, exactly.
6:21
All right, so we've got the conference stuff out of the way.
6:23
We're going to have a wide-ranging conversation about
6:26
just a ton of things from any perspective.
6:28
We're very fortunate to be joined by John Podboy.
6:30
He's a senior vice president in cybersecurity for a major bank.
6:33
We won't mention who. I'm sure his opinions are his
6:36
own, all that legal mumbo jumbo stuff, but welcome to the show,
6:39
John. Yeah, thanks for having me.
6:41
I'm really excited to be here. Well, thanks for taking the
6:43
time. I know that right now you're
6:45
under a weather watch of some sort.
6:47
There was like, tornadoes, hurricanes.
6:49
And we kind of said, well, OK, we do want to go forward or not.
6:52
I'm like, yeah, let's do it. It'll be the most if if
6:54
something happens, it'll be the most memorable episode we've
6:56
ever done. Yeah, maybe the last will and
6:59
testament of Jon Podboy. It'd be kind of momentous.
7:02
Well, don't hold us accountable for that.
7:05
We want you to be safe, but sounds like things are blown
7:07
over. We're good to have a
7:09
conversation here. And I think the first time that
7:11
we like to have people on, and you're probably familiar with
7:13
this, is when we have someone on tell us about your identity,
7:16
origin story. How did you get into this space?
7:19
Is identity something that you chose or did it choose you?
7:22
Oh, gosh, great question. You know, I think you talk to
7:26
people, you know, at a cocktail party and people ask you, you
7:29
know, what do you do? And well, how'd you get into
7:32
that? You know, most people will
7:33
assume you, you had a traditional background, right?
7:35
You studied, you know, computer science or you did something and
7:40
then you, you know, went into that field.
7:42
But you know, like most people in this space, they kind of
7:45
found me and, you know, to maybe the surprise to some people, you
7:49
know, very diverse background, you know, much like identity,
7:52
right? Physical people have, you know,
7:54
various backgrounds and educations.
7:57
And you know, interestingly enough, I actually studied
7:59
philosophy, right, and somehow ended up in the identity field.
8:03
They kind of seemed destined to happen, right, the questions of
8:06
who you are and what you should do.
8:08
But, you know, broad level arts background.
8:11
But I've always been into cybersecurity and IT and I have
8:14
to chuckle, you know young John Podvoy back in you know the
8:18
early 90s figuring out how to hook up a dial up modem and
8:22
getting into trouble on the Internet.
8:25
You know, sticking stuff into the CD drive.
8:27
You know exploring, you know what is this thing or the floppy
8:30
Dr. I guess back then. So you know, you know Fast
8:33
forward graduate college. You know during the recession.
8:37
Yeah really interesting time to get into feel.
8:40
But moved back to Northern Virginia where I grew up and got
8:44
into the government world. You know got really fortunate to
8:48
to get a job as a contractor for the Drug Enforcement
8:50
Administration as a systems engineer.
8:53
So we were the team that you know figured out how to build
8:56
anything that you know the agency needed.
8:59
And you know really cool environment is you have to work
9:01
on a little bit of everything IT and cybersecurity and you know
9:05
one of those things was identity and kind of bit me and from
9:08
there you know haven't really left since.
9:11
So we were talking about before hit record, what we're gonna
9:13
call this show. And I think I just came up with
9:14
a name, The thinking man's I Am with Jon Podboy.
9:18
So here's my question. As a philosopher, and this is a
9:21
question I always ask what is I am?
9:24
Oh man, I I feel like we need a drink for that conversation.
9:28
You know, I tend not to over overthink it, right.
9:32
You know at the end of the day as a security leader, you know
9:35
it's our job to highlight things we need to do to protect and
9:39
enable the business, right. And you think of identity, you
9:43
know traditionally that's been focused on people.
9:45
Yeah. And you know that's obviously
9:46
evolved over the years and continues to grow into you know,
9:50
non human identity. You know, ultimately it's the
9:53
things that we need to enable with controls, you know, whether
9:58
that's authentication, authorization, whether that be
10:01
EPI controls, you know, in this digital economy.
10:04
And you know that kind of is evolved over the years from the
10:09
castle and mode analogy to you know, just you know, build out
10:12
workstation or server controls or network controls to you know
10:16
really where we're at now where identity is evolving and taking
10:20
on a greater role in the cyber world to protect any
10:24
organizations in that kind of that corporate security mindset.
10:28
But then also taking on a completely different role for
10:30
kind of end consumers, right? Yeah, what can we do to drive
10:34
consumer trust and enable that? And so it's a pretty exciting
10:37
field at the end. You know, one of the reasons
10:39
I've stayed in it for so long, even though I've done a variety
10:42
of other things, is the opportunity to influence and
10:45
impact organizations. Is is so unique.
10:48
Yeah, John, something that you mentioned there triggered me to
10:51
think about Adm that I received from a person named Nathaniel.
10:56
I'm not going to say his last name because they didn't get his
10:59
permission to kind of read this on the air, but he did say thank
11:03
you. I started listening to your
11:04
podcast. I'm looking to land a role as an
11:07
IAM analyst and your podcast mentions how rare it is for
11:12
people to go straight into IAM. I'm looking to do that.
11:15
So what I replied was I say don't let anyone stop you from
11:20
pursuing your dream. In the podcast we speak from our
11:23
experience and usually talk about what we see the most, but
11:27
there are no set in stone rules for getting into this, this fun
11:31
industry. Best of luck and thanks for
11:33
listening. And I I'd say that, you know,
11:37
when we have folks like yourself who are in the same ballpark
11:41
range of ages, Jeff and I. In other words, you were around
11:45
when Pearl Jam 10 came out and you listened to it and it was
11:48
like new music and you still probably listen to.
11:51
Rocks. Let's just be clear here.
11:53
It still rocks. That's awesome.
11:54
It still rock. Absolutely.
11:56
But what I would say is like there was no IM industry really
11:59
at that point or it was so it was so niche that no one was
12:04
really starting their career in that and probably spent their
12:06
whole career in there. So, but now I think if you're
12:09
coming out with a cybersecurity degree, it's a very viable
12:13
option, maybe not even a cybersecurity degree, but I
12:16
think, you know, it's that diverse background is what you
12:19
said, like you're kind of a liberal arts guy.
