Latest / Identity at the Center / #387 - InfoSec World 2025 - Trust, Transparency, and Technology: Building Better MSP Partnerships

Transcript

#387 - InfoSec World 2025 - Trust, Transparency, and Technology: Building Better MSP Partnerships · Identity at the Center

0:10
Welcome to the Identity of the Center podcast.
0:11
I'm Jeff, and that's Jim. Hey, Jim.
0:13
Hey, Jeff, how are you? I'm pretty good.
0:14
How are you? Good.
0:15
We're at Infosec World 2025, and as usual with most conferences,
0:21
like the Hallway, conversations are worth the price of
0:24
admission. Hallway con is all is all about
0:27
it. So that's that's the car good.
0:29
Part So I've had a few conversations with folks about
0:33
they're using managed service providers to provide identity
0:37
not only here at the conference but come a couple of times.
0:40
So we decided let's do a podcast about that topic.
0:43
Yeah, I don't think we've actually like hit this topic
0:45
before. And so it's like they're out
0:48
there. I think the, you know, there's
0:50
always some trepidation. OK, well, do we use a partner
0:52
for this? Can we do it ourselves?
0:54
The answer is probably different for everybody.
0:56
So it's not like A1 size fits all solution, but it's
0:59
definitely an area where from an identity perspective we have to
1:01
think about. OK, well, how do these people
1:03
get access to things if they're managing my data?
1:05
What about other parts, you know, other clients they might
1:08
have? Right?
1:08
Things like that. So I thought it'd be
1:09
interesting. And yeah, so again, I'm going to
1:12
be distracted because, again, looking past you is in the
1:14
episode recorded earlier, There's a pumpkin patch and
1:19
people in wizard hats across from here.
1:21
Well, Halloween is those weeks, so you got to cut them a little
1:24
bit of slack. But they're trying to be
1:25
festive, right? And we we have Halloween.
1:28
Candy Yeah, yeah. I mean, look, we're at a
1:30
conference, right? You need, you need to have
1:32
something to hook people coming in.
1:34
Yeah. It's like a message, say, like
1:35
for us, hey, we're doing a podcast in the middle of like
1:37
the RSM and ID identity at the center, you know, Expo hall
1:42
space. And so, yeah, like we're all
1:43
trying to do our things. And we?
1:45
Have Butterfingers and we have Butterfingers and other coffees.
1:48
And who do we thank for the Butterfingers?
1:49
It's our guest today, Mr. Mike Rearing, who joins us from
1:52
Tampa, coming in here to Orlando.
1:54
Thanks, guys. Thanks for bringing the candy.
1:56
Yeah, that's so Candy will get you everywhere on this podcast.
1:59
I'd be careful to bring candy that I don't love, and I didn't
2:04
personally agree at all so. Yeah, that's a that's a good
2:06
strategy. So I there's 100 grams and
2:09
crunches in there and that has been a problem for me I'll.
2:12
Just say that up front right now.
2:13
So for me, the thing that's in there that I like is the
2:15
Butterfinger and I managed to resist for the most.
2:18
Part. OK, well, thanks for being here
2:20
with us. So you're a member of the RSM
2:23
team here. I'll let you kind of introduce
2:24
yourself. But we're all part of the RSM
2:26
and they say, OK, we're gonna have a conversation about about,
2:29
you know, managed providers and kind of things like that.
2:31
So tell us who you are. So I'm a principal in our
2:35
technology consulting space and I work on, on managed.
2:40
So I, I both, you know, I'm a leader in the practice that
2:44
delivers managed services to our clients and I serve clients.
2:48
So been doing the managed services thing for a while.
2:52
So before I came in, I'm a recovering nerds.
2:56
They don't let me do that anymore.
2:58
I'm not allowed to actually touch the keyboards, but yeah.
3:01
So how did you get into like the technology space?
3:04
So like the origin story of of you?
3:06
Yeah, I went to school for computer science, but I haven't
3:12
ever actually been paid to write any codes.
3:16
Is that a good thing? I guess.
3:17
I mean, it depends what you mean by code, right?
3:19
So I've scripted a bunch of stuff, right?
3:21
There's almost most IT people have done some sort of
3:25
automation, but I've been an infrastructure person, man or
3:29
what? So before I came to RSM, I used
3:34
to implement things like Microsoft Active Directory,
3:39
Exchange servers. And you know, back in the day
3:44
teens used to be called a thing called what was this OCS Office
3:50
communication fervor. So I used to implement that
3:52
thing. So yeah.
3:55
And like, talking to you about identity is always interesting
3:58
to me because like, that whole Active Directory thing is like,
4:01
you know, it, it is at least in part an identity system.
4:06
It's an identity provider. It's the gift that keeps on
4:08
giving and will never die. Like everyone uses Active
4:11
Directory. For the most part, we can call
4:13
it Contra, we call it whatever we want, but it's active.
4:16
Whether it's on Prem or in the cloud, there's a directory
4:18
somewhere and I think, you know, just my own.
4:20
Experience. I don't know, I've never heard
4:22
exactly. Yeah.
4:24
So M1 of the reasons that we wanted to have you on the show
4:27
is that you're heavily involved in the MSP kind of focus.
4:31
And I mean, that's just like it seems like it's a rapidly
4:35
evolving area and a lot of organizations are doing it now.
4:39
We're reaching the identity practitioner listener base and
4:44
these are folks who are having to secure access for their MSP
4:48
providers. What have you seen in terms of
4:52
the evolution over the last few years and what are some of the
4:54
the biggest impacts of those identity people?
4:58
Yeah, the, the standard by of what good stewardship is has
5:05
certainly evolved, right, in a lot of ways in the identity
5:10
space. And then what, what minimum
5:14
security standards are for various industries have have
5:17
evolved and people had to get a lot more mature, right.
