Latest / Identity at the Center / #325 - Theorycrafting Modern Identity Architecture with Ian Glazer

Transcript

#325 - Theorycrafting Modern Identity Architecture with Ian Glazer · Identity at the Center

0:00
One of the things that I've started talking about is I this
0:05
may be me tilting in a windmill. I think we need to put some in
0:08
classic relational database terms, standardized views so
0:13
that everyone, whether it's a third party product or home
0:16
grown, can implement these views such that for a core set of
0:19
objects, maybe user and entitlement and system, I can
0:23
get data out no matter what the back end is, no matter whether
0:25
it's third party provided or it's first party provided.
0:29
Because that can reduce the cost of switching between vendors.
0:33
It can reduce the ability to the challenge to do bake offs
0:38
between technologies. It can facilitate people
0:41
bringing their own models or buying models to look at this
0:44
data to find interesting things about them.
0:46
So I'm, I'm a little bit on this, what I'm lovingly calling
0:50
Oids open IAM data schema, those of you who've been around for a
0:54
long time. And OID is an object identifier
0:57
famous in Ldapland. And this came from a realization
1:02
that the last time we really as an industry standardized data
1:06
objects at rest was like inet org person and Edu person.
1:11
And so with love in my heart, I'm like, you know what, let's
1:13
do a throwback name here. But I'm kicking that
1:17
conversation off with a bunch of folks and I'm getting a lot of
1:20
feedback and I'll it's really interesting seeing the questions
1:23
and the challenges to it. But that's like in my To Do List
1:27
to the next couple of months. And then we'll see where it
1:30
leads. It may all just crash and burn,
1:32
but someone may take like a ember of the remnants of it and
1:37
go use it to start a fire and that'll be great.
1:39
So let's let's hope that happens.
1:46
This is identity at the center if it has anything to do with
1:52
IAM. This is the go to podcast now
1:56
your hosts Jim McDonald and Jeff Steadman.
2:06
Welcome to the Identity at the Center podcast.
2:08
I'm Jeff, and that's Jim. Hey, Jim.
2:10
Hey, Jeff, how are you? Oh, not so bad yourself.
2:14
Doing good, but it's been a hectic couple of days.
2:17
I mean, you know, 2025 is going to be a fantastic year for the
2:21
podcast. We've got some great sponsor
2:23
spotlight episodes. We've got our our series talking
2:26
about the tie between different infosec areas or cybersecurity
2:31
areas and digital identity. And then we've just got a a lot
2:35
of fantastic guests lined up. So I'd build out the schedule
2:39
pretty much all the way through April at this point.
2:41
And already is shot to hell, right?
2:44
Different, different folks have kind of said, hey, I'm not ready
2:48
to do the podcast. So I've got 2 openings within
2:51
the next couple of weeks and I'm working my tail off to try to
2:55
fill those openings. We might have to do the Jim and
2:57
Jeff episodes. I like those.
3:00
Those are easy. Those are easy to schedule.
3:02
It's just you and I. We can actually disagree on a
3:04
bunch of stuff for like an hour, so I'm OK with that.
3:08
Yeah, I'm OK with it as well. But I think one of the one of
3:12
our secret recipe ingredients has been bringing in great
3:17
guests who bring different perspectives that we do.
3:21
Obviously you and I disagree on certain things, but I can pretty
3:24
much predict what those things are going to be.
3:27
I like bringing in somebody new to disagree with things.
3:31
Yeah, and I. Always had on the OR someone
3:33
we've had on the show like 10 times.
3:35
That's also great. Yeah, I mean, look, we have, we
3:38
have a tight knit community here in the identity space.
3:40
So obviously, you know, if you're listening to this, you've
3:42
already seen the scripture, you know who's going to be on.
3:44
But yeah, I mean, look, we have so many people.
3:49
I love talking to new people. I love talking to people who are
3:51
out there in the real world doing, you know, I call it real
3:54
identity things, right? There's so much we can learn,
3:57
you know, from each other. And even if we don't have all
3:59
the answers, like let's get it out there, maybe someone else
4:01
does or maybe someone else is struggling with those problems.
4:03
So if you're if you're, I'll put a I'll put a thing out there.
4:07
If you're interested in being a guest on the show, don't
4:10
hesitate to reach out. We're very friendly.
4:12
You know, it's a safe place, right?
4:14
We'll take care. Yeah.
4:16
And we just like to have conversations.
4:18
That's all it is. I think a lot of people maybe
4:19
get intimidated, like, oh, it's a podcast.
4:21
Like, OK, So what? It's just microphone.
4:23
And after about 30 seconds of talking into it, you, you
4:26
totally forget about it. And it's just, you know, us
4:28
talking here on the web. Yeah.
4:31
What I also like to do is to get folks like our guest today who
4:35
is a thought leader. But I've kind of decided in my
4:38
mind, you have to be told by somebody else that you're a
4:41
thought leader. You can't declare, hey, I'm a
4:44
thought leader. I'm a thought leader in this
4:47
space. I know people who do declare,
4:49
make that declaration, and Oh yeah, you know, sure, we all
4:54
have. A warning.
4:56
Listen to a warning if you If you have that on your LinkedIn
4:59
website, go delete it immediately.
5:01
Well, I think there's a whole subreddit called LinkedIn
5:03
Lunatics that is all about just the crazy LinkedIn stuff that
5:07
people post. And there's some good ones on
5:10
there. And thankfully I haven't seen
5:12
myself mentioned. I, you know, I don't know if I
5:14
would consider it a badge of honor or not to be somewhere
5:17
listed in LinkedIn Lunatics, but there are, there are definitely
5:20
some, some lunatics that have opinions, just put it that way.
5:25
Yeah, absolutely. I have to go out to check out my
5:28
own LinkedIn, make sure I didn't call myself a thought leader.
5:31
Maybe I nominated you and I posted something you did.
5:35
What were you doing on their site to begin with?
5:38
We keep teasing them, but let's take a minute to talk about
5:42
discounts. It's never too soon to save some
5:44
money and we're excited for this discount because this is our
5:49
first time actually going to this conference.
5:51
It's the European Identity and Cloud Conference 2025.
5:55
It's May 6th to the 9th in Berlin, Germany.
5:58
That's put in by the fine folks over at Commuter Cole and they
6:01
have partnered with us to give a discount code to all you fine
6:04
folks listening or watching here.
6:06
If you use the code ID AC25M KOI know it rolls right off the
6:13
tongue. Don't worry, it'll be in the
6:14
show notes and if I can remember, I'll put it on the
6:15
graphic down here. That'll get you 25% off the
6:18
registration. And Jim, you and I for the first
6:21
time are planning on being out there, will be, I'm sure, trying
6:25
to figure out how to do some podcasts maybe.
6:27
But I'm excited. It's the first time I'll be in
6:29
Berlin, second time technically in Germany.
6:33
I was in the Frankfurt Airport for about 6 hours, my way to
6:36
India. So I'm excited to go to Berlin.
6:40
And then I think maybe I'll take some time off after that
6:42
conference and maybe try to explore other parts of Europe
6:45
that I have not yet seen. What do you think, Jim?
6:48
Well, I'm going to go the week before, I'm definitely going to
6:51
Oslo because that's where my, I already booked the flight.
6:54
So I'm going to Oslo. Where I go from there, I'm not
6:57
sure yet, but what I want to do is identify her in a few
7:01
different cities. I'm thinking, you know, stick to
7:04
the Scandinavia region and meet as many of our listeners as
7:08
possible. So as the details of those
7:11
things start to formulate what cities I want to go to, things
7:15
like that, I'll be announcing that here.
7:19
Also, like you mentioned what podcasting we're going to be
7:22
doing and maybe getting involved with sessions, things like that,
7:27
we'll be announcing that here as well.
7:29
But definitely grateful already to the folks over at Cooper Coal
7:33
for collaborating with us and making this discount available.
7:38
I can say that we will not be upended with the bitter discount
7:42
code. So use ours, get out there,
7:44
register early while they still have the most attractive level
7:49
pricing. It only goes off from here.
7:52
Yeah, show support for the show, which is always appreciated.
7:54
And we're going to have Martin coming around here and I think
7:56
it's next week or the week after, but he's coming up here
7:58
pretty soon on the show. So we'll hear from more from him
8:01
and maybe some about what's planned for the conference
8:04
itself. So I'm looking forward to it.