12:21
My original degree was in political science, so who would
12:25
have known? But I it's, it's funny, you
12:28
know, and Jeff will probably say the same thing, which is that
12:32
politics is such a part of being successful in this world of
12:36
identity. You have to have a little bit of
12:38
tech. You have to have a little bit of
12:40
business. But man, if you can't understand
12:43
politics and, you know, make friends or what do you say,
12:47
Jeff, kiss babies and shake hands, something like that.
12:50
You can't do those things like you don't want to do the.
12:51
Opposite you don't shake babies and kiss hands.
12:55
There you go. That's that would be a very bad
12:57
idea. But you know, John, we, so we
13:01
have this podcast called Identity at the Center.
13:04
And you know, you and I, we've only met a couple of months ago
13:08
now and I never asked you this question, but why do you like
13:12
that name identity at the center?
13:13
What does that mean to you? You know, I I think it means a
13:17
lot of things right in, you know, identity really evolving
13:21
to such a forefront of digital enablement, whether that's
13:25
security, whether it's driving revenue, you know, it can meet a
13:28
variety of things. You know, maybe the simple
13:31
answer, you know, we have to put people first, right?
13:33
You know, people are complicated.
13:35
We have diverse backgrounds, right, Physical conditions,
13:40
right. You know, in society we have or
13:43
hopefully have, you know, the ability to accommodate people
13:46
and the diversity of people, right.
13:48
We're not analog. You know, in the digital world
13:50
we tend to think of things as very analogue, but they're, you
13:54
know, we probably shouldn't be, right?
13:56
We have to have really, you know, adaptive security controls
14:00
and experiences. So you think about identity at
14:02
the center, it's, you know, keeping people's, you know, in
14:06
mind being, you know, we're here to protect them, you're here to
14:10
enable them. And we're also here to enable
14:12
things workstation servers write data, but thinking differently
14:16
and you know if you kind of look at the different methodologies
14:19
out there, I kind of equated to design thinking if people have
14:24
heard of that. If you haven't, go Google it
14:25
right. But design thinking and I, you
14:28
know the skills that make you successful in identity are
14:30
really similar, right? You have to understand people,
14:33
things, devices, network connections, you know how things
14:38
are architected and how they fit together.
14:40
So you know how to influence and you talked about, you know,
14:43
whether it be political or maybe to use a different word, you
14:46
know, using influence, right. You know, no one necessarily
14:50
wants to invest in identity because it's not, you know, the
14:53
most easy thing to understand or say like hey this this matters.
14:57
It's one of the things that you know, I think has been really
14:59
important is, you know, to be successful in identity, yes, you
15:03
have to have deep technical knowledge of your hands on
15:05
keyboard. You have to be technically aware
15:07
of leadership roles, but I think even more importantly is you
15:11
have to be willing to drive transformation.
15:14
And that's beyond anything that is within your direct control,
15:17
no matter what organization you work for, right?
15:19
Because ultimately we're here to orchestrate from the phone you
15:23
have in your hand to the workstation to the server, to
15:26
the application, to architectural standards, to user
15:29
behavior, to politics or things, right?
15:32
That's a lot, right? And you know, obviously other
15:35
types of disciplines have a lot to influence, you know, but you
15:39
know in this space it's very broad and very deep.
15:41
So kind of being committed to, you know, diving in, learning
15:45
that technology I think is really important, but you know,
15:48
building those soft skills to drive organizational behavior.
15:52
I love that answer. I think you and I have a very
15:54
similar mindset of treating identity as a product for
15:58
whatever organization you happen to be serving, right?
16:00
Whether it's enterprise identity or customer identity, or
16:04
somewhere in the middle, right? Whatever that looks like.
16:06
So this idea of treating identity as a product, are you
16:08
putting out a good product for your users?
16:11
Yes or no, right. Would you use it?
16:14
Are other people looking to find ways around it?
16:16
Because they feel like if you are able to take that design
16:19
thinking and say yeah let's design this with humans mind
16:22
because humans are going to use it.
16:23
I think you're going to be a lot more successful in you know not
16:26
only the adoption but just the efficacy of the different
16:29
solutions you put in whether it's technical solution could be
16:32
a policy procedure, whatever it may be.
16:34
But I love that idea of designing identity around
16:37
humans. So you're definitely showing off
16:39
your your philosophical side around this because I'm with you
16:42
on it. I want to ask you about identity
16:45
data because I think that's something that sometimes that
16:46
gets lost in all this stuff. Hey we just put in an IDP and we
16:51
can do single sign on an MFA and we put in IGA and we can do
16:55
automated on boarding and off boarding and privilege access
16:58
management. We're vaulting and session
17:00
management. That's cool.
17:02
What about the data that you're collecting?
17:04
What does identity data mean to you?
17:06
You know, it's a great question. I can't help but chuckle a
17:09
little bit. If I pose that question at, you
17:12
know, any of the players I've worked at, right, people would
17:14
probably look at me like I'm crazy, like I have no idea what
17:17
you're talking about. Right.
17:19
You, you go talk to like a chief data office or folks that would
17:22
work in IT, they would understand that question
17:24
immediately. But then they'd be like, why you
17:26
even asking, right. So we tend to think about data
17:29
And you know a lot of organizations have data offices
17:31
that have tools techniques for moving data and transactions and
17:36
the security privacy implications.
17:38
But no one thinks about that in terms of the identity context.
17:41
And you know, ultimately I think I go back to that design
17:44
thinking mentality of like well you know, in a good architecture
17:49
or at least in my opinion, right.
17:50
Identity, should it be at the top of the pyramid, right.
17:52
D char or something authoritative for, you know, the
17:55
physical person or life cycle controls, applications really
17:59
should feed into those identity systems.
18:02
And you know you have attributes and things about people or
18:05
devices. But ultimately then it's going
18:07
to understand zooming out in that architectural view, who's
18:10
consuming it applications are. And you know, I think the piece
18:13
that people don't necessarily understand is a lot of
18:16
applications don't just hook into identity and reference it.
18:19
They hook into identity and then copy it locally because they
18:22
need to store it for whatever way that application is
18:26
architected. And when you ask me about what
18:27
do I think about identity data in my mind can't help go into
18:31
the importance of understanding that architectural diagram.
18:35
You know, I verbally talked about and the importance of
18:38
managing that data because you change setting an AD around,
18:43
hey, I'm going to make this field mandatory, capitalize when
18:46
it was free tax before. You may break every app and you
18:49
know in your organization so you know it's it's thinking
18:53
differently about it. And you know, I think maybe more
18:55
interesting is, well, what does the future of identity look like
18:59
when you start talking about privacy regulations?