5:21
The threat landscape has definitely evolved and changed
5:26
just in the last 5-6 years. You know, you look around and
5:29
look at this, we're not, it's not, it's a cyber conference.
5:34
And you know, you walk down the halls and you'll see the names
5:37
of vendors that were selling antivirus products, you know, 20
5:43
years ago, you know, like, wow, I didn't know they were still in
5:47
business 'cause I think of them as like a legacy signature based
5:50
antivirus provider. And then you see other people
5:53
that are, you know, didn't exist back then and now they're
5:57
leaders in his face for things like DDR and detection response
6:01
and that those faces change. I get it, he's changed it.
6:04
So when I first started working in the managed services space,
6:10
we always had, you know, the companies that I worked for at
6:13
the time, we used shared account to access our clients
6:19
environment. You know even the most
6:21
privileged accounts, you know, you know the domain admin,
6:24
enterprise admin level accounts were a shared account.
6:27
You know, you know Acme MSP admin, you know past client.
6:34
They've not. Gone.
6:35
Almost nobody wants to use that anymore, right?
6:37
That's right. Not the, not the leading.
6:39
Practice, we should just call it that, right?
6:41
So it's really easy to identify in the list and of account.
6:44
That's right. But that whole thing has
6:48
changed, you know, and and the vendor landscape has evolved to
6:55
support some of that and in other ways is way behind.
6:59
And you would you have to work around it then use, you know,
7:02
third party stuff to help either federate or do just in time
7:06
privileged access to the client environment, those sorts of
7:09
things. So and of course our clients,
7:13
you know, in our assembly serves the middle market.
7:16
So that means a lot, right? That that means very, very small
7:22
immature environments. I serve a not-for-profit that
7:25
has a budget of $20 million a year for the whole
7:27
not-for-profit now for IT, not for identity, not for cyber.
7:31
It's also for budget, right? And then I serve other clients
7:34
that are, you know, in, you know, the billion dollars, you
7:37
know, billions of dollars space. So their maturity in their
7:43
expectation and their ability to even participate with you in
7:48
securely and responsibly accessing their environment is,
7:52
you know, this massive continues, right.
7:54
So it's not in the back from that perspective.
8:02
Yeah. And when I mean, do you feel
8:05
like the your walk around here in the in the vendor Expo hall
8:09
here at the conference, do you feel like the the technology
8:13
solutions are evolving to kind of solve those problems well?
8:17
Or is this still a major gap in terms of, you know, a focus on
8:23
solving the problem of having multiple third parties coming in
8:27
and managing the IT environment? Yeah, that I don't know, Like
8:35
I'm not an identity expert, so I don't feel rude.
8:38
Well, if I can answer the question, to be honest with you,
8:40
I do know that most of the folks in the Expo hall are not trying
8:46
to solve my problem. Isn't NSP most of them, right?
8:50
They're trying, they're building solutions for enterprise sized
8:55
clients to do identity and access management for an
9:00
enterprise, right. And my business probably was a
9:05
little different. As I think about serving my
9:07
hundreds of clients, we've have extraordinarily disparate
9:11
technology platforms that may or may not be able to consume
9:15
identity from the IDP that I select, right or the for the,
9:21
you know, the federation and you know, focus station for
9:23
frustration platforms that I select all right.
9:26
So I feel like I can get to like 80% and then that last 20%'s
9:32
just really, really long, right. So we still have shared accounts
9:36
if we used to access certainly quiet systems that just can't
9:41
play in the sandbox. And we just have to be really
9:45
diligent about how we manage those privileged accounts.
9:48
We keep them involved. You have to check them out.
9:51
You know all that stuff. And you think to yourself is
9:55
probably legacy applications, but I think there's also just
10:00
certain industry focused applications that almost act
10:03
like legacy. They're still like the current
10:05
state, you know, latest and greatest, but you know, from the
10:09
standpoint of evolving with the technology, they're not doing
10:14
it. There's such like like the
10:17
certain industries, you're right, like the industrial space
10:20
is one that I think about a lot, right.
10:22
Because they're, you know, they're OT environments or the
10:26
process control environments. Like they don't go update that
10:29
stuff all yeah, you know what I mean?
10:31
Like some of those are, I walked into a factory a few months ago
10:35
and there were like zip drives on Youtubers that were running
10:38
Windows 2000. Yeah, you know, and I'm like.
10:42
Those are disc tries, only five years.
10:44
Ago we can't touch that because that's the thing that does the
10:47
batch control for making, you know, the polymers, they the
10:51
vendor isn't in business anymore and they you know, it's that
10:55
kind of stuff. You know there's always going to
10:57
be something. Yeah, a lot of times there's
11:00
apps you'll see, Oh yeah, we're going to have Samuel single sign
11:02
on in a couple of years or something like that's not even
11:06
available. So I think listeners could be
11:09
coming from to this podcast from a couple of different places.
11:12
One is they've already got an MSP and they're trying to manage
11:16
access. Another is, you know, the place
11:20
where their organization is starting to look at using, you
11:25
know, kind of outsourcing some of those managed servers work
11:29
for some of the, you know, maintenance of IT and
11:32
information security and identity and kind of what are
11:35
some of the traits of, you know, a good partner?
11:38
What are things that stand out versus a not good partner?
11:42
Yeah, I guess the first thing I think of is the word partner.
11:48
It, you know, we all throw that word around, but it, it's a real
11:51
word. And one of the characteristics
11:54
of a good partnership in all parts of our lives, right, like
11:58
is transparency and, and, and honesty about capability.
12:04
What can I do well? What can I not do well?