8:05
First time in Germany and yeah, let's do it man.
8:10
Yeah, man. All right, why don't we get to
8:12
our guests? This is his 9th appearance on
8:15
the show and we were talking before we hit record here.
8:18
You know, what do you get for being, you know, on the show,
8:20
you know, 9 times. And Jimmy, you're in charge of
8:22
guest swag and I think jackets, you know, SNL does 5 time, 5
8:26
timer jackets. So we're up until like 9 timers.
8:28
Think. Andrew Shikiar is another one
8:29
who's been under a bunch of times, but this is his ninth
8:32
time. He's the founder and president
8:34
of Weave Identity. He's one of the founders of the
8:36
Digital Identity Advancement Foundation.
8:39
He's one of your team members from Team Identifriends at Fido
8:43
Feud at the Authenticate Conference earlier this or I
8:46
should say late last year, he is Ian Glazer.
8:48
Welcome back to the show, Ian. Hey guys, thanks for having me.
8:52
It's good to see you. So I got to start right off with
8:56
what was your impression of Fido feud and how that thing kind of
9:00
all came together and and when can we do it again is kind of
9:04
what I'm thinking already. But tell me what your your your
9:07
perspective was as a team member on that?
9:09
As a team member, I was not prepared for the level of
9:14
competitive energy coming from the other team, people who will
9:19
remain nameless, who may be parts of organizations.
9:22
Yeah. Megan.
9:25
Wow. Lot, lot of competitive spirit.
9:27
Let's say I feel like the tequila came out too late.
9:32
I feel like that would have helped earlier.
9:34
And I was dumbfounded by how poor my answers were across the
9:39
board. Like I was a boat anchor of
9:41
answering questions. Like absolutely useless.
9:43
So yeah. But it's super fun and I hope
9:46
you guys bring it to more places.
9:48
Yeah, I would love to figure out how to get to more conferences.
9:51
I think we're already talking about the next iteration for the
9:53
Authenticate conference, you know, later this year.
9:56
And again, it'll be in Carlsbad, so stay tuned for that one.
9:59
I was, so I helped come up with the questions and they were sent
10:04
out by the Authenticate team to all the Authenticate attendees.
10:07
And we got a bunch of responses back.
10:09
And there were some responses that clearly had, you know,
10:14
leanings one way or the other, either politically or whatever
10:18
that I had to censor. But I was surprised at some of
10:21
the answers that came out there. And you know, the the most
10:25
popular answers. I think if you watch look, if
10:27
you watch the episode, it's on YouTube.
10:28
Just search Fido feuds on our. Channel and you should.
10:30
You should and. You should, because it's really
10:31
one of the best times I've ever had at a conference.
10:33
I had so much fun hosting it, but the answers were not at all
10:37
what I expected from the identity community at large.
10:41
So I'm hopeful that we can make it bigger and better next time.
10:43
But I just had such a blast with it and you.
10:45
Know, you know, I just have a thought which is ID Pro is
10:48
releasing their skill survey questionnaire.
10:50
It's just going out now. I wonder if there's like an Idoc
10:54
ID pro team up here where we can take the questions from last
10:58
year's identity feud and actually fold some of that stuff
11:02
into the skill survey. Like we should, we should talk
11:05
about this with Heather and Andy.
11:07
Like that would be super cool. See, like just as an interesting
11:09
sort of interlude, like, huh, here's some like kind of simple
11:15
questions in theory, in theory simple questions and wow, wildly
11:19
different answers. So like that could be fun.
11:21
I think I'd be up for that. Heather or Andy, if you guys are
11:23
listening, hit me up. Let's figure out how to do it.
11:27
I look, we can make it fun. I think that's one of the fun
11:30
things about stuff like, yeah, this space is just when you
11:32
think you have it figured out some some question like this
11:35
comes up and it's like, whoa, I. Didn't even think about.
11:37
That Where did that come from? For sure.
11:40
Let's talk a little bit more about some of the stuff that's
11:41
been going on. I guess let's let's talk about
11:44
2024, kind of recap it here. I know you're at a lot of
11:46
different conferences, but how did 2024 go over all?
11:49
What do you think? Did you have any, any big sort
11:51
of identity epiphanies or I don't know, things like that?
11:56
It was it was a blur of a year. Like I still haven't recovered
12:01
in my sense of time from COVID, right?
12:03
I don't know about you guys, but like, yeah, that's still like
12:06
mushy and I feel like a lot of a lot of velocity in a lot of
12:13
different directions. I'm just not, I still don't
12:15
quite understand what's going on in the market.
12:18
But like highlights for me, the shared signals framework
12:21
interrupts. I didn't catch the one in
12:23
London. I did catch the one at Gartner
12:26
in in Dallas in December. Adeniverse, there was some stuff
12:29
there too. It was like, that's really great
12:31
to see the, the, the real push. I think right now between SSF
12:35
and Cape and Risk, that's super cool.
12:40
What else? I think there's a lot of new
12:42
energy. There's a lot of new players.
12:44
I keep learning about companies like literally every day.
12:47
It feels like it's like how many people can, you know, come into
12:50
this market and come at it with like like a real genuine energy
12:54
to like do something different. And I think that's that's
12:56
healthy and that's really good for the market.
13:01
It was good as my first full year on my own, like full
13:04
calendar year as you know, just a A1 man show to see the kinds
13:10
of companies that are out there, what they're doing, be able to
13:11
help where I could be able to just see trends.
13:14
So like it's it was a good year, but man, it went fast.
13:18
Yeah, time flies, I think when you're having fun, which
13:21
hopefully that's what's taking taking place more often than
13:24
not. Yeah, for sure.
13:25
What conferences are you planning on hitting this year
13:27
will we see at EIC? So I'll definitely be at EIC.
13:31
This year's a little bit different for me.
13:32
So I think I'm going to do for sure EIC.
13:36
Haven't been to RSA in a long time, so I'm going to go back
13:38
there. I've never done blackout.
13:40
I'm going to check that out. I've done that a couple times.
13:44
I'm probable, let's say for maybe the Gartner conferences
13:47
this year, but there's one that's not going to be on my
13:50
list and that's Identiverse this year.
13:52
Man. Well.
13:53
Look, I feel like I can miss a CIS slash identiverse once every
13:57
10 years. This is like certain time at
14:00
20th. It's my 20th anniversary.
14:01
We're going hiking like see you like.
14:04
So we'll I'll be on a trail somewhere when when the
14:07
conference going on, which it bums me out, but I'm still going
14:09
to do all of my content committee review work, which I
14:12
need to go do before Andy and Nishant beat me up.
14:16
And you know, that's the kind of the first half of the year.
14:20
And then I'm not sure really the second-half.
14:22
It's been a long time since I've been to an IWI really should
14:24
change that. And I am Jim, you just triggered
14:30
this thought. I'm going to be at one of the
14:32
Identity beers and in fact, I'm going to be at the Identity beer
14:35
next week in London. Now, I know this show won't air
14:37
until probably after that. So if you're hearing this now,
14:42
then you've already had a beer with me in London because
14:45
obviously you would go to Identity Beer in London.
14:47
Or you're about to. So I think, I think this is
14:49
going to go out on the next Monday.
14:52
So it'll be the 13th. Yeah.
14:53
All right, so then you have two days now that you're hearing
14:56
this. In three days time in Thursday,
14:59
I'll be at the identity here. And I'm I'm really excited just
15:02
to see some people that I know and I haven't seen in a while.
15:05
But more importantly, like see a whole new group of people.
15:07
I have no idea who they are and just meet them and, and
15:10
understand what they're up to. And, and I will be coming right
15:14
off the plane. So I am going to fall asleep in
15:16
a pint. It'll be great.
15:18
I'm sure it'll be photos, but I'm really excited for it.
15:20
Like it's, it's about, you know, another opportunity to, to meet
15:23
more of the community, which is going to be great.
15:25
Sounds like a lot of fun. Now your conference schedule is
15:28
pretty busy and you know you've been to these for a long time as
15:30
you've mentioned. What's something that I guess
15:34
your assessment of the scene today, how do you see IM
15:37
conferences? And have you noticed any
15:40
evolution maybe within the last couple years?