19:02
You know, this question of what data do you have about people,
19:05
what are they doing is going to get really interesting.
19:07
And obviously in Europe, right, there's been a lot around
19:11
controlling or limiting, you know, tracking of employees or
19:14
customers you have in the US, right.
19:16
We're kind of really at the early stages of those privacy
19:18
conversations. So you think for practitioners,
19:22
right, it's understanding what is your current state and you
19:24
know, potentially what could evolve over time, I don't know.
19:26
What do you guys think? Yeah.
19:28
Jim, I know that you are interested in this as well or
19:31
this concept of identity data. Like, what do you what does it
19:33
mean to you? I don't think there's one answer
19:37
to this question I but I do think John kind of pointed to
19:40
the right point. So I think of identity in the
19:43
realm of attributes about a person.
19:46
The attributes aren't like flat, just lists of texts.
19:50
They could be things like relationships potentially.
19:53
It really depends on the organization.
19:55
I think when you're talking about like managing identity
19:58
within an enterprise, it's usually the data that you can
20:01
get from the HR system. It's maybe some data points that
20:06
are coming from other systems. But when you look at like ACIM
20:09
environment, now think about this, think about, OK, Jeff
20:13
Steadman is the identity that we're interested in.
20:15
His relationships are this is his spouse, these are his
20:19
brothers. Things like that.
20:20
Is that identity data is data about them.
20:23
Identity data. For you, what about what
20:26
websites you've gone to within that realm?
20:28
What about what orders you've placed?
20:31
Where do you draw the line? And then you start saying, well,
20:33
no, maybe orders. That's not identity data, but
20:38
certainly the person's name is. Well, now what if you have seven
20:41
different websites and you allow people to define their name?
20:44
Or a better example would be addresses.
20:47
So in one system you have an address that's like here's my
20:51
shipping address and here on another system here's my
20:54
shipping address and etcetera, etcetera.
20:56
So now as an organization you will say, no, we're not going to
20:59
now let you set your shipping address in those seven websites.
21:03
You have to come back to some central profile system to set
21:06
your delivery address that it really depends on what the
21:09
organization is trying to achieve.
21:11
So I'm not even going to try and solve that answer.
21:13
But what I'm saying is like there are very few attributes
21:16
about a person where it's clearly yes, this is identity
21:20
data that should be managed in the center and should not be
21:24
managed in applications. It's really depends on what
21:27
makes sense for your organization.
21:28
Yeah, that's if I were to jump in there.
21:30
You know, I think you tease on something I'm really passionate
21:32
about is, yeah, you think about what is identity, right?
21:35
Obviously the centralized tools, directories or SSO clearly sit
21:39
with the teams that run them. But I think there's that broader
21:42
definition and responsibility of you know how is your corporate
21:47
phone managed or the consumer's phone or their laptop.
21:51
Well, there was all that local data that sits in there about
21:54
who you are, your behavior that usually an identity may not run,
21:59
but if you think about identity as a perimeter, new perimeter,
22:02
you know identity at the center or identity centric security, we
22:05
have to orchestrate that and no one else is going to do unless
22:07
we do it right. So like that mesh concept of I
22:11
think previous speakers have talked about you know that
22:13
graph, you know what who you are in these different systems, your
22:17
behavior to really build out those analytics I think is
22:19
really the forefront of where security is going to go.
22:22
Not only for you know corporations to drive security
22:25
maturity, but you think about if you draw a comparison right,
22:29
some of the largest companies in the world don't really sell a
22:32
lot of products. We give them our data and you
22:35
know they're multi billion dollars because they're really
22:37
good about understanding that broader context of who you are,
22:41
what you're doing, where you're doing it to build analytics.
22:45
Yeah, but we don't tend to think about identity and security in
22:48
the same way, right. We, I think we have to shift our
22:50
mindset of you know, not that I'm going to advocate for
22:53
browser cookies and the enterprise for tracking, but you
22:57
know this problem has been solved at scale globally in
23:00
different markets like marketing.
23:01
You know how do we think about that differently in you know the
23:04
enterprise Oregon consumer space to really drive that mesh
23:09
architecture. Well, I think you open up a
23:11
little bit of a Pandora's box here, because now we're talking
23:13
about data and is it identity data or just data?
23:17
And then who owns it? Who's responsible for it?
23:20
Where do we see responsibilities live for the data collection?
23:24
And if it's identity data, does it belong to the identity team?
23:27
And then how do you make that available to others who might
23:29
use it? Should you make it available to
23:31
others? If you're somehow collecting non
23:34
identity data because a marketing team says, hey, we'd
23:37
like you to collect e-mail addresses for people, you don't
23:40
maybe need it for your system. Maybe e-mail address is a bad
23:42
example because everybody logs in with an e-mail address, but
23:44
go with me after this one, right?
23:45
You may be collecting bits of data on behalf of another group,
23:50
so who owns that data? Who's responsible for that data?
23:53
Have you come across this in your experience like that?
23:55
Ownership struggle? Or maybe it's not a struggle,
23:58
Maybe it's clearly defined upfront.
24:00
Yeah, that's a good question. And you know, my experience,
24:02
it's not even really a conversation, right.
24:04
People, I think, think about the problem so differently.
24:07
It doesn't even cross their minds.
24:09
And I think part of what will drive the change in the
24:12
conversation, understanding the problem of that identity data
24:15
is, you know, more regulatory pressure around security or
24:19
privacy. And you know who's really
24:21
supposed to drive that? You know, regardless of
24:23
ownership, You know, like most things and identity, you know,
24:27
you kind of sit in between multiple lines of ownership,
24:30
direct and indirect and. Right.
24:32
If you have X amount of employees, right, you've got X
24:36
amount of people telling you, you know what they think and
24:38
feel, you know that's important thing to remember in terms of
24:43
how do we engage with people. We have to be hyper
24:45
collaborative and focus on the problems that business needs to
24:49
solve. So you know we're always keeping
24:51
it at a step above versus you know having that direct
24:54
ownership is important. What about indicators of
24:56
compromise? Do you see that as an area where
24:59
we can use these bits of identity that we're collecting
25:02
to say, hey, we're noticing things, How successful do you
25:06
generally see identity data contributing to an indicator of
25:11
compromise? And I think we're all familiar
25:13
with something like, oh, there's a bad login attempt or too many
25:17
bad passwords entered, right? Sprite passwords, Bray text,
25:19
things like that. But do you have ideas of how
25:22
maybe we can leverage identity data to help with that?