12:09
And I would hope that as you're, as you're evaluating
12:12
relationships with different people to to serve your
12:16
organization, I'm not going to trust your gut.
12:20
Like if you can tell whether somebody's, you know, if
12:24
somebody says yes to everything, it's probably not true.
12:29
You know, there are things that I can't do well.
12:31
And I'll, you know, I my job to be courageous enough to tell you
12:36
and risk using the deal. I have to say, sorry, I I can't
12:41
do this. I can't do that well or I would
12:44
love to Co develop the ability to do this.
12:47
I'll give you a break on this engagement so we can Co develop
12:52
this this model, but you have to let me use it for other other
12:56
attention clients, right? Maybe someone but you know.
13:00
The thing I thought of. When we were afraid to do that.
13:02
The thing I thought of when you said partnership is also there's
13:06
two sides to a partnership, right?
13:08
If all you are looking at is like what you're going to get,
13:12
yes, that's not a good starting point, right?
13:14
And I think, you know, I've worked in an organization where
13:17
we looked at MSS PS and Ms. PS and it's like, you know,
13:21
ultimately the bottom dollar is going to be one of the main
13:26
drivers, but you can't kind of just go into and expect the
13:30
world and the lowest price. And because what you're probably
13:33
going to get is a lot of promises that will never be
13:35
fulfilled. To me, it's kind of like it's a
13:38
give and take. Yeah.
13:39
Well, and getting an MSP or an MSSP on boarded to deliver the
13:47
service to your organization, it thankfully like it's hard.
13:51
There's real work, like we have to learn each other.
13:54
I have to learn all the nuances and all the littles, you know,
13:58
institutional knowledge that you as the consumer of the service
14:03
may have well documented, but you probably don't.
14:06
But at least I haven't met you yet.
14:08
So if you're one of the, if there's a listener out here who
14:10
has all the institutional knowledge really well
14:12
documented, like please call me, I'd love to serve you, but I
14:16
haven't met that. I haven't met that client yet,
14:18
right? There's always stuff that's
14:20
locked up in Putin's heads that's really, really important.
14:24
And learning those things is super, super, super important
14:29
and it takes time and we have to document that stuff in our, our,
14:33
our IT. So this management platform and
14:35
entering the knowledge and standard operating procedures
14:38
and, and all that kind of stuff. And then, you know, deploying
14:41
the tooling and all that, right? So it's time consuming and it's
14:44
expensive. And so to your point, you don't
14:49
want to make a transactional decision on that relationship
14:53
because three years later you don't want to change.
14:57
It hurts to change. It costs money and time and it's
15:00
disrupted for change. You mean change?
15:02
Partners change partners. Great.
15:03
Yeah, Yeah. So hopefully you put you make a
15:06
good choice and you have a big culture fit and it's truly a
15:10
function. I kind of feel like something
15:12
I've seen my clients struggle with is looking at MSP or MSSP
15:18
relationship. It'll be written for, hey, we'll
15:22
run your environment as it is on such and such a date three years
15:26
in the future. The contract hasn't changed, but
15:29
the technology is really changing.
15:32
And it's like, where does that leave you?
15:34
Yeah, yeah. I mean, it kind of depends what
15:38
service you're subscribed to. You know, we said we just, you
15:41
know, we've been talking so far in the conversation about like
15:45
MSP as if it's one thing, right. When for a really small client,
15:50
the, the, the idea of being their MSP might be that I'm the
15:53
total outsource service, like I am the outsourced IT department.
15:57
They don't have any money. So when you say I'm your MSP
16:00
that to that client on everything.
16:02
I'm the service desk. So I'm monitoring, I'm patching,
16:06
I'm, you know, doing, you know, you hire onboarding, I'm
16:12
deploying PCs, I'm doing endpoint life cycle, I'm doing
16:15
all that stuff. OK, But to another organization
16:19
to be there, NSP might just mean that I'm the outsource.
16:23
I'm the outsource services, or I'm the outsourced monitoring
16:27
like network monitoring team, or I just do firewall management or
16:32
whatever, right? It's a discrete service.
16:35
So it depends what the service is, right?
16:39
And it's just that it's not one size fits.
16:43
I'm glad you made that distinction because I think we
16:45
sometimes get caught into like, OK, is it MSP?
16:48
Is it MSSP? Is there a difference?
16:50
I do. Think there's a clear
16:51
distinction? So let's.
16:52
Talk about that because people might not be familiar with.
16:55
All the actors of the IT is for some of our, you know, our less
17:00
experienced fire, right or our client who you know, it's not
17:03
always even an IT professional who I'm interacting with as the
17:06
prime partner. She sometimes it's a operating
17:09
officer or a or, or somebody like that.
17:13
And for an IT professional or a, or a cyber or security
17:19
professional, we kind of intuitively understand that
17:22
there's right, you, you know, the outsourced MSP is really, I
17:29
think of, I use the word infrastructure and operations,
17:32
like we're keeping the thing up and running and operating it for
17:38
you, right? So we're making sure that all of
17:42
your systems are available and ready to do their zones, right?
17:46
The security provider is really like, I think of as the cyber
17:52
operations, right? They're probably delivering a
17:57
set of, they're probably operating a security operation
18:01
Center for you. They're probably ingesting your,
18:05
your telemetry and your events into their SIM.
18:07
There might be providing you with endpoint detection response
18:12
tooling and they might be doing some kind of, you know,
18:18
vulnerability scans on a periodic or continuous basis to,
18:22
to make sure that we're staying ahead of, you know, the
18:25
vulnerabilities that are in the environment, whether they be
18:29
configuration or patch or whatever The thing is, right?