15:42
Is it, I feel like, you know, a couple years ago it was all
15:45
right, everything is zero trust. And then it was maybe before
15:48
that it was everything was blockchain and then it was, you
15:50
know, AI is kind of like the thing right now, like we see
15:53
these waves coming through. But I'm curious kind of like
15:55
what's your assessment of where I am conferences at large are
15:59
kind of at right now? So I think my take is not so
16:03
much thematic in terms of like what you know, conferences are
16:06
sort of choosing as their themes.
16:07
I think it's more about a little bit more meta, which is I think
16:12
that last year certainly was more evidence to the fact that
16:15
identity based is becoming more and more mainstream.
16:18
It's a mainstream concern for more parts of the enterprise and
16:22
certainly within the security organization.
16:25
And so one of the things we're seeing is that people that are
16:27
coming to conferences are first timers.
16:30
Four of those conferences, Identiverse, you know, Andy
16:33
always asks like who's, you know, first time is this to
16:36
Identiverse. Half the room raises their hand.
16:39
And I would posit that a third to half the people that raised
16:43
their hand for that question are new to identity.
16:46
Same basic thing happened at Gartner.
16:48
I am in Dallas in December. So we're seeing a lot of new
16:51
faces and we're seeing a lot of new beginning practitioners,
16:56
people that have done their career in security in other
16:58
places are now coming to identity.
17:00
And I think that's really great. One of the side effects is that
17:04
we're gonna, I think we've already seen this and it will
17:07
continue to happen. Most conferences are needing to
17:11
Orient to those people, right? And so there's a lot that can be
17:16
taught and yet still to we can get better at teaching it about
17:21
identity and there's always emergent topics.
17:23
That's important. I think one of the side effects
17:26
is that it's going to get harder for conferences to put more
17:32
content on that's longer and more technical.
17:37
I have a feeling just because of who's going to be there that
17:40
we're going to see a kind of different optimization for
17:43
content in the majority, like in the sort of, let's say,
17:46
mainstage identity conferences. It'll be interesting to see
17:51
where some of the, the longer term, the more difficult, the
17:54
more challenging identity problems continue to be
17:56
discussed. Obviously, IOW is one of those
17:58
kinds of places Eici think does a good job in this.
18:03
I think Authenticate is starting to find its legs and its voice
18:06
in this regard, but it'll be interesting to see that
18:08
emergence of conferences that are tending towards the more
18:11
mainstream identity topics and practitioners and then places
18:15
where people can have the harder conversations.
18:17
The, the more in depth, the more I would say nuanced
18:21
conversations about like you've got a three to five year problem
18:24
over millions of identities. What does that start to look?
18:27
Where do those conversations happen?
18:28
Who's participating and how do we how do we foster more of
18:31
that? Yeah, there's a lot of good
18:34
thoughts. I, I wanted to echo something
18:37
you said earlier when you talked about 2024 with all the, the new
18:42
vendors that you're seeing and the really there was a ton of
18:46
innovation. And when I talked to other
18:48
practitioners, they talk about things like this massive amount
18:52
of identity data that they want to be able to use to automate
18:57
provision tasks. So you go back to the nuts and
18:59
bolts, but do it in a, a way that leverages this data that
19:03
they have. And you're starting to see
19:05
solutions that actually are things that put them in control
19:09
and give them the ability to do that.
19:11
So I kind of get the sense that those are the companies that
19:17
could shape the future. We've seen it happen a couple of
19:19
times within the last 20 years where incumbents, I don't know
19:24
if they get fat, slow and lazy or, or what the case is, right?
19:28
Maybe that's a little too harsh, but young, hungry companies come
19:33
and eat their lunch. And I wonder if we're in the
19:37
reflection point for that again. I think 2024 was good evidence
19:41
that we are seeing on one hand a return to the best of platform
19:47
days that we saw an identity. We've seen it two other times. 1
19:51
was basically CA and IBM and a little bit of BMC.
19:54
It was like who's got the most complete essentially suite of
19:58
identity. We saw it again and that well
20:02
that was a moment in time. We saw it again with Oracle and
20:06
Son. Now we're seeing it again and
20:08
it's Octa sale point. Ping maybe Cyber Ark Entra like
20:15
and we have these best of sort of sweet platform type things.
20:18
But at the same time, every time we saw one of those movements
20:21
towards a best of suite or best of platform, we also saw a huge
20:26
influx of new identity vendors coming out with novel ways to
20:31
approach problems or augmenting some of those more traditional
20:37
suites to give them more innovative features without
20:39
replacing them entirely. A Better Together kind of
20:42
strategy. And I think that's what's going
20:45
to continue in 2025 is this kind of tension towards some
20:51
incumbent vendors that are getting super, super large from
20:54
a sort of footprint inside of IAM customer base as well and a
20:58
bunch of new folks coming in and saying yes, but they're missing
21:02
a bunch of things. We can't claim that we're going
21:06
to displace your 10 year old sail point installation or what
21:10
have you. But what we can do is add these
21:12
capabilities to it. That's going to help reduce your
21:15
burden, make you more efficient, get you better integrated with
21:18
security, what have you. I think there's a whole influx
21:20
of that's going to happen in 2025.
21:22
We'll start to see that in the market shortly.
21:28
So I wanted to talk about something that you published
21:31
last year, which to me, I, I loved it because it's like, I'm
21:35
going to, nobody asked for this. I'm just going to put it out
21:38
there. It's kind of a, a mini series
21:41
blog. You broke it up into a few
21:42
different parts, but the idea was you're kind of laying out
21:46
that the argument that modern identity architectures need to
21:51
be or are different. You kind of talked about almost
21:54
what I would call a reference architecture or some of the
21:58
major themes that, that make up this modern identity
22:02
architecture. Originally, I think it was 4
22:06
principles or 4 layers, if you will.
22:09
I think you're evolving it, which just goes to show, I mean,
22:14
to me, that's, that's what it should be, right?
22:16
Otherwise it's just, it's going to be thrown out there and die
22:18
on the vine. You're evolving it, but kind of
22:21
the five principles that I've heard you talk about anyway,
22:24
policy, data, orchestration, execution and events.
22:30
Did I describe that right? I mean is that?
22:33
Yeah. Let me paint the picture, which
22:35
is that I, I last year had two things I realized. 1 is that the
22:42
names of the markets that we have with an identity don't make
22:46
any sense anymore, right? Case in point, access
22:48
management. Is access management single sign
22:52
on? Is it authorization?
22:56
Isn't it the teams that field the tickets from service now
22:59
that then go build people's accounts?
23:01
Isn't that managing access? Like what the heck does the do
23:05
these words mean? And access management is not the
23:07
only one where you're like, I don't understand what's in this
23:09
bucket. Like I don't understand what the
23:11
feature boundaries are of these markets anymore.
23:13
It's super, super blurry. Part 1.
23:15
Part 2 is I don't know where the IAM market is going per SE, but
23:27
I'm starting to see sort of evidence that there's a foot
23:31
race going on towards some form of a enhanced data tier.
23:39
We can talk a little bit more about that informed by more
23:43
robust and contextual policy, powered by real time events.
23:48
And that, by the way, does not fit neatly into the identity
23:54
security bucket or any damn bucket, right?
23:56
So I'm like, OK, I've had enough of this.
23:58
I'm going to write everything out of my head that I've got
24:02
swirling around because what I think I'm seeing is an emergent
24:05
architecture for what we should be heading towards that
24:10
acknowledges the realities of an identity team.
24:13
And one of those realities is you don't replace major
24:16
constituents in your architecture very often.
24:19
Once a decade you change out your IDP, Once a decade you
24:22
change out your IGA. And if you've got different
24:27
kinds of needs that the business is bringing to you, like case in
24:29
point, you need fappy support. Your IDP may not have that.
24:33
Are you going to throw out that IDP?
24:35
Heck no, because it's doing SSO for like a gazillion things plus
24:39
all your O auth brokering. What you might do is augment it
24:43
with a specialized solution that has it.
24:45
Well, all of a sudden now you find yourself that's an identity
24:47
fabric. How the hell is this all going
24:51
to work together? And so I started just writing
24:54
like just getting it all out. And I thought it was going to be
24:59
a short piece. That was a lie I told myself.
25:03
And so one of the things that's in there is a notional reference
25:07
architecture and it talks about those five components that you
25:10
mentioned and describes the interplay between them as this
25:15
is what I think, this is where I think we're headed from an
25:17
architectural perspective. At least you write the documents
25:21
or the blogs for. I just needed to get it out of
25:26
my head right And for. You right, Ian, It's kind of
25:30
like thinking out loud. A lot of look, I am.