25:25
Oh gosh, yeah. I think that's gonna be really
25:26
interesting. And you think about, you know,
25:28
the analysis people put out there about the identity market
25:32
as a business, right? People say it's 60 billion a
25:35
year or 80 billion. You know, people throw out on
25:37
these big numbers. You know, at the end of the day,
25:40
all that tells me is there's big problems for companies that have
25:43
to solve and you know, there's foundational stuff you either
25:47
should have been doing or you need to do, you know, SSO and
25:49
MFA, easy examples. But then there's more advanced
25:53
like how do you start connecting things together.
25:56
And you know, people use that analogy of security controls are
26:00
shifting less. And I'm not big on buzzwords.
26:02
I don't, I don't particularly like them.
26:04
You know, I think most people don't really know what they're
26:06
saying or other people don't hear what they intend to say.
26:08
But I think the, the point, you know, when people say that is
26:13
architectures, corporations are changing, right.
26:15
You're going to more SAS solutions, cloud solutions,
26:18
environments, environments are getting more complicated at the
26:21
end of the day, right? We have to move security
26:23
controls to, you know, earlier or you know to use the analogy,
26:27
shift left. And the way I think we have to
26:30
do that is connecting all those things together.
26:34
You know, to use a simple example, right?
26:35
You you may have Intune, you know in your environment, right?
26:40
That has its own identity that may be separate from how you log
26:42
in say with a Ping or an Octa or Cyber Ark whatever the vendor
26:47
may be. I think you know how do you
26:49
connect those things together that may not natively connect.
26:52
That is I think where the innovation will be and you see a
26:55
lot of companies filling that gap of how do you connect those
26:58
entirely new product categories. And so you know I guess maybe
27:02
I'll conclude it right. I think a lot of the legacy, you
27:05
know, things around identity, they're not going away, but
27:09
they're really becoming commodity services and companies
27:11
that are focusing on indicators of compromise and the ability to
27:15
see, you know, where you have permissions, where can attackers
27:20
get into the environment. That is where I think there are
27:22
a lot of the value it's going to be going forward of simplifying
27:26
this complexity of the IT environment.
27:28
Hey, John, I totally agree with you on what you're saying with
27:31
like using buzz terms like shift left.
27:33
In fact when people use this kind of terms, I have zero trust
27:37
for them. So I just wanted to get that out
27:39
there. So John, obviously you're going
27:42
to speak from your experience, right?
27:44
You're not answering this for the world in general, but your
27:48
perspective. When you talk about identity to
27:50
the business, or when you hear what the business thinks of
27:53
identity, they have any concept of what it really is.
27:57
Or is this just about changing passwords, You know, still like
28:01
people living in that Stone Age? You know.
28:04
I think a lot of people struggle and I think that it has to
28:08
change over the time, right? But rewind 10 years ago, people
28:11
were having the same conversation about anything in
28:13
cybersecurity. You're like, why are we talking
28:15
about this, right? And I think it's one helping
28:18
people understand what are we trying to solve, what do we need
28:22
to solve to protect an organization, to meet regulatory
28:25
or privacy requirements. And I think one of the things
28:28
that is a challenge, identity is like a super set in cyber, maybe
28:33
one of the largest, right? And we have tend to use our own
28:36
language. Well, you know, it's my
28:39
experience, yeah, that doesn't always help us, right.
28:41
Because you know, even within cyber IT people are like, we
28:45
have no idea what you're talking about, right, Because we're
28:47
using our own language. They don't hear what they want
28:49
to hear or need to hear. So kind of going back to that
28:52
communication and you know, I think it's really important to
28:54
ground yourself. You know, if you work in an
28:57
enterprise environment, most likely you're not working for an
29:00
identity company where you're, that's how you make your money,
29:03
right. It's, it's other things.
29:05
And I'm not belittling the criticality of identity at all.
29:08
I actually think the opposite. You know, we can and should
29:12
drive revenue, but it's not the direct thing that drives
29:15
revenue. And understanding that in
29:18
aligning to organizational priorities is important and
29:22
balancing that with risk, right. You know, just because we want
29:25
to do something to drive revenue doesn't mean we should also do
29:28
something because it's you know, risk driven.
29:30
But boiling it down to more simple terms and language, you
29:33
know, I think it's really important and you know, I think
29:36
things have evolved and will continue to evolve right where
29:39
people are in tune with you know, vulnerability management
29:41
or patching or the importance of you know, security awareness,
29:46
right. People understand why we have to
29:48
invest in those things. You know, I think just
29:50
continuing to focus on the business or the customer, if
29:53
you're a customer identity, you know what we need to do to
29:56
enable them is is a good way for us to drive the industry
30:00
forward. Yeah.
30:01
And I think in in the banking industry you certainly have been
30:06
driven a lot by regulation and the need to drive security in on
30:12
the customer side, prevent fraud for sure.
30:16
So there's like all the security benefit is obvious, but I'm
30:19
wondering you know the do you feel like the business
30:22
understands or thinks of Identity as an enabler like we
30:25
can use identity to improve our our grow our business?
30:30
Yeah, That's a good question. I think it depends on how you
30:32
position it, right. It could be that that carrot or
30:36
it could be a stick, right. You know, sometimes obviously
30:40
that we have to do things because it's things you have to
30:43
do for security or regulatory requirements.
30:45
But going about it in terms of like beating the business over
30:48
the head, well, people usually remember that hurts, right.
30:51
And you know, it may be required sometimes, but it has a lasting
30:55
negative impact. And you know, I'll, I'll be a
30:58
little bit more real, right. I think, you know, say in the
31:00
customer identity space, yeah, it, it can be something that's
31:04
critical, but we have to position it the right way.
31:07
Right. And let's maybe use an example,
31:09
right. And I'm making up an example
31:11
like if I went to a website and it was painful for me to log in,
31:14
to sign up just to get in, I might not, you know, continue.
31:18
Well, that's the easy one, right.
31:20
Well, what about if I, you know, say go to, you know, a car
31:25
dealership's website and they've got some type of buying program.
31:29
Well, they need to sign you up for identity, they need to, do
31:32
you know, KYC and KYC really is identity proofing.
31:36
You know, for the most case they have to do background checks,
31:39
identity proofing. Well, what if they said I need
31:42
to mail in a paper form, right? No, thank you.