18:34
And there's got to be connectivity between those two
18:36
parties, whether they're the same, they're the same company
18:40
delivering both of those capabilities or you'd buy those
18:43
things from two different companies.
18:44
There has to be connectivity. It's like here at RSM the the
18:49
MSSP team does vulnerability scans for our clients as part of
18:54
their scope of service when you buy that service from us.
18:58
But my team on the managed IT side does the vulnerability
19:03
remediation, right. So we have a certain set of
19:07
stuff that art that knows how to patch.
19:10
And that's not everything right there.
19:12
I have not met the tour, if that knows how to patch everything,
19:15
right? And so there's a handshake
19:19
between that MSSP side of the house and the MSP side of the
19:23
house that says, hey, you guys have been patching all the
19:28
Microsoft stuff that you're patching all these third party
19:30
products. But here's this thing in your
19:33
client's environment that is has a vulnerability and is behind,
19:38
right? What are we going to do to
19:40
mediate that? And there's varying levels of
19:42
flexity to that, you know, but there's got to be a handshake.
19:48
So who's who's responsible for that handshake?
19:51
Is it the client? That's like, OK, we've got these
19:53
two different services and you guys should be talking to each
19:57
other and ultimately right, the customer is probably.
19:59
What addicted to you guys you should get it varies a little
20:01
bit. If you buy both of those
20:02
services from us, you should expect us to be that court,
20:05
right? But if you are the kind of
20:08
client that is, that doesn't have an IT leader, doesn't have
20:14
an IT staff, we should be doing that coordination and reporting
20:19
to you, informing you if you think in racy terms, right?
20:23
I'm informing you that I did, that I did my job right and
20:26
hopefully. Through our relationship, you
20:29
are learning, I have a lot of clients that had zero IP
20:33
background, but over the course of the relationship they've
20:38
learned enough to be able to ask intelligent and for questions of
20:42
us, right? And I love that.
20:43
That's the best time part, right, is, is when we're both on
20:47
the same page. But then there are other clients
20:50
who have some more nuances and, and you know, more experienced
20:52
and maybe they want to be more involved in that process.
20:59
So we'll have the meeting between the MSSP side and the
21:02
MSP side and the client will show up to that meeting and
21:07
really play an active role. They, you know, this long 4 J
21:11
thing is out there and like don't mind that bus, but it's,
21:18
it's stitched into our line of business application and the
21:21
vendor, you know, does it really have a great remediation for
21:25
like the. You end up in those kind of
21:26
conversations. And hopefully the client is
21:28
equipped to have to participate fully in an informed manner in
21:32
that conversation. So let me ask you for three
21:35
questions that a client should ask their managed partner.
21:41
Like what are the three things that is OK?
21:43
I'm interested in this concept of some sort of managed service.
21:47
What are three things they should be answering?
21:49
This is somebody who has not done outsourcing before and
21:51
they're thinking about boot. Counts.
21:53
Yeah, let's take it from that angle and say, OK, good.
21:54
What should you? What should they be asking?
21:56
Yeah, one of them is, is like what widgets are we counting,
22:03
OK, like how do I, how do you determine what my fee is every
22:08
month with that? So in the MSSP space, they are
22:13
often counting the number of devices that have UDR installed
22:18
on them or the number of log sources that are sending logs of
22:23
telemetry into the SIM, right. In the MSP space, we're often
22:28
counting sometimes for, for those like relatively simple
22:32
smaller clients, we're just like first supported user per month.
22:36
That's the widget. I'm counting the number of
22:38
employees that you have who could call the service desk and
22:41
who carry a laptop. So what's the widget that I'm
22:46
counting in order to determine like, and there are people out
22:50
there like especially, and it's the large enterprise space on
22:53
the health desk side, it's, you know, fee for service desktop
22:59
per month and you pay every time you fall.
23:02
Like I personally don't like that model because it it just
23:05
doesn't doesn't inset the right behaviors.
23:08
What's the what's the service provider's incentive?
23:11
So drive down the valley in the service dust falls and be
23:13
prominent right in that. Maybe I don't understand it, I
23:17
don't know. But what's the witches?
23:21
What's another one? Who is going to after the
23:28
salesperson walks away? Who?
23:31
What's my What's my escalation path?
23:34
Who's my account manager? I'd like to meet them.
23:38
I hope you've already met them through this, the sales process.
23:42
But who, who's the, who's the escalation path?
23:45
What happens if that person builds on PTO on vacation?
23:48
How do I get escalation to find an impalm?
23:52
And so I would want to know that and what are the metrics that
23:59
we're going to use to define success?
24:03
And so that could be, you know, response time and itself is so
24:09
the celebrity greener around response time.
24:11
If it's a service desk thing, one of the things we report to
24:15
our clients in a program that I run is I report the client
24:19
satisfaction for my clients. So would you subscribe to ours
24:23
for the pills desk? We offer your caller an
24:28
opportunity to tell us how we did.
24:30
Five stars, but 5 is good, one is bad.
24:33
I report that back to all my clients.
24:35
This is, you know, 75 or 100 or 1000 of your people responded to
24:40
the survey last month. And this is how many people told
24:44
us we did a great job. Here are the ones who told us we
24:46
did a poor job. And this is what we did to
24:49
revelate that. Make sure it doesn't happen.
24:51
So what's the standard for success that we're going to use
24:53
them to manage them? I love Jeff's question because
24:57
what we're always trying to drive towards in these
25:00
conversations is what are the actionable steps that people can
25:03
come and take away from those? Yeah.
25:05
And I'm sitting here processing when you have the MSP and MSSP,
25:12
it feels like identity becomes the area where it's like where
25:17
does that line kind of stop because you want to say, oh,
25:20
MSSP you do identity. But I would think in the the
25:26
world that MSP is often running like Active Directory, which
25:30
ends up being one of the most important identity systems.