25:36
I've found in my career that I've only smarted in the
25:38
presence of other people. Like I need other people to
25:42
critique and push back and comment on and nudge to actually
25:48
produce anything. And so I was like, look, I'm
25:50
going to get this crap out there and then people are going to
25:53
beat it up and then someone's going to pick up a piece of this
25:56
thing and run with it. And it's going to be, it's going
25:58
to be better. Like, let's just do that.
26:01
So in some regards, yes, I wrote it for architects, I wrote it
26:04
for product managers also, like I always sort of write for
26:07
myself in that regard of like, hey, like how should I be
26:09
thinking about the next three years of where I want to take my
26:12
product? If I'm a product owner or
26:13
product manager? And if I'm in large enterprise,
26:16
like same thing. Like I've got a whole bunch of
26:19
piece parts. How the heck is this all going
26:21
to work together? And how am I going to be, how is
26:24
that architecture going to be stressed in the coming years?
26:27
And what should I, what should I think about as I keep going
26:29
forward? So I didn't write it for a
26:31
single persona. I wrote it for people that were
26:33
just genuinely curious and could find something in there that
26:38
they could use. Maybe not the whole thing,
26:39
that's fine, I just wanted to get some ideas out there.
26:42
Yeah, I I think that you hit the nail on the head in turn like
26:47
you used a great example, what is access management.
26:50
But as you think about what we have been doing for a living for
26:54
the last 20 plus years, it's identity and access management
26:57
on now you, how do you even define that?
27:01
People? You say what is access
27:04
management? But I, I think that's, that is
27:08
the under pinning or the under churn of what we're doing here,
27:14
which is these definitions are constantly changing the identity
27:17
access management, that's digital identity.
27:20
What is it now? It's an identity security.
27:23
Is that just a buzz term or is that actually something real?
27:28
And that's not a question for you.
27:29
I'm just, yeah, I'm just talking out loud.
27:34
So, so Jim, my reaction to that was like, let's focus on the
27:37
outcomes that the things that I have can have, right?
27:41
So like I've got these pieces of things in my identity
27:43
infrastructure, What outcomes can I achieve with them?
27:46
And I I've been trying to drive to like focus on the outcomes
27:49
that you want the architecture to have or your infrastructure
27:51
to have. And then let's, we can give
27:53
those things names or not, it doesn't matter.
27:56
And if you're using a tool in kind of a funny way, but it, it
27:59
scratches the itch, it reaches that outcome.
28:01
Who's to say that's wrong? Like I'm, I think we got to get
28:05
away from some of those sort of strictly bucketed market
28:08
terminology and start thinking about like, what do we need to
28:11
get done? What is the most efficient way
28:13
for me this organization, given the constraints we have, to get
28:16
that done, get that achieved? Well, let's not forget the most
28:20
important thing here. It needs to have another acronym
28:23
and it needs to conflict with something else within the
28:24
identity space. I'm not a barbarian, of course.
28:28
We need something that's utterly confusing and, you know,
28:31
conflicting, of course. It's got to have, yeah, it's got
28:35
to be catchy so that everybody can say now there's more modern
28:38
identity architecture. To be fair, Dave Birch said.
28:43
I should have called the architecture dope.
28:45
I'm like, yeah, but that's like the 80s calling and like that.
28:49
I have like control essay nightmares when you start doing
28:51
that. And so like, I don't think
28:53
that's super cool, but. Everything's just a cycle, Ian.
28:56
It's dope. And then you have belt the bell
28:58
bottom principle, right? We have to figure out how that
29:00
works. And I am, Yeah.
29:01
And then classic rock like Nirvana, which, oh, that makes
29:04
me feel old. Yeah, exactly.
29:07
That'll be cool. And it's by the time you're
29:10
like, oh, turn, turn the music down.
29:12
That's when it'll be cool again. I think we can agree classic
29:16
rock is music from the 70s. Everything else is not classic
29:21
rock. I agree with that.
29:23
I'm with you. That's that's a platform.
29:24
But here's the thing. I mean, the 70s are like a
29:27
billion years ago and it's like me in the 70s are like Oh my
29:31
God, like Glenn Miller is the classic rock of like my
29:35
grandparents generation. Like oh God, what does this mean
29:38
for me anyway? We went, we went way off with
29:42
that one. Sorry.
29:45
What's these five elements? Are they layers of this like a
29:50
reference architecture? Or is there just too much
29:53
blurring to call it layers? I refer to them as layers and
29:58
you know I sort of start with policy is the first one like
30:01
it's the backdrop, right. We are awash in our enterprises
30:04
and policy, both sort of business rules but also the
30:09
technical ones. And we know the well and
30:11
identity, right there are provisioning policies, who's
30:14
supposed to get what you know, what are the attributes we need
30:16
to set like it's the configurations in our SSO tools
30:19
like we recognize those things. But one of the realizations I
30:23
had was traditionally speaking, our identity products only could
30:29
describe policies and knew about data that they could interact
30:34
with through their execution layer.
30:36
So if I was a provisioning product, the data I knew about
30:39
which things that I had a connector for and I could write
30:42
policies about those things. In the modern era, I want to
30:47
describe a policy that says, well before you go accessing
30:51
production Azure instance, there's got to be a ServiceNow
30:55
ticket open in your name referencing the specific Azure
31:00
account that we need to go talk to.
31:02
You need to be coming from a managed product or a managed
31:04
laptop. It needs to be fully patched.
31:07
And then if all those things are true and we're not in the last
31:12
days of the quarter, then get this ephemeral role that I want
31:17
to assign to your access and let the IDP do that.
31:19
And then it will go away when things are done.
31:22
That's not the kind of policy you could write in a traditional
31:25
system. It is 100% however, the kind of
31:28
policy that if you step away from the technology, what people
31:32
want to have as outcomes, what they want to put in place in
31:35
their enterprises. But they got a jury rig it
31:38
between 5 different technologies that don't talk like this only
31:42
gets worse when you realize, well, how many components are in
31:45
my identity architecture, like in my infrastructure, how do I
31:48
coordinate that stuff? So policy is The thing is the
31:51
backdrop, right? That is the that pervasive layer
31:54
and it will be tiered. And I know that's a hard topic
32:00
in and of itself. And I don't want to make light
32:02
of it because the more I talk to people at large enterprise,
32:05
they're saying I, as an identity team, want to describe a set of
32:09
guard rails. The people that are actually
32:11
doing the identity work in terms of implementing systems that
32:15
consume identity services, they're at the edge.
32:17
They've got their own rules because they're closest to the
32:19
application. How do I make this coherent?
32:21
How do I link these things? I don't have good answers to
32:24
that yet, but I acknowledge that like this is still a place that
32:30
we can do better. And I think it's actually an
32:32
interesting opportunity legitimately for AI.
32:35
I'm just not sure how yet. Like the oh, create a policy
32:38
from natural language blah blah blah.
32:39
That's boring. I mean like real interesting use
32:42
of AII, just haven't seen it yet.
32:45
Well, I think that's like what you just described is like
32:48
Nirvana, right? It's a whole bunch of like if,
32:50
then statements and that forms your policy of when you're
32:54
allowed to do things. And I look, I say it's all due
32:56
respect. I love it.
32:58
I just don't see it happening anytime soon for even half of
33:04
the organizations out there with I am stuff.
33:06
Because it takes so long for organizations to invest in
33:10
technology, they're going to need probably a couple different
33:13
tools to do that. They're going to need good data,
33:16
right to do sort of things like that.
33:18
And you know, for every cutting edge Google, Microsoft, Apple,
33:22
TikTok, PayPal, right, whoever it may be who is really cutting
33:26
edge of I am, there are 100 a thousand times more companies
33:30
who are still getting a fax to get somebody on boarded.
33:35
Right. I mean, it's, it's, it's, it
33:37
sounds cool, it sounds neat. And then I get so I feel like
33:41
pessimistic about like, well, that's, that's 1015 years ago
33:46
realistically for, you know, most companies to aspire to
33:50
that, if they even get that far. Help me talk to you about the
33:53
ledge because I love the idea of it.
33:56
I just don't see it happening anytime soon.