31:46
Right. You know, these are simple and
31:48
easy kind of dramatic examples, but they're very real, right.
31:51
A lot of our, you know, digital products, softwares were built
31:56
in the 90s and 2000 and took static human processes and put
31:59
them into the digital world. I think what you're seeing now
32:02
is identity continuing to accelerate where yeah, we really
32:05
can know who the person is really quickly with a high
32:08
degree of accuracy that is tied back to financial things, right.
32:12
And if we start talking about it in that way, right, one and you
32:15
can talk about customer retention or onboarding or you
32:19
know sales cycle that has direct revenue ties, You know that that
32:23
is an opportunity for us to really drive and think about
32:26
identity, to drive the security aspect, but also the revenue
32:30
side as well. I'll give you a real world
32:32
example that just happened to me this past weekend.
32:34
I had dinner reservations set up.
32:36
Actually, just lunch reservations, taking my aunt out
32:39
for her birthday and it's like, OK great.
32:42
I get a call saying, hey, we cannot process credit cards,
32:47
we're only accepting cash and personal checks to pay your bill
32:52
and Nope, not happening. I went and found someplace else
32:56
they made they made it. Too much friction for me to go
33:00
to their place of establishment and spend a lot of money you
33:03
know on on a nice lunch and dinner.
33:05
So I am absolutely in that use case of like you're gonna send
33:08
you're gonna have me do what Like that Friction is such an
33:11
important point that I think people really need to think
33:13
about. You know, I I have not written a
33:16
check for a a meal in probably 25 years or ever like that's
33:22
that was the response. Like really OK we'll try your
33:25
place another time we'll go someplace else.
33:26
So I I just want to echo that part.
33:28
Yeah. One of the, yeah, one of the
33:29
things I think is interesting is you talk about you know this
33:32
notion of like a pre customer if you're you know, digital
33:35
business, right. You can log someone in maybe,
33:39
but they're not signed up for a product or service that you
33:41
offer. Well, is, is it the identity
33:44
team's job to drive that or maybe is it marketing?
33:47
I think that's an interesting question because you know if
33:50
maybe my spouse is a customer of that site and you know, maybe
33:54
I'm considering signing up for something obviously BM abstract
33:57
here. But my point being is like we
33:58
talked about, you know, in human life, we all have connections
34:02
that, hey, I learned about this awesome podcast, Can I, can I
34:05
come speak And you guys were like, yeah, this is great,
34:07
right? Our, our connections kind of
34:09
brought us together, right. How do we do that in the digital
34:12
world where we're correlating this data and you know that
34:15
broader notion of identity and who we're connected to that's
34:19
you know, very a lot of very clear and a lot of revenue
34:22
potential to think about digital modernization in in a real way.
34:26
So you know, I think we're not necessarily talking a lot about
34:29
that as identity practitioners or security because we're
34:32
focused I think more on the security side in a lot of cases.
34:36
But I think we should talk more about, you know, what does it
34:39
mean to drive connectedness digitally and you know, what
34:43
does that do for the business? Yeah, that's a great point,
34:46
Jeff. I loved your story.
34:48
It reminded me of the Seinfeld episode.
34:50
You know how to take the reservation.
34:52
You just don't know how to hold the reservation, and that's
34:56
really the important part of the reservation, the holding of the
34:59
reservation. Anytime we can get a Seinfeld,
35:02
you know, reference into a show, I consider it a win.
35:04
We should probably just stop right now, but let's keep going.
35:06
We should probably stop right now.
35:08
It's also a high note, Jim. There you go.
35:10
There's another one for. You, you throw a cream of
35:12
reference in and you know I'll give you guys a high 5.
35:15
We'll see if we can work one in by the time the show's over.
35:17
Perfect. So John, I mean, one of the
35:20
things that you're tasked with, right, you have to sell identity
35:24
investments to the business, whether it's for security
35:28
purposes or for enabling some business growth opportunity.
35:33
So what is the angle that you take?
35:36
Is it you try to speak the language of the business?
35:39
What are some of the tips that you'd throw out there for the
35:42
listener? Yeah, I go back to understanding
35:46
what's going on in the business. You know IT.
35:48
Are you an IT team? Cause a lot of identity teams
35:50
sit within IT and have security. You know what's going on.
35:53
You know, what are your leaders talking about and what are their
35:57
leaders talking about? And I'm a little weird, I I like
36:01
to read SEC and business statements, 'cause I think you
36:05
know, it offers an interesting perspective on companies, right.
36:08
So if you're a publicly listed company, read that stuff and I
36:12
don't know, maybe you're probably more educated than I
36:14
will be, but I don't understand a lot of it.
36:16
But you do pick up on you know where things are going, you know
36:20
what's what is driving revenue, where things are focused, what
36:24
are they concerned about. And you know may that may not
36:27
help you directly, but understanding that broader
36:30
organization I think is important, right.
36:32
So what are the organizational efforts, how does this tie in
36:35
And you know if you're lucky enough, right identity is a
36:39
organizational priority. That may or may not always be
36:42
the case for everyone, but you know, tying back into why it's
36:46
critical for what we do, you know, what are we driving?
36:49
You know, if you're in Europe, obviously there are a lot of
36:53
laws and regulations where identity is very clearly tied.
36:56
And you know, you don't have a choice.
36:58
You know, in the United States it's maybe a little bit more
37:00
abstract. But you know, at the end of the
37:02
day, you know, whether it's protecting money or protecting
37:05
data or protecting just customers, right?
37:07
It's understanding like how does it boil down because you know,
37:11
at the end of the day, right, for the layperson, you know, I
37:13
don't care about us. So like, why does it matter,
37:16
right? But it's it's about what does it
37:18
get us and why does that matter for people in for, you know,
37:21
people consuming the services. So you've been in this space for
37:25
a while and I'm curious what you think has been, what's the most
37:30
important change that you've seen in the identity industry in
37:34
your career in IT? Oh.
37:36
I think there's probably 2 and I think one was the broader
37:40
recognition of the criticality of security and identity right.
37:45
You see a lot flip flop of identity teams being within you
37:49
know maybe a non security to people using you know buzzwords
37:55
of identity security or you know shift shifting identities in new
37:59
perimeter. You know it's been my experience
38:01
if you actually ask people well can you tell me what that
38:03
actually means people are like what right.