25:33
So if you're kind of architecting the solution like
25:37
roles and responsibilities, but also realizing that the tech
25:41
landscape changes every couple of years, what is the approach?
25:45
And I always feel like a well informed client is the best
25:49
client because they understand the challenges right?
25:51
Well, you don't have misunderstandings and surprises,
25:54
right? Right.
25:54
What a welcome client for sure. You know where identity lives is
26:00
kind of up to the client, right. You guys probably work with
26:04
clients and yours and probably there are people on this fall
26:07
and some of the people for on this podcast that are pursuing
26:10
the podcast. Some of you work for the the
26:13
security team at your employer and some of you might work for
26:17
the IT team at your employer. I don't think there's, I don't
26:21
think there's consensus in the world about where identity lives
26:25
in, in our our universe of IT departments and cyber
26:29
departments in the world, right, right.
26:31
It's a question. That comes up every time.
26:32
Like, you know, we sit with clients who should it report to?
26:35
Yeah, there isn't a right answer and I'm not a.
26:37
Security professor so I hope I don't know the right answer.
26:40
If I I'm responsive to the client in that.
26:43
It should belong somewhere though, like somebody should be
26:45
doing it. What it does is as long as they
26:47
know about it and they're. Responsible.
26:48
It's an afterthought though. Like I've we onboard clients all
26:51
the time to our managed service and getting to one of the first
26:57
things we start to look at is when a hiring manager clicks on
27:04
the configuration item in the in the in the portal that says I
27:08
need a new hire. Like what is the authorization
27:14
process for that? What job roles exist?
27:18
What authorizations, what identities do they need?
27:22
Yeah, right. Because a ton of my clients
27:24
don't have a central identity provider so.
27:25
You trace those whole workflows and kind of figure out what are
27:28
the sticking points. And then you know, who gets to
27:33
authorize which job roles, what kind of laptop do they get, what
27:37
systems do I provision identity into and so on.
27:42
And then because some of our pricing models have this price
27:47
per supplies user per month, find a concept like what's the,
27:52
what's the system of like of record for figuring out like
27:55
what's a user and what's an active user?
27:58
And then you start digging into their system.
28:00
And I'm like, you told me that you have, you know, 1500
28:04
employees that work here, but they're like 3800 active Active
28:10
Directory or Ultra accounts that like aren't logged in over.
28:14
So that doesn't feel right. Like you told me 1500 people
28:18
work here. Why do you have an extra X
28:21
number of thousand against? And they and they're like, yeah.
28:26
But that drives that, that incense behavior on your part to
28:29
say, wait a second, is the license incorrect?
28:31
Because I know that that is a challenge for a lot of
28:34
organizations. Like we don't, we don't actually
28:35
know how many people here it. Becomes a licensing thing
28:38
because they're probably paying for AE3 or E5 or right, whatever
28:43
license to Microsoft or whoever, right, whatever your system is
28:46
for a person who hasn't been here for whoever and and they
28:50
could still log in like the identity's active right?
28:54
That they I would be worried about that, right.
28:56
But we run across people like that.
28:59
These kind of like workflowing processes sound to me like the
29:03
perfect topic for workshops. One to two day workshops.
29:08
I'm just wondering. Have you ever got that done in
29:10
two days? Since this is at some point you
29:13
have. Like occasions, right, right.
29:15
At some point you got to say, OK, we're going to go with
29:17
vendor A or vendor B. Do you get that opportunity in a
29:22
lot of, because I've seen our fees be the way to kind of like
29:28
get folks to come in, But it seems like it's such a important
29:33
process to figure out like are we working with somebody who
29:35
gets it and cares about our needs?
29:38
Or does it come down to all right, put together a bunch of
29:41
documentation and give us a. Price, the RP thing's so tough,
29:45
like, you know? I'm on record as not liking
29:48
them. Well, no one, no vendor likes
29:50
them, right? I don't.
29:51
Like doing them even on the customer side because they don't
29:53
really. It seems like it's a paperwork.
29:56
Exercise what they use them at least in principle.
30:00
They exist to like keep the the process of captain right?
30:06
So it's not who took you to dinner or it's not who gave you
30:09
tickets to the hockey game. It's it's ideal you would like
30:14
to see that RFP processes are a way to keep things objective.
30:18
But you're right, it ends up putting up this wall between
30:22
your organization and potential service providers that's hard to
30:27
penetrate. You know, it's hard to get to
30:32
what the real consumer of the service really cares about and
30:37
wants and being exposed to that while still respecting the
30:43
spirit of the RFP processing function, right.
30:48
You know, I struggle with it a lot.
30:51
You know, I also don't like them, but I understand why do
30:54
they right? They you end up with like a
30:57
procurement person who sometimes if you know larger organizations
31:02
might have a procurement person who's assigned to I team dealer
31:06
superior cyber, the office from the system and over their
31:10
career, they, they actually understand the things they're
31:12
trying to help high right. But then sometimes come across
31:15
procurement people who are really just box checkers have no
31:20
clue what the service is that they're trying to facilitate and
31:25
they're just running through a process and that.
31:27
That's time, yeah. I just feel like it's it's the
31:30
RFP process. The spirit and the intent is
31:34
good, but the execution in the real world is very lacking.
31:39
Say that about so many takes time on it.
31:43
All right, let's talk a little bit about.
31:45
So you. You.
31:46
You talked before about, you know, how do you measure some of
31:48
the things that, you know, the client might want to see as a
31:50
consumer of that service? But let's talk about risk and
31:53
maybe if that perspective, are there other ways that we could
31:55
say, OK, we've reduced the risk. You identified one, right?