33:58
So I think there's two things that might give you hope to
34:00
carry on. Like I didn't realize that we're
34:02
doing this as like it's the Wonderful Life edition of.
34:07
I am therapy with Ian. So so two things to consider. 1
34:11
is standards help us build a better identity fabric and allow
34:18
for orchestration between components.
34:21
And I think that's really important Things like shared
34:25
signals is one of those things that I think is really, really
34:28
important to help us here. Both respond more dynamically
34:33
closer to the incident, closer to whatever that that that
34:36
decision making moment is. And that that allows us to put
34:44
smaller components into our identity architecture without
34:46
upsetting the apple cart, right? So if you're, if you've got a
34:52
lot of sort of tech inertia because of whether it's on Prem
34:56
legacy that, you know, you want to migrate, but that's a five
34:59
year project and that's what we're doing and we're going to
35:01
go knock it down. Or you've just got sort of basic
35:05
components to begin with. You still have an opportunity to
35:09
add fit for purpose components, essentially capabilities.
35:15
I still think that's true. What you might lack is the
35:20
staffing to be able to operate it.
35:23
What you might lack is a seat at the table that says, hey,
35:29
security, You've got a bunch of requirements here that you keep
35:33
pushing on application teams. Like for example, they've got to
35:37
be coming from, you know, I want a full ZTNA type situation and I
35:42
want this MFA. You, you, you're doing all these
35:45
things, but all of those controls are disjoint and
35:50
they're not actually been sort of laid out together because
35:54
they have to really run in parallel in a lot of ways.
35:57
And I think this is, this is an opportunity for, to me, what I
36:01
think what Gartner would call identity first security.
36:04
They really hate the identity security term.
36:07
It's really entertaining to watch them kind of go off on
36:09
that of just the, how do we make our security controls and our
36:15
identity controls first and foremost in that sort of set of
36:18
security controls and orchestrate that to happen one
36:21
side. The other side of it is, but one
36:26
of the trends we're seeing is that people are building data
36:29
tiers that are considering more than just one flavour of data,
36:34
right? Used to be my IGA tool had admin
36:37
time data. What could I write a connector
36:39
for? Pull data back, provision back
36:42
out again, right? And our access management tool
36:45
knew about systems it was connected to.
36:47
And who attempted to create a session?
36:49
Did we create that session? When did we log that person out?
36:52
Never. The two shall meet, right?
36:54
Like totally silo data. Now we're starting to see people
36:58
say, let's bring those sets of data together, let's bring those
37:00
things together and then be able to have signal information.
37:06
So say shared shared signals framework from things like our
37:11
EDR starting to facilitate this thing where now you've actually
37:16
got the data you can reason against, even if you're writing
37:19
basic policies. The thing that I struggle with
37:22
is it is bananas. If you look at someone's
37:25
identity architecture, each component in their architecture,
37:29
their IGA, their Pam, their SSO, who knows what else they've got
37:33
in there. They're specialized MFA, each
37:35
one of them has their own data repository.
37:37
I guarantee you that like 20 to 30% of the data in each one of
37:41
those things is duplicated with one other component, if not all
37:45
of them. How on earth are we supposed to
37:48
operate this monster if we're not all reading from the same
37:51
page? And so one of the tenants I say
37:54
in modern I am is a unified data tier that everything in the
37:59
fabric can pull from and use at least as a system of record and
38:04
bring proper data management practitioners to this
38:08
conversation as opposed to us I am people being like, cool, I
38:12
know what I'm doing down here in the data tier.
38:14
You don't. You just don't, right?
38:16
Data governance is a real thing. Let's bring those practitioners
38:19
into this story. All right, let me try to swing
38:22
it back to the positive side because you sparked a couple
38:24
thoughts in my head. And one is, is there a catch up
38:27
point here or a level skip or whatever we want to call it
38:32
where we say, OK, yeah, maybe we missed the boat on IGA, you
38:37
know, over the last 10 years. But if we adopt this mindset,
38:41
this modern architecture, this modern identity kind of
38:43
thinking, is there an opportunity for organizations
38:47
who maybe missed that boat to skip ahead to, hey, you know
38:50
what, we've got some new tools that are coming out.
38:52
We're better at our data. Maybe we're more
38:53
organizationally sound when it comes to, you know, how we
38:56
collect that kind of stuff and store it.
38:58
Maybe I don't need all those other components that at that
39:00
point might be considered more legacy.
39:02
Is there an opportunity for that?
39:03
I think there is an opportunity. I think it's around taking the
39:07
heart where you can, where is most impactful 0 standing
39:13
privilege. Leave aside the plumbing, leave
39:15
aside all the things that I actually talked about in in
39:17
those blog pieces and focus on where do we have the opportunity
39:23
to use ephemeral access? And can we describe what the
39:28
appropriate access is for a certain job function?
39:30
So a production instance, break glass scenario.
39:34
What do developers need in stage?
39:35
What do they need in test and where systems and increasingly
39:40
especially our cloud ones, do facilitate ephemeral access.
39:43
So you get something assigned at the beginning of your session
39:46
and when that session's over, it goes away.
39:49
Holding tight to that as a goal I think will have sort of knock
39:57
on effects of like, OK, cool, I can do that in these
40:00
environments. Now, how do I better describe
40:03
the rules of the game here? Where should my control points
40:06
be? I think it leads to better
40:08
conversations in places that don't facilitate ZSP as easily
40:14
or efemoral axis as easily. That's places to then take a
40:17
really sharp eye and look at it and say, is this the place where
40:22
we need to do more role engineering, more QA, Rs, what
40:27
have you And really like focus the scope of where we're doing
40:30
more heavyweight traditional I am and start to find pieces
40:35
critical, critical systems, cloud systems, what have you to
40:39
actually try to bite off some of the ZSP concepts and start to
40:43
develop those that muscle there. And I think there really is an
40:46
opportunity for kind of a catch up there because we're now
40:50
increasingly finding high impact systems that do facilitate it.
40:53
That means you don't have to bring all the tools of the last
40:56
decade to bear. You actually can do this
40:58
differently. Lighter weight, easier to audit,
41:01
more effective. I can see where you broke this
41:05
into multiple blogs for instance, than just one blog and
41:09
layout. I'm threatening to glue them all
41:12
back together and make like an e-book that I don't know I'll
41:15
print out for my mom or something.
41:16
I'm not sure what I'm doing. So you talked about policy.
41:20
I had a bunch of follow up questions, but I think we should
41:23
keep pace when it's the data talked about data lake earlier I
41:29
even had just a foundational question of like, OK, what is
41:33
identity data? You actually started a whole
41:36
piece around what is identity data?
41:41
I have always kind of felt like there's the black and the white
41:45
and then there's the Gray in between.
41:47
There's information like transactions that Ian did on
41:52
Amazon, those are not identity data.
41:55
There's Ian's credentials to log into Amazon, that's identity
42:00
data. Then there's a whole bunch of
42:02
stuff in between like billing address and other things that
42:07
maybe they're application specific, but they could
42:11
contribute to, oh, you know, Ian lives in this part of the world
42:15
and things like that. We can make some identity
42:17
decision based on it. What I'm finding as I talked to
42:23
more identity practitioners is that they want to solve their
42:28
business specific identity and access issues with data that
42:35
matters to them. You know, if they're, you know,
42:38
say in the insurance industry or something like that, maybe
42:42
there's some data elements that come from other systems that
42:46
they can make access decisions on.
42:50
Do you see that's, I kind of feel like that is enabling that
42:54
type of approach is something that technology vendors are
43:01
starting to say, all right, well, there's all these
43:03
different use cases that are specific to not only industry,
43:07
but specific to clients. We're not going to try to solve
43:11
them all. We're going to give you the
43:12
platform to build it from. And it's not only maybe it's not
43:15
even like a technology or product thing to solve.
43:20
Maybe it's, you know, it's just building a platform.
43:24
So I, I guess like turning all that into a question is what
43:28
were you talking about with what were you?
43:30
Thinking what the what? The heck were you thinking?
43:35
So, so two things. One is I wrote about this not in
43:38
the same series, but a post which is a probably bad idea,
43:44
which talks about workforce identity data platforms.
43:46
Get that in a SEC in the consumer world.