38:07
But I think what's happening now is you know whether it's the the
38:11
big identity providers or the traditional security providers
38:14
starting to offer identity technologies, is people really
38:18
understanding you know the role of all these tools connected
38:22
together and what can they do to protect people.
38:25
So I think we're on the cusp of the next evolution of this
38:28
becoming real, right, whether that be password lists,
38:32
technologies being real to identity, actually providing new
38:38
insights around behaviors and indicators of compromise or
38:43
attack, You know, continuing to drive that I think is really
38:46
critical. I think customer identity is
38:49
similarly on a different journey, right, because it has
38:52
different focus, yes, security, but also a lot of user
38:54
enablement, revenue generation. And you know, I think that
38:57
journey is just beginning where you know has a lot of potential
39:01
to go in many different directions around doing that
39:03
correlation we've been talking about.
39:05
So I'm particularly excited by that because you know, it'd be
39:09
really fun to see Identity actually having ability to drive
39:13
revenue and insights in a totally different way.
39:15
You know, kind of going back to that analogy of, you know,
39:18
cookies and Google and all these companies making money off
39:21
tracking behavior, right, You know, and thinking about it in a
39:23
different manner. Do you think we've I I feel like
39:27
we have and I'm just wanna curious your thoughts you feel
39:29
like we've moved past the phase of you know you contribute
39:32
nothing to society is whereas identity is not really well
39:37
understood and now it is I. Don't know if we've moved past
39:40
it. I think we're still early in
39:42
that journey and you know ultimately understanding the
39:47
role we play, right. Like I mentioned, I don't think
39:49
any of us or most of us are going to work for organizations
39:52
where we are the ones driving revenue.
39:54
And I think it's really important for security
39:56
practitioners, anyone in technology to understand how do
40:00
how do we drive revenue and why it's critical.
40:02
And I'm not minimizing the role of technology or security or
40:05
identity at all, right, But it's understanding everyone has
40:09
different focuses and organization.
40:10
They're all equally valid and. The role we can play and you
40:14
know why that matters because that builds that influence, that
40:17
credibility versus US kind of bringing that stake of thou
40:20
shalt do this really hard thing called identity and it's
40:23
probably going to take five years and you're not going to
40:26
really see anything until five years, right.
40:27
We have to think differently about it of showing incremental
40:30
progress, value and impact and continuing to move on in terms
40:33
of where we need to be in the future.
40:35
So, Jeff, was that a cream of reference?
40:37
Darn Tooting it was, yelled it out at Newman.
40:40
Right over my head. It.
40:41
Was for the wind, for the. Wind the trifecta.
40:43
We're good. Awesome.
40:45
Good. We're good.
40:46
OK. John, So the Creamer sliding
40:49
into the apartment. Kind of reference here.
40:53
The Cohibas smoking a Cohiba. So John, as far as kind of what
41:00
do you see as kind of the big future innovations for IM and
41:05
specific to the banking industry, I was gonna throw one
41:07
out there and then feel free to come up with your own.
41:10
But 502 pass keys password list, I mean I think it's kind of just
41:16
taking you know commerce by storm in terms of you know
41:20
that's that's the future. It's not just MFA because that's
41:24
just the builds A builds friction in getting in right.
41:29
Even though like as far as what it does for security it's like a
41:32
huge step up. So I'm not dissing MFA, but I
41:36
kind of feel like Fighter Two is and Pesky's is really where
41:41
things are heading. I'm wondering what you think of
41:43
that for banking. Is there something else on your
41:45
mind? You know, it's a great question
41:46
and you know, I'd echo right. Yeah, I haven't seen a long time
41:50
the way we talked about MFA has to move on and it's good to see
41:53
almost everyone's already recognized that now and you can
41:55
use different terms, right. I think we all kind of alluding
41:57
to the same thing, you know, adaptive MFA, contextual MFA,
42:01
you know it's all about do we really trust that's you right.
42:04
And how do we prove that in a, you know, a way that we know for
42:08
certain it is. But you know I think if you talk
42:10
about the banking industry more broadly, you know I imagine a
42:14
lot of people have different opinions about banks right now.
42:17
I got to go into a bank or it's painful, you know, but they play
42:20
important role in a society. And you know, I can't help but
42:23
get excited. If you kind of look at the news,
42:25
what's happening in the Europe right now with Europe passing on
42:30
a digital identity or it seems like I think they passed it.
42:33
I don't know, Jeff, I think you're maybe heading out in
42:35
here, but the digital wallet, European digital wallet, right.
42:39
The European countries have, you know, wanted to pass this.
42:43
And you can't talk about digital wallets without identity, right,
42:46
because you have to be able to prove it's really you in a
42:48
really secure way to get access to that.
42:50
But you know, I think financial services as a whole is shifting
42:53
from really static capabilities that were probably built for
42:58
when you went into a physical place.
43:00
You know, a lot of those controls, whether they're fraud
43:03
risks, security, you know, were transported into a digital world
43:07
but never really designed for the digital world.
43:09
So I think, you know, we're about to see a massive shift.
43:12
And you know, I think Evident alone is look at all the fintech
43:15
companies that are out there that are soon started.
43:18
You know, the opportunity to do innovation is massive.
43:22
And you know, that I think is really neat because it's going
43:24
to change not only the technology but more important,
43:28
you know, the impact for society.
43:30
And you kind of really get into this broader notion of identity,
43:32
right? You people talk about
43:34
decentralized identity, I think for a long time.
43:37
And I'm like, yeah, it makes sense.
43:38
But show me something real, like, you know, has anyone
43:41
really using this? And you're starting to see real
43:43
examples now emerge where you know, people that are immigrants
43:46
that have no documentation, like how do you integrate them into
43:49
societies, whether it's Europe, the United States, You know, how
43:53
do you connect them to service loans?
43:56
Right. You know, a large portion of
43:57
this country doesn't have access to Internet, right?
44:00
Like the majority of government services are offered through the
44:03
Internet. That's a pretty important
44:05
problem for society to solve. And it's really all around
44:08
identity and how do you connect people?
44:10
So I'm, I'm really bullish. I think there's a lot of amazing
44:14
opportunity going forward for decades.
44:17
And I think the problems that you know, we have to solve today
44:20
or in the past, you know, we'll evolve, right.
44:23
And we're going to have these new problems around the data and
44:25
citizen enablement and e-commerce.
44:28
And I think that's really exciting.
44:30
And I think you know Jim, right, you're going back to, you got to
44:33
build broad skill sets and identity, right.