31:58
Hey, we found this account and guess what?
32:01
It should be a it should have been, you know, removed a while
32:04
back, right, licensing. Are there other risk reduction
32:07
sort of metrics that come out of this kind of conversation or
32:10
this type of service? I should say I.
32:11
Mean they're all open race and and they vary from client to
32:15
client and it's it around identity.
32:20
It's like how am I provisioning identity that finding the
32:24
fashion? How am I deep provisional of
32:25
identity? How am I ensuring that as a
32:28
person for their life cycle in your publicization doesn't just
32:32
accumulate permission then then access, you know, as they get
32:38
transferred from department of the department.
32:40
Have they just accumulated access to everything they've
32:42
ever had? You know, and it has no no
32:44
relationship to their third world.
32:47
You know, we end up talking about stuff like that.
32:50
We end up on my side of things. We spend a ton of time talking
32:53
about vulnerability and and patching and you know, what's
32:59
the right mix of being hyper responsive to security related
33:04
patches and from your updates and fix the like that.
33:08
Wow, doing some kind of change management and testing around
33:12
that stuff. Some of our clients just want us
33:16
to deploy it, right, you know, and you know, like, hey, can we
33:19
just maybe let's deploy it to this test group first, then the
33:24
next week we'll deploy it to everybody.
33:25
So you know what I mean? So we need to talk about that
33:28
kind of stuff. A lot of our middle market
33:31
clients don't really have the concept of vendor management as
33:38
relates to ITI spoke to someone just recently and they're like,
33:43
yeah, I went to this, you know, this meeting, you know, four
33:47
different departments are evaluating AI solutions for
33:50
their department and I'm like, hold on guys, why aren't you
33:53
talking to IT? Then I called this person, I
33:55
said you don't have shadow IT because you don't have a policy.
34:00
Like you don't have any kind of vendor in fate that evaluates
34:05
the risk of new solutions and opinion in the environment.
34:08
You have it when they win the business what the what the rules
34:11
are. And so they can't be breaking
34:13
the rules if there aren't any rules for anything.
34:15
You're like, you know what I mean?
34:17
So and this person was like. Yeah, Yeah, right.
34:21
Right. Yeah, exactly.
34:22
Yeah. So Mike, you've been super
34:24
generous with your time. We're at AIT conference.
34:27
Guess what they're talking about AI cruising system.
34:30
So AI is changing everything in technology, right?
34:34
It's going to change MSSPI think as well.
34:37
Yeah, kind of put your your future facing hat on if you
34:42
would and just talk about where you see those changes coming.
34:46
How do you see this space evolving in the next couple of
34:49
years? Because of AI, Yeah.
34:52
So the, the, the two things that I think are important on the MSP
34:58
side of things that are interesting that are, that are
35:01
happening in AI, at least we're actually spending time and money
35:04
and, and putting real focus on this.
35:07
One of them is we spend at, we use, we use AI to do some
35:10
problem management. So problem management
35:13
historically has been a somewhat labor intensive thing and you
35:19
can use tools to help you with it, but so.
35:21
When you say problem management, can you describe what that is
35:23
for people who aren't familiar? Yeah, yeah, yeah.
35:25
So problem management is a ITIL process and problem management
35:30
is looking for trends across multiple incidents or service,
35:34
but so you know, it's work Spark not hard is the short is the
35:39
TLDR of problem management. It's I get a ton of calls about
35:44
this one issue and I could just solve the issue every time the
35:47
call comes in. Or I could try, try to find the
35:49
root cause. And the root cause might be a
35:51
technology root cause. It might be a training issue
35:54
that might be organizational change management thing.
35:57
But if I get, you know, 45 calls a day about the same problem
36:02
from the same client and I'm not doing any kind of I might never
36:07
identify the that I might just my service desk operation like
36:11
the Super inefficient and my clients.
36:13
So I always tell my clients, if your people are talking with my
36:16
people, they're not doing their job.
36:19
So I want to make it so that your people never have to pull
36:22
my OK, if your personal on the service desk, they're not doing
36:26
their thing. So if I could reduce that 25
36:29
calls a day on this one topic to a handful or zero.
36:35
That's the guilt. That's the bullet prompt.
36:37
It makes everybody happy. But there's some AI stuff that
36:40
we can do to look at the natural language text in the body of
36:48
our, our case or ticket history, if you will, and find out like
36:52
what are the things that are happening.
36:54
I, I use AI to look at, I told you, I run that play experience
36:58
program for, for our, our major service business.
37:03
And we use AI to look for themes that clients complain about,
37:11
like what are the things that that multiple people at the same
37:15
client might be playing bound or what are the things that
37:18
multiple people across our falls right of clients like waiting
37:22
back about in their case view. And then we go actually take
37:26
action. So that's it for who for sure.
37:31
Problem management implies that. And then the other thing is, you
37:35
know, we've all gone to a service desk portal and filled
37:40
out our ticket, right? And some of the more advanced
37:44
systems today are as you fill out the Tibet and they're
37:47
starting to suggest solutions to you for self-service, I think
37:51
you'll see that accelerate in just the the maturity of their
37:55
solutions and their ability to let you solve your whole problem
37:59
without this the the service desk, whether it's an insourced
38:03
or outsourced service desk, having to have person do
38:06
something. And you can see that stuff go
38:09
like I hate, I used to hate this things like try and just talk to
38:12
a person who consult. I'm an old guy, right?
38:14
I want to talk to a person who consult me problem.
38:17
I'm starting to pivot on the end then now I'm getting to a place
38:20
where the solutions that are being offered to me as I fill
38:23
out the digital form are actually better than.