43:49
And I'm not talking about consumer, I am just, I'm talking
43:50
about in the consumer world you have data platforms called
43:54
customer data platforms, CDPS. It's its own market and it
43:58
consumes all manner of data, everything from click stream
44:02
analytics on websites to e-mail open statistics to self provided
44:09
preference information. You know, I'm into these
44:11
colours, these styles, what have you.
44:13
All of that goes into ACDP and arguably all of that then is
44:20
used to build better customer journeys and experiences.
44:24
And so if you are on a major e-commerce site, you are very
44:31
much have information that is now in ACDP somewhere.
44:34
The credential that you used to log in, let's say it's a social
44:38
credential, that's also interesting.
44:39
So in my mind, I've always had the attitude of the data that is
44:44
associated to you, the consumer. CDPS are designed to do these
44:48
things from a data management perspective and then the ability
44:51
to reason across it and make decisions across it and then
44:54
affect changing it. How you authenticate to This
44:57
site is a thin wedge of that information that an identity
45:02
team is responsible for, but they should be the data
45:05
custodians for the entire CDP. They don't own the CRM like that
45:08
would be crazy to think about that.
45:10
But the notion of ACDP that takes all these different kinds
45:13
of data in terms of different velocities of data, structures
45:17
of data, and puts them together so that you can actually build a
45:19
better customer experience. That's really cool.
45:22
So when I took that idea, I was like, what if we did that for
45:24
workforce? This is a horrible idea.
45:27
And I kept going through like how horrible of an idea is.
45:29
Like I'm going to throw what training classes you've got in
45:32
there and I'm going to throw your your 360 surveys.
45:38
Like I'm gonna throw everything in that pot.
45:40
And not dinner. I'm sorry if I'm interrupting,
45:43
but are you talking about like taking copies of the training
45:46
data and throwing it in your lake or you're just pointing to
45:49
it? Well, so here's the beautiful
45:50
thing is that, and This is why we need more data management
45:54
professionals in conversations about any practitioners is that
45:58
things like lake house architectures can do reference
46:00
without copy for massive data sets.
46:03
Like I didn't really learn this until I was at Salesforce for a
46:06
couple of years and looking at how they're building their CDP
46:09
and the ability to do 0 copy. But on the, you know, petabytes
46:13
of data, you're like, holy crap, like blew my mind.
46:16
I got my start as an Oracle sales engineer.
46:20
Like good old relational tables and Oracle seven man, the world
46:23
is a really different place. And if you're listening to this
46:27
and you take one thing from this is go find your data management
46:29
practitioners because they're fascinating and the things they
46:32
can do are fascinating. So I think it's reference, not
46:34
copy, but you may copy for a variety of reasons.
46:38
One of which guys, you know, this, how much in the, the
46:42
customers that you have and the work that you do is dealing with
46:45
data quality issues and you find those data quality issues and
46:49
what are you left to do? Go to the upstream system and be
46:51
like, Hey, can you change this? Cause your use of like street is
46:56
just all baffled and weird and it's causing all sorts of
46:58
problems that that's not a conversation that often goes
47:02
well. So it's left to the identity
47:03
team while they're marshalling data to fix these things.
47:06
So there's actually some legitimate reason why you do
47:09
want to copy some of this stuff so you can improve its data
47:11
quality. And so long way around, very
47:17
long way around, I think there is an opportunity to bring
47:24
together a variety of different kinds of information, whether
47:26
it's copy or reference, that's the data management team's
47:29
decision. But whether that is workforce
47:32
and workforce related training information, those kinds of
47:35
things, plus why don't we bring in other kinds of information?
47:39
And that leads to the conversation of like, should
47:41
this thing be its own? Should it be its own identity
47:43
like, or is it part of your security data?
47:45
Like closer to things like IP intelligence, other threat
47:49
information, zero trust, telemetry, things like that.
47:53
And now identity has its components in there that it can
47:55
reason across. I don't.
47:57
Know that's going to be. Some of it's going to be log
48:00
data, some of it's going to be resident in some system for
48:05
sure. Some of it's going to be third
48:06
party data that you can only write you only get through an
48:10
API. Yeah, all of those things.
48:13
And, and this is the important part, I've talked to
48:16
organizations who have built these things either inside of
48:18
their security data lakes or on their own.
48:22
They are a rare breed of organization, right to, you
48:26
know, the person who's like, I'm barely holding it down as it is.
48:29
I'm not building a data lake for this identity type.
48:31
Are you kidding? I think what we're going to see,
48:33
and the market is showing us this, is that vendors are coming
48:36
now and saying we can at least combine different kinds of
48:38
identity data, admin time data, runtime data, event time data,
48:42
and give you a better wider view of the playing field, the
48:47
ability to affect controls better.
48:49
So I think there's this democratization going on.
48:51
And yeah, some set of companies are going to go out there and
48:54
build these things. We're starting to see vendors
48:58
here saying we're doing that for you, but no one's going to buy
49:00
that. No one is buying one of these
49:02
things. What they're buying is I need to
49:04
be better about my IGA practices.
49:07
I need to be better about my standing access.
49:09
Oh, by the way, the thing that's powering it is this really cool
49:12
data tier. Don't worry about it right now.
49:15
In a couple years, you'll be ready to start doing other
49:18
things with that. That's the hope I have for the
49:19
market. So the third layer was
49:24
orchestration and you know, it's, it's kind of funny because
49:28
I was reading through this, I kept thinking back to Strata
49:35
Strata's, a company that does a lot of what you're talking
49:38
about, like policy, orchestration and other types of
49:42
orchestration. I, I do think a lot of these
49:45
terms is kind of funny because I think policy could be these
49:48
technical policies or they could be your infosec policy.
49:52
Data could be the not when you talk about who has access to
49:57
what, it's the, what the data is, the what that you have
50:00
access to. But there's also this whole
50:03
identity data concept. Orchestration could be the
50:07
orchestration of, you know, these identity systems and you
50:11
have legacy identity systems, you have modern identity
50:14
systems. How do you hook them all up so
50:16
you can achieve full integration without just wiping out
50:20
everything every time you want to do something new?
50:23
But it also could be orchestration of work flows.
50:27
But you're talking about, I think more the first type that I
50:30
talked about, right, which is orchestrating modern and legacy
50:35
identity systems. I would think about it this way
50:38
is so you've got this data tier, you then need to evaluate and
50:43
take action based on either changes in it or discoveries in
50:46
that information. And so you, that could be
50:50
everything from a classic provisioning policy to AITSM
50:56
ticket ticket, classic workflow ticket flow could also be a hey,
51:03
I'm the IDP, we are using XYZMFA provider.
51:07
I need you to go actually challenge this user, right?
51:10
So I think there's a different, lots of different kinds of
51:12
orchestration. It doesn't need to be massively
51:14
complex. It can be, but I actually think
51:17
a lot of it is just the basics of how do I evaluate policy
51:20
based on some changes in information and data?
51:24
And then what do I need to go tell to go do something like
51:27
what's my execution layer that I want to go reach out to and
51:31
nudge it along to take an action?
51:34
So it can start very, very simple.
51:35
Most people have these things in their IGH tools.
51:38
In fact, I would argue they all do.
51:39
But you even have it in your ID PS in your Pam systems.
51:43
That's just an acknowledgement that the real value in a lot of
51:46
our systems comes from that orchestration layer.
51:48
As complicated or as simplistic as it is, that's the thing that
51:52
really is doing the heavy lifting.
51:54
So you have OK, we went policy data orchestration executioned.
52:01
I think the execution is kind of the these domains of identity.
52:08
I am technologies. It's the single signal platform,
52:11
it's the IGA PAN. Is that right?
52:14
Not quite, but it's close. Think of it as the execution
52:17
layer is the interface between your IAM architecture and the
52:20
applications that you actually want to go manage access with
52:22
it. And so that is your provisioning
52:25
connector lives in the execution layer, your SSO configuration
52:29
effectively like the brokerage of a SAML flow that's an
52:33
execution layer example we used to pay for stuff in that layer
52:38
like we used to buy connectors. Like that's crazy to me.
52:40
Like the execution layer should be free.
52:42
And increasingly, as you have integration platforms as a
52:48
service, that's not quite the right the abbreviation, but
52:53
essentially there's whole businesses out there.
52:55
They're like, we can basically give you a unified API service
52:58
over everything you got out there.
52:59
So I can trigger create user or an update record anywhere you
53:03
want. That's not fun.
53:05
Like that's not a the IAM business anymore.