44:36
It's not just technical, and that's really pretty important.
44:38
Yeah, you know, I'm just going to throw this out there.
44:41
We are coming close on time and I want to be respectful of your
44:46
time. So more of a rapid fire and I'm
44:48
going to bring up something that I don't know a whole lot about.
44:51
But I understand these things are kind of quote UN quote game
44:55
changers. So financial grade APIs and open
44:58
banking to areas where I'm not an expert, but I'd love to hear
45:02
your thoughts. You know, I I don't know if I
45:05
would say I'm an expert either. You know, I have had
45:07
conversations. I can understand the use cases,
45:11
you know, but I think that will continue to evolve and you know,
45:14
questions I would have as I look into that is what problems are
45:17
we trying to solve more broadly? And you know, personally, I
45:20
definitely am interested in learning more.
45:22
So I want to ask what your thoughts on a couple of items
45:25
here. Just real quickly.
45:27
AI is everywhere, it seems like. I have to imagine that you're
45:30
seeing it as well as part of some of the stuff that you work
45:33
on. Where do you see AI really
45:36
impacting identity for you? You know right now it's not I
45:39
think something that we're seeing direct impact yet.
45:42
I think the potential is there and you know I I try to have a
45:46
level head about these things, It absolutely will be a game
45:49
changer for society, for companies, no doubt you know,
45:53
but if you zoom back, a lot of companies are doing things that
45:57
we said were bleeding edge 1520 years ago, right.
46:01
You go look at the Magic Quadrant or whatever, you know,
46:05
maturity, scale, right, of where people are going to invest their
46:07
time and money. You know, everyone said when the
46:09
iPhone came out, oh, we're going to, you know, you know, build
46:13
mobile apps. And yeah, companies kind of did
46:15
it, but not really right. And companies are still
46:17
investing in those things 1015 years later.
46:19
So I think practically I think it's going to take time, but
46:22
maybe not as long. You know, where I think I think
46:25
is really exciting is the ability to have a technology
46:30
that can integrate into that data set of identity.
46:33
Hey, does this person really need access or did they just say
46:36
right, are they using it? Give me the ability to know
46:39
that, right. Having really intelligent versus
46:42
static controls, you know those are easy examples where it's
46:45
going to have huge influence, you know in this space going
46:49
forward. And and I can't help but going
46:51
back to the, you know, we have to drive outcomes more broadly,
46:55
right? If we have the ability to see
46:57
this stuff in Orchestrate, those are great tools for people to
47:00
scale out versus continuing to try to ask for more headcount,
47:04
right, because that's probably not a winning strategy, right.
47:06
So I'm I'm really interested in see how it influences the
47:10
product Rd. maps of companies coming coming soon here I'm.
47:13
Going to throw another one out for you.
47:15
This big trend in the industry is around converged identity.
47:19
In other words, one software vendor does it all and can
47:24
compare and contrast that with best of breed.
47:27
And if you're like me, there's not a black and white answer,
47:29
but I'd like you to. I'd like to understand your
47:31
headspace when it comes to converged identity versus best
47:35
of breed approach. Yeah, no, it makes sense.
47:37
And you know, I think if you're a smaller company organization,
47:40
if you don't have an IT staff, you know going to something like
47:43
a Microsoft or some other comparable vendor, right,
47:46
totally makes sense because you're you're really there to
47:50
enable other things. But as you grow in
47:53
organizational size and complexity, I think that
47:55
question probably shifts. And you know I think ultimately
47:59
to enable business security outcomes we have to be able to
48:01
shift tools when they no longer serve our needs.
48:05
So I get hesitant to say that we should go all in on you know a
48:09
massive platform because the stickiness that that drives and
48:13
the ability to move off of it, you know doesn't necessarily
48:16
enable those business outcomes. So I think it really depends and
48:19
you have to be really careful. So we've had a great
48:21
conversation and I want to start to wrap things up.
48:23
We were talking before we hit record that you're interested in
48:27
vineyards, and so I want to understand a little more about
48:31
this interests. I don't know if it's a passion
48:34
or a hobby, or maybe it's everything, but if you were to
48:36
create your own vineyard, what type of wine would you
48:39
specialize in and why? No, that's a great question.
48:42
And you know, I didn't say where I live.
48:44
I actually live in Virginia. You know, when people think of
48:47
wine, they obviously think of the West Coast.
48:50
But Virginia has phenomenal wine and, you know, amazing scenery,
48:55
probably not really well known outside of Virginia or, you
48:58
know, people that are really into wine, you know?
49:01
So I can't help but think about, you know, wine's awesome, right?
49:03
It, it brings people together, you know?
49:06
You know, we're obviously really interested in that as an
49:07
identity professional, right, about bringing people together.
49:10
But also, you know, I think it's really interesting because wine
49:13
grows in a place and it absorbs the flavor or the characters of
49:17
a place. And so, you know, I couldn't
49:19
help but think about, you know, living in an awesome world, you
49:22
know, beautiful mountains or rolling hills.
49:25
We are crafting this thing that brings people together.
49:27
So, you know, personally, I love caps of.
49:31
But you know, if you were to come out to Virginia and I
49:33
encourage you to do so, right? There's pretty much everything
49:35
out here. A lot of wine that you've
49:38
probably never heard of, like VMA or Tanat or Petite Mensee
49:43
these great white wines, red wines, you know they have a lot
49:46
of character and you know, bring you out to amazing places and
49:49
you know, make awesome connections.
49:51
I recognize some of those words, but only because my wife is
49:54
really into wine, so I definitely know the only Jim
49:57
for. All different language.
49:59
It it absolutely is, and it's fascinating.
50:01
I I think that there is a little bit of a biological factor in
50:05
this as well because my wife is the kind of person where she can
50:09
taste it and she can taste all the tasting notes, right?
50:11
She's very good at telling you I was like, oh, here's what the
50:14
terroir was and here's the notes of this and that.
50:17
And for me, all I taste is alcohol and wine and it's very
50:22
hard for me to enjoy it and appreciate it like she does,
50:24
because I just, I don't pick up on any of that.
50:28
Like I I can't smell it, I can't taste it, and so I don't enjoy
50:31
it to the level of others. But I don't begrudge people for
50:34
that. You know, I have AI have a
50:36
infirmity and I just live with it.
50:39
There you go. Yeah, well, I think the
50:41
important thing, like anything in life, it's about enjoyment
50:43
and, you know, having good connections and time with other
50:46
people. But I can't tell the difference
50:48
between Coke and Pepsi, that is for sure.