38:26
They're getting so much better. I mean, you see it all over the
38:28
place. I still find myself sometimes
38:31
where you could tell they're the dated all the way.
38:34
You're just like, I want to speak to human.
38:36
I want to speak to human. Before they ask you the same
38:39
question, five months. Yeah, right.
38:41
You call your bank or your credit card company and you
38:43
answer the questions to file and then Sally asked you the exact
38:50
same questions. Annoying.
38:53
Why, right. Maybe some of those questions
38:55
you guys are identity to, maybe some of those questions are
38:57
authentication, but that's not anything.
38:59
But they're they're continuous identity.
39:02
Continuous identity verification.
39:03
Trust, right? I mean I I understand.
39:06
Memory from. 0 memory. Well, part of it might be that
39:12
somebody got injected into the call process, right?
39:14
If I have a Direct Line or something like that, how do you
39:17
know it's that person on the line?
39:18
It's it's a slippery slope. My background is help desk.
39:21
So when you start talking about, you know, problem management, we
39:24
had an entire team, this would have been early 2000s that was
39:27
responsible for writing right all the procedure documentation
39:30
and say, OK, if a caller calls with this problem, here are the
39:34
steps to fix it. AII think changes that quite a
39:37
bit, because now that information theoretically can be
39:41
generated by AI. Well.
39:42
What happens, you still need people to review it because what
39:45
you don't want to do is have it hallucinates, which is that nice
39:47
way of saying lie, you know, to give you incorrect, you know,
39:51
directions on how to solve something.
39:53
So it's a very fascinating world we're in right now where AI is
39:56
literally touching like every single part of the journey of a
40:00
customer through any support mechanism, whether it's they hit
40:04
the help desk, right? And if the help desk has a
40:06
problem, they're referring to documentation.
40:08
All that's being, you know, set up through potentially AI
40:11
identity problems are part of that.
40:14
Again, you run help desk, you're probably getting phone calls for
40:17
my password doesn't work or I can't get my mobile device
40:21
connected to the MDM, right. This is a you know we're we're
40:25
inside baseball. We had some problems with this
40:27
with you, right? Yeah, exactly right.
40:29
So things like that is these are all identity problems that are
40:31
coming in through the 1st port of contact is either a web form
40:35
right, my ticketing system, itsm or I'm picking up the phone and
40:38
calling somebody. A lot of this stuff is is just
40:40
changing the way it's working. I kind of feel like that
40:44
companies are sometimes afraid to unleash the full power of AI.
40:48
So for example, I called in for a pharmacy prescription renewal
40:55
and it was like, I can help you with that.
40:57
Give me the prescription number. It's like, I don't know the
40:59
prescription number. Can you tell me all of the
41:02
prescriptions I have with you? And I'll tell you the one that I
41:05
want. Well, I think their AI was
41:07
definitely smart enough to pull that back.
41:10
But at some point someone put guardrails on the AI and said
41:14
we're not going to do that, right?
41:15
That's too, too much of an opportunity for fraud or
41:19
whatever. They're concerned like concerns,
41:22
but like, man, that would have been like super useful, they
41:26
said. I was like, talk to human, talk
41:28
to human. Yeah, yeah.
41:30
I, I went to a client experience conference recently, well less
41:37
than a year ago. And in the client experience,
41:41
well, one of the things that happens is the concept that
41:43
closed the loop, right? So if somebody gives you
41:45
negative feedback, like somebody should reach back out to them,
41:49
then at least send them an e-mail and acknowledge their
41:52
pain, right? Or maybe call them whatever,
41:55
right? And one of the vendors in that
41:58
space was touting their ability to do close the loop without
42:03
even intervention, right? So the agent can reach back out
42:07
to the person who gave you negative feedback and make them
42:10
heard. And I just know that ironic that
42:13
like you want, you're using a system to make your customer
42:19
feel heard by an empathetic human, but they never get to
42:22
talk to him, right? And at what point do our agents
42:27
just talk to each? That's why.
42:29
I mean, that's that's a lot of transactions taking taking
42:31
place. They're going to be ancient to
42:32
ancient and then, you know, you guys figure it out.
42:35
Let me know what your agent. Yeah, exactly.
42:37
It makes us all sound very important, right, Agents?
42:40
You've been very generous with your time bands.
42:43
It's getting loud here in the conference kind of Expo area.
42:45
Like, I feel like I'm just being served right, Yeah.
42:49
You should be fine. You do photography on the side
42:53
and we were kind of talking a little bit about like deeking
42:55
out maybe some of the tools and stuff that we're kind of.
42:57
Using here, you guys have a, the audience probably can't see it
42:59
because you've always had like a really cool portable video and
43:03
audio rig. Here, thank you.
43:04
It's it works for what we do. I want to know, you know, from
43:08
your photography expertise and your history, like what is your
43:12
is definitely too. Strong about OK.
43:14
OK, your your interests. Yeah.
43:17
Like what is your favorite thing to photograph?
43:19
And like, what is it about photography that like, you just
43:22
enjoy it so much? I like travel photography, so
43:28
I'm the person who probably doesn't pick up the camera
43:32
often. So I definitely take it on
43:36
certain kinds of trip and they I think it makes you, it makes
43:43
you, it gives you an opportunity to look at the world with
43:48
intentions. So anybody can, anybody can pick
43:52
up a camera or your phone and just snap it, right?
43:57
A lot of people will say the best camera is the one you have
44:00
with. You the 1 you carry.
44:01
Right. And for a lot of.
44:02
People that is their phone, right?