53:07
Like you shouldn't be paying for that.
53:09
But it's where identity, the orchestration meets the real
53:12
world. That's where the rubber hits the
53:14
road. OK.
53:17
The last one that you had, and I don't think this was part of the
53:20
original framework of layers was events.
53:24
And I think you kind of tease us a little bit in the beginning
53:27
talking about how we're moving toward more of a real time event
53:31
type of environment, so recognizing things as they're
53:35
happening and some of those things are going to be attacks,
53:40
right? Well yes, and think about it
53:42
this way. Identity systems traditionally
53:44
have is a piano with about 5 keys, join, move, leave, log in
53:50
or verify, log out. But no one ever plays the log
53:53
out key like that never happens. So we have 4 * 4 notes that we
53:56
can play. We are not going to be the most
53:58
popular keyboardist in the town, right?
54:02
Our ability to affect controls was significantly limited by the
54:06
events that we could actually instrument join, move, leave,
54:10
log in or verify event time. Identity totally changes that
54:16
because now what we can say is look, an application out there
54:20
says, hey, I have my own inbuilt transactional fraud system built
54:25
into me and I just terminated a user session because it was
54:29
super weird. Basically shared signals
54:32
framework is Twitter for apps. It's like, hey, I'm just going
54:35
to shout into the void. I did a thing.
54:37
I terminated this session for this data subject because that
54:40
was weird. I don't know what's going on.
54:43
Maybe someone out there wants to take an action about that, but I
54:45
don't have to know about it. I, as the application don't have
54:48
to know about who my IDP is or my IGA system.
54:50
I simply say I terminated a session because of broad.
54:54
Now I can pull that information in and say, oh, now what do I
54:57
want to do if I see these kinds of things?
54:59
Let's go find the data subject. Let's go tell the IDP, terminate
55:02
all their sessions. Meanwhile, let's go change maybe
55:06
more dynamically. There is zero trust from a
55:08
network perspective. Let's sequester them.
55:10
Let's do these other things like it gives us this opportunity to
55:13
bring our controls to bear in more places than just join,
55:17
movely verify. That's hugely important.
55:20
I mean, more than that, I think it's an opportunity to be almost
55:23
creative with events and what are things that we can do with,
55:28
you know, the data that we have available to us?
55:29
What what are things we haven't thought of or maybe couldn't do
55:32
before, right? I think this is a real
55:33
opportunity to say, hey, you know, this, this shouting into
55:36
the void thing is great. What if you had a very specific
55:40
app or function or whatever it is that's looking for this very
55:42
specific thing. It's available now.
55:45
It is. Yes.
55:46
And the other side, it is the things that generate signals.
55:49
Now, if you're the kind of organization that has data
55:53
scientists on board and AI scientists, you can actually
55:56
start to build models that look at this data tier and be like,
55:58
hey, I know something weird. I'm going to emit a signal.
56:00
And now we can take action on that immediately.
56:02
Versus I'm waiting for my HR purse, HR trigger to add a new
56:06
user to the system. Like it's, it's really
56:09
interesting what these things open up.
56:11
By the way, I feel like we're late to the game, right?
56:13
Security has had much more dynamic sets of controls, not
56:17
limited to I only do something when the user boots their
56:20
laptop, right? Welcome to the party identity.
56:23
Like now we can actually work in concert with security controls
56:26
because we can act on the same cadence, we can act with the
56:28
same velocity they do. That's hugely important.
56:33
Yeah, I kind of feel like that's the the idea that we're going
56:36
for with identity security. It's just hard to put a
56:39
definition around identity security abuse.
56:42
Anytime you're talking about identity, it gets into
56:44
something. Oh yeah, that's identity
56:46
security. So.
56:49
So Ian, with this framework, where do you take it from here?
56:53
I mean, are you going to continue to evangelize this or
56:58
are you looking for the community to kind of start to
57:01
pick it up? And you've done so many things,
57:05
by the way, like you started a lot of organizations.
57:08
Like did you just give me the what have you done for us lately
57:10
question? I just want to check.
57:12
I didn't want it to sound that way, but.
57:14
Ian, you're doing way too much. You're giving us stuff we're not
57:17
asking for, man. Come on.
57:20
So, oh God. All right, we'll get it back on
57:24
rails. All right, so here's what I want
57:26
to do. Like I, I do want to keep
57:27
talking about this. Like next week I'm going to go
57:29
visit an enterprise and talk unpack some of these thoughts a
57:32
little bit more. This is a absolutely leading
57:34
edge organization in terms of identity and more.
57:37
It's about conversations of just like this is how I'm thinking
57:41
about it. How are you thinking about it?
57:42
Like it's just going to refine my own thinking.
57:44
I think it's really beneficial. Maybe I can help them too.
57:46
I really hope so. One of the things that I want to
57:50
do from this is I'm really enamored with this data tier
57:53
thing. And the more I talk to people
57:54
that have done it and it brought real data practitioners into the
57:58
story and why they're doing it. Like it's fascinating to me.
58:05
And one of the things that I've started talking about is I, this
58:10
may be me tilting in a windmill. I think we need to put some in
58:13
classic relational database terms, standardized views so
58:18
that everyone, whether it's a third party product or home
58:21
grown, can implement these views such that for a core set of
58:24
objects, maybe user and entitlement and system, I can
58:28
get data out no matter what the back end is, no matter whether
58:31
it's third party provided or it's first party provided.
58:34
Because that can reduce the cost of switching between vendors.
58:39
It can reduce the ability to the challenge to do bake offs
58:43
between technologies. It can facilitate people
58:46
bringing their own models or buying models to look at this
58:49
data to find interesting things about them.
58:52
So I'm, I'm a little bit on this, what I'm lovingly calling
58:55
Oids open IAM data schema, those of you who've been around for a
58:59
long time. And OID is an object identifier
59:02
famous in Ldapland. And this came from a realization
59:07
that the last time we really as an industry standardized data
59:11
objects at rest was like inet org person and Edu person.
59:16
And so with love in my heart, I'm like, you know what, let's
59:18
do a throwback name here. But I'm kicking that
59:22
conversation off with a bunch of folks and I'm getting a lot of
59:25
feedback and I'll it's really interesting seeing the questions
59:28
and the challenges to it. But that's like in my To Do List
59:32
to the next couple of months. And then we'll see where it
59:36
leads. It may all just crash and burn,
59:38
but someone may take like a ember of the remnants of it and
59:42
go use it to start a fire and that'll be great.
59:44
So let's let's hope that happens.
59:47
Yeah, I'm, I'm thinking Oids and now I, I'm thinking about the
59:51
old, I think it was Domino's Pizza, the Noid.
59:53
Do you remember? That, yeah, void the Noid, Yeah,
59:55
so I did. I did think about that.
59:57
We're all of similar age on that one.
59:59
I'll let you explain it to the listeners what the Noid was and
1:00:03
put that in the show links like the Wikipedia article for Noid.
1:00:07
The 80s were a weird time for commercials.
1:00:10
They just put it that way. Yeah.
1:00:14
I look, there's so much to unpack here.
1:00:16
And here's what I would recommend is like we're grabbing
1:00:18
our show notes, the, the link to the articles that you that
1:00:21
you've written here. I would read those definitely.
1:00:25
And then I would listen to this or maybe vice versa, depending
1:00:27
which, whichever one comes first, because I think there's a
1:00:30
lot to impact here. And I love the discussion that
1:00:32
you started and I and I think you've turned some of this as
1:00:35
well into some talks maybe given like Identiverse, maybe it was
1:00:37
Gartner, I can't remember which one where you've started to kind
1:00:41
of posit this. And I love this idea of theory
1:00:43
crafting, right. Hey, here's some ideas we have
1:00:47
to solve some of the problems that we're seeing.
1:00:49
What do we think Many has a better than one.
1:00:51
So I would definitely encourage people to to check it out.
1:00:54
I also want to ask about one thing I noticed on your LinkedIn
1:00:56
when I was, you know, doing some cyber stalking of you before you
1:00:59
joined the show. You recently became a faculty
1:01:03
member for IONS. Yep, the Irons Institute.
1:01:05
Yeah. So tell me about this.
1:01:07
First of all, not everyone may be familiar.
1:01:08
What is irons and then what are you teaching?
1:01:10
Yes, faculty is an interesting word too.