50:49
So you know, I've got my priorities straight.
50:52
Jim, if you were going to create your own vineyard, what, what,
50:55
what type of wine would you be making?
50:57
So my favorite kind of wine is Merlot.
50:59
And The funny thing about Merlot is I feel like people like wine.
51:04
People think it's lowbrow. First off, as I was thinking
51:07
that that's what I wanted to say, the thought came to my mind
51:10
of what does lowbrow mean? First off, that's like outdated.
51:14
And anybody who's talking in those terms, I'm not taking
51:17
advice, I think. It has something to do with like
51:19
if you're drinking out of a brown paper bag or something
51:21
like that. Well, if you're drinking Merlot
51:24
out of a brown paper bag, I mean you do you Jim, however you want
51:28
to assume it, that's yeah, that's not been my experience.
51:31
That's like Boone's farm or something like that.
51:33
But actually I so I guess Merlot, but I wanted to threw
51:38
this other idea out there. So I had this idea recently of
51:42
you know maybe I'm going to throw this out there.
51:45
This is the first time you've heard this idea Jeff.
51:47
But you know how last year we did an axe during event for
51:51
identity at the center kind of a meet up of all the listeners at
51:55
Gartner and it was an awesome event and few people who were
51:59
like really into the podcast showed up.
52:01
We threw axes. We had a couple of sponsors come
52:05
out and like pay for the whole thing.
52:06
So it was completely free for everyone.
52:09
What if we did a high end wine tasting and like for people who
52:14
drink, you're more than welcome to swallow.
52:17
If you don't drink, you're more than welcome to spit it into
52:20
some kind of like trash can. But my idea was we'd have, I
52:24
think the right term is sommelier, like somebody who
52:27
like, really knows the wine. Who would say, all right, now
52:29
we're going to open this 1997 Cabernet Sauvignon?
52:34
And this was a great year because it was, you know, a
52:38
drought or something like that. And, you know, expect some hints
52:43
of coffee and black cherries or something like that.
52:47
And then everybody would get like, you know, 1/2 an inch of
52:49
this wine. They'd be able to taste it and
52:52
it would be wines that most people would not buy because
52:57
like $200 a bottle or something like that.
53:00
And we could do it with like 10 different wines.
53:03
So what do you think? Is that a good idea?
53:05
A bad idea? I don't know, but it's
53:07
sommelier, so that's how you pronounce it.
53:10
My wife actually used to do. That I mean the sommelier.
53:13
The sommelier. I mean, I don't think in her.
53:16
I thought you were gonna have something a little more
53:17
interactive, like doing a crush, jumping into a VAT full of
53:21
grapes and just stomping on them and stuff like that.
53:24
That's pretty popular actually. People go and do that.
53:26
We could do wine pong, yeah. Something like that.
53:28
I don't know. I don't know, John, what do you
53:30
think? Would you go to a a wine tasting
53:33
of some sort? Oh, absolutely.
53:36
You know, but Jim, you said you live at Augusta.
53:39
Like, why don't you have us all to the masters here?
53:42
I mean, come on, that's a that's a way better option.
53:44
I definitely would do that, but I would not buy people tickets.
53:48
You know, to buy those tickets on Sub Hub, they're going for
53:51
like $1700 a day now, and then Sub hub's gonna throw another
53:55
$500 in fees. So if you got a ticket, I've got
53:59
like several guest rooms in my house.
54:01
And John, I'd love to have you over lot.
54:04
But Jim, you're a Co host of the world's most popular identity
54:09
and access management podcast. What do you mean you don't get
54:12
tickets to the Masters? Well, it's, yeah, I mean, I
54:17
don't know. How can I explain it, man?
54:21
It's a lottery system. They have a lottery system.
54:24
I enter the lottery system every year, but it's just like the
54:27
regular lottery. I'd never win.
54:29
So if you win the lottery, you can buy up to four tickets for
54:33
the days that you won at like 90 bucks a ticket.
54:37
And then when you get in, they sell sandwiches for like $1.00.
54:41
So it's like they do a lot of things that are traditions for
54:45
Augusta. The whole thing is about it's a
54:47
tradition like no other, but if you aren't lucky enough to win
54:51
the lottery, it's just like any sporting event.
54:53
You can go on to StubHub and buy a ticket at some exorbitant fee.
54:57
So think of how many people win this lottery.
55:00
They get 4 tickets at 90 bucks and then go and sell them on
55:03
StubHub for, you know, anywhere from 1500 to $2500.
55:08
Sounds like a pretty good investment.
55:10
It seems rock solid. Like, you know.
55:12
Well, here's the here's the strategy.
55:13
Just go win the lottery and turn that $90.00 into, you know, 10
55:17
times that. Yeah, it might as well enter the
55:20
lottery every year, whether you like golf or not.
55:23
All right, let's go ahead and leave it there with the fact
55:25
that you're not bringing anybody to the Masters gym.
55:27
I'm very disappointed in you. I'm bummed.
55:30
Yeah, I know. No kidding, right?
55:31
Yeah, I'm, I'm taking a I'm taking a training course on how
55:34
to become a better some leader. All right, you can find us on
55:39
the web idacpodcast.com or on Twitter X, whatever it's called
55:43
by the time you listen to this IDAC podcast.
55:46
Macedon. At IDAC Padcot.
55:48
Yeah, IDAC podcast at infosec dot exchange.
55:51
And of course look for us on YouTube.
55:53
Start to put more content up there and hope to do more in the
55:55
future. And of course link, you know,
55:57
catches up on on LinkedIn. Send us notes, comments, what
56:01
you like about the show, what you don't like about the show.
56:02
We read them all. And for those that have sent
56:04
stuff in the past, we definitely appreciate it.
56:07
We'll have a link to everyone's LinkedIn in our show notes so
56:10
people can ask questions or, you know, give Jim a hard time about
56:14
the pronunciation of sommelier. So with that, we'll go ahead and
56:17
leave it for this week. Thanks everyone for listening
56:19
and we'll talk with you all in the next one.
56:22
You've been listening to Identity at the Center.
56:25
We hope you've enjoyed the show. Make sure to like, rate and
56:29
review and we'll be back soon. But in the meantime, hit the
56:33
website at identity@thecenter.com and find
56:37
us on Twitter at IDAC Podcast. See you next time on Identity at
56:44
the Center.