44:04
But I'm, I'm a nerd, so I like the, you know, I like to have a
44:08
real camera with me, but I do travel photography and I like to
44:11
take pictures of wildlife and birds, birds of fuel, because
44:15
they're a technical challenge. They're this thing that's moving
44:18
quickly, often really far away. And I still haven't taken a good
44:23
bird pic. So I've taken soft bird pics
44:28
that I was like, OK, that's cool.
44:29
But there are certain things in life that I think some of the
44:36
best things in life, but with things that they've never done
44:39
getting good in, like literally even play golf, like they
44:43
probably chase that thing where they're not done getting Glen
44:46
out of it. I play tennis.
44:49
I'm never going getting good at tennis.
44:50
I'm a sailor. You never get done getting good
44:53
at sailing. Photography is another thing to
44:56
think it's you've never done. There's always more to and truly
45:00
even try to. What is your What is your white
45:04
whale of photography like? If you could take a photograph
45:08
of anything I don't what would it be?
45:10
Like that? Nothing.
45:11
No, I don't. Particular bird, particular
45:14
scene. Nothing.
45:15
Just. That's not the way.
45:17
OK, so I use it's about capturing a moment.
45:21
You mean like capturing it in an intentional way, right?
45:24
Like I, I, there's a, there's a YouTube channel the, the guy
45:29
runs that my daughter expressed recently in interest of
45:33
photography. So I introduced to this guy's
45:35
YouTube channel and we were watching one of his Intro to you
45:40
photography episodes and he was like, there's a improperly
45:47
exposed shot, there's a properly exposed shot, and there's a
45:53
creatively correct shot. So correct shot make creative
45:58
the correct shot of two different things.
46:01
And the creative Nick Barrett shot Heart is where you bring
46:05
your art to the science. And maybe it's you chose to get
46:09
down on a knee and take it from a different angle, or you chose
46:13
to, you know, expose the shot in a way that emphasized, you know,
46:18
something in the foreground and word background in a creative
46:21
way or whatever that thing is. Get that bouquet effect right?
46:25
Yeah, but I. Think it's yeah.
46:29
I don't remember Wade Whale. If not like that's that's a good
46:33
question. If I don't have an answer to
46:34
that, me and I, there's no bowl. I don't have a bowl.
46:39
Me even though, yeah. Yeah, I've, I've, as I've, as
46:44
we've grown this podcast, right, we've introduced video with like
46:47
in the last year and a half or so, I've gotten into things that
46:51
I hadn't thought about before, right before we were audio.
46:53
Now we're video. And so it's like OK camera
46:55
angles and lighting and exposure and framing of shots.
47:00
And I'm not an expert on it at all.
47:02
I try to find something that works with the gear that we have
47:05
for the environment that we're in.
47:07
And now I'm getting into color correction.
47:10
And now it's like, OK, what does pleasing look like to me might
47:15
be very different for someone else, right?
47:16
And so you get over saturated color sometimes or maybe that is
47:20
pleasing. The tool like that you and I
47:22
were talking about. The different.
47:23
Resolve Right started as a color graded product and became a
47:28
video video. So yeah.
47:30
And do my eyes perceive colors the same way as someone else?
47:33
Do you want it to be hyper realistic, right, or are you
47:35
trying for an effect? Yeah, yeah.
47:37
There's just so much to it and I find it.
47:40
Fasting, going to start wearing makeup on the on the I'll.
47:43
Wear like, you know, like like stage makeup for like, you know,
47:47
a heavy metal band. I'll do that.
47:49
That would probably help this at anything.
47:50
All right, let's go ahead and leave it there for for this
47:53
episode. Mike, thank you so much for
47:55
taking time out. Thanks for being here.
47:57
You know, I think this is such an interesting area that we
47:59
haven't really touched on is like that whole managed provider
48:02
kind of community. So hopefully people got, you
48:04
know, a sense out of that. I think people are going to love
48:06
this episode. Yeah, I think especially we got
48:09
into the conversation about help desk and like the real world
48:13
stuff and that's what the identity practice is doing.
48:16
And shout out to all my help desk people.
48:17
And that's where I started at. Least you could like keep going
48:21
down the Rataville, you could grab like the HR and paywall
48:23
team into this. Like you guys are identity
48:28
professionals, right? Like it's not just IT or even
48:31
cyber rates, you have to have that business connection.
48:33
A lot of IM is just business process.
48:35
You know, the technology is sort of like the third leg over here,
48:39
but so much of people in process.
48:41
Yeah. All right, we've been here for
48:43
this week. Shout out to Shirley again and
48:46
RSM for bringing us out here. Let's see what else
48:49
idacpodcast.com like and subscribe dot TZ.
48:53
IDAC. Dot TV.
48:56
You know idac podcast dot. Podcast, I should just go to
48:59
idacpodcast.com. It's there.
49:01
The YouTube channel linked everything else.
49:02
I know I've got too many domain names for the podcast now I'm
49:05
starting to lose track of it. I need like a.
49:07
Is this defensive domain name registration?
49:09
A little bit, but also, you know, Zeke, alright, how do we
49:11
make sure that we got things covered?
49:13
I need like a like a Pam system for all my like domain names or
49:17
something. I don't know.
49:17
That's a whole. Different we manage for the MP
49:19
so we you could become a fuss of.
49:21
All right, well then, you know, maybe we should have a, if only
49:23
I had like a an episode that I could lean into and say what
49:26
should I be asking my provider? OK Mike, thank you so much for
49:29
taking the time with us. And yeah, we've been there for
49:31
this week. Thanks Amber one for watching
49:33
and or listening and we'll talk with y'all in the next one.
49:38
You've been listening to Identity at the Center.
49:42
We hope you've enjoyed the show. Make sure to like, rate and
49:46
review, and we'll be back soon. But in the meantime, hit the
49:49
website at identity@thecenter.com.