1:01:13
So Irons Institute has been around for for quite some time
1:01:16
and I knew it as a place where really kick ass security
1:01:20
practitioners would teach classes, could do consulting
1:01:25
engagements, could actually just engage directly with an
1:01:27
enterprise to answer a question. And a while ago a friend of mine
1:01:33
who's one of those absolute kick ass security folk was like, Hey,
1:01:37
you should totally become a faculty member.
1:01:39
Let me do the intro. And I went through the
1:01:41
evaluation process and I got to say it's the opportunity to do
1:01:46
calls with enterprise customers who are having challenges and
1:01:50
just be able to see if I can help.
1:01:52
It kind of brought me back to my Burton days and like, I love it.
1:01:55
It's like a way just to kind of play stump the chump.
1:01:58
Like they've got a rando question, which I love doing and
1:02:01
like seeing if I can help. But also it was just destiny
1:02:04
because it's literally my institute, so obviously I have
1:02:06
to be a member of it. So, you know, there's that.
1:02:09
That's actually a pretty good segue.
1:02:11
You just kind of kind of say, hey, this is this is my thing.
1:02:14
Yeah, take it over now. Yeah, I'm not charging you for
1:02:16
likeness fees. It's cool.
1:02:18
I like the idea of the whole stump to chump, you know, trying
1:02:20
to trick the professioner, you know, ask the questions and
1:02:23
hopefully, you know, there's answers.
1:02:24
If there's not, let's figure it out together.
1:02:26
I think those are the I think those are the one you learn the
1:02:28
most. It's like, OK, yeah, I don't
1:02:29
know about that. I mean, let me go look at that
1:02:30
because I feel like whether you've been in in any industry
1:02:33
or any topic, right, there's always something new to learn.
1:02:36
And I know Jim, you're very fond of saying sharpening the saw.
1:02:40
So there's. If you want to learn something,
1:02:42
teach it. Yeah, If you want to be really
1:02:45
know something, put yourself in a position to teach someone else
1:02:48
about it, and then you'll know whether you know it or not.
1:02:51
So I gave a in as sparks my my member from today.
1:02:54
I actually gave a class today to a bunch of auditors on IM1O1,
1:02:58
right. What should auditors be looking
1:03:00
at from an editing perspective? So sorry for the IM teams who
1:03:04
are now dealing with smarter auditors.
1:03:06
You know, there are people too, but the idea was like, hey, you
1:03:11
know what, let's level set here. What is that we're doing?
1:03:14
And I, and it give me an opportunity to get on soapboxes
1:03:16
like, Hey, auditors, stop telling your organizations to
1:03:19
change your password every 90 days.
1:03:20
Like that's, that's old guidance from like 5-10 years or seven
1:03:24
years ago. Now probably some of that area,
1:03:26
you know, time to get with it, man.
1:03:28
You know, so it gives me an opportunity to maybe do a little
1:03:31
influencing on some of the areas that I think, you know,
1:03:33
organizationally things do, but I, I enjoy doing that kind of
1:03:36
stuff. You know, I'm, look, I'm not a
1:03:37
technical expert in deep and everything, but I know certain
1:03:41
things and I do enjoy the teaching aspect of it.
1:03:43
I think you've got the opportunity to share knowledge
1:03:46
and you know, maybe we do with this podcast or other things.
1:03:49
Go for it, it's great. All right, I have AI have a
1:03:54
lighter note question. Uh oh.
1:03:56
If you could teach anything, doesn't have to be identity
1:03:59
related, what would you teach? Does this have to be something
1:04:04
that I know today or I could learn and then teach it?
1:04:07
Oh, you know what? That's a good spin.
1:04:10
Either one, that's fine. So I, I would love to teach
1:04:16
music theory. I don't know really the first
1:04:20
thing about it. I mean, I played an instrument
1:04:22
junior high in high school and what have you.
1:04:24
But I'd I'd love to teach as it Wood Forest me to learn about
1:04:29
music theory and like how the construction of music comes
1:04:34
about and what are the sort of basic tenants for it.
1:04:37
If it's something I do know, I don't really know much.
1:04:45
I don't know. I think you want to fall back on
1:04:46
the like, let's just go with the I'm going to learn musically and
1:04:48
I'm going to teach it. I like that.
1:04:50
Oh, that's good, Jim. What would you teach if you
1:04:51
could teach anything? So I've been able to think about
1:04:54
this question for about an hour because you.
1:04:57
I spoke on I spoke on all of this at the last minute here.
1:04:59
Yeah. And so I originally thought
1:05:01
like, oh, you can't just go and say identity and access
1:05:04
management vendor developing identity strategy, that's going
1:05:07
to be way too boring. But then I started thinking
1:05:10
about my hobbies and what would I teach, What would I take of my
1:05:14
hobbies and turn into a college course?
1:05:17
And I thought, no, that would ruin my hobby.
1:05:19
I'd much rather just work a little bit longer and keep my
1:05:22
hobbies, you know, pure. So I'm going to go with identity
1:05:27
and access management. Oh, that is such a blame.
1:05:29
And I was expecting something baseball, or anyway, I thought
1:05:33
of money laundering, you know, something that's a little more
1:05:35
interesting. Those two hobbies I don't want
1:05:38
to ruin. OK, well, all right, let's see.
1:05:42
You know, you got me. I was originally going to go
1:05:45
down a video game track, but I wish I could teach people to
1:05:48
play guitar because I have this guitar that has been sitting in
1:05:51
the corner of my office for a couple years now, and I can't do
1:05:55
a darn thing with it. I have.
1:05:58
Now, to be fair, I have not really invested the time into it
1:06:01
and I'm always looking for shortcuts.
1:06:02
But I wish I could teach guitar because that would mean that I
1:06:06
know how to play the guitar. Yeah.
1:06:09
So there you go. You got me on the music theory
1:06:12
one because I, I, you know, I, I do like music.
1:06:14
I, I have no musical talent whatsoever other than the Jingle
1:06:18
for this show. That is about as creative as
1:06:20
I've gotten. Pretty like that.
1:06:23
But I do listen to a lot of music.
1:06:24
I challenge myself to try to listen to something new every
1:06:26
week. So I'm constantly kind of
1:06:28
evaluating and OK, I like that. I don't like that, so I don't
1:06:31
become one. Of those people, like, can you
1:06:32
put what you listened to last week in the show notes to this
1:06:34
one? Because like, I'm always looking
1:06:35
for new stuff. I mean, there's so much, man.
1:06:38
I'll tell you what I have gotten into recently and kind of
1:06:41
recently. It's not new I would say but the
1:06:45
orb and massive attack so. The. 90s. 80s, nineties, yeah.
1:06:51
Electronic music a little more casual and chill so you know if
1:06:55
you're looking for good listens, go back and listen that stuff
1:06:58
it's. Not a lot of work.
1:07:00
I mean, some of those songs have so many different layers to them
1:07:04
that I'm constantly picking up. Oh, I never heard that before.
1:07:07
And so I'm constantly. Orbs Perpetual Dawn isn't their
1:07:11
sort of their famous track. It is.
1:07:13
And they I think they just re released a new version, actually
1:07:15
a new video just hit YouTube of all places.
1:07:17
And yeah, so there's there's a lot to discover there.
1:07:21
And I think, you know, I don't want to be one of those people
1:07:23
where I'm like, you know, 60 or 70 and I stopped listening to
1:07:27
music after a 90s grunge, you know, so I want to like learn
1:07:31
new stuff. So I'm with you, all right.
1:07:33
We've been talking for an hour and 5 minutes.
1:07:36
It always goes by so quickly with you, Ian, So I appreciate
1:07:39
it. By the way, I want to say 1
1:07:41
noted thing. Jeff teaching a class about
1:07:43
identity and access management would not be boring.
1:07:46
This is a fantastic topic. We just talked about it for an
1:07:49
hour. Was it boring?
1:07:51
It's only podcasts that are boring that are about I am all
1:07:56
right, all those leaving on high note.
1:07:58
We'll Costanza this thing. Ian, thank you so much for
1:08:01
joining us. Jim, as always, thanks for your
1:08:02
time. I will have links in our show
1:08:04
notes to pretty much everything we've talked about.
1:08:06
Go read the stuff that Ian has been posting.
1:08:08
Really, it's kind of thought provoking stuff.
1:08:10
And this is how these conversations and these thoughts
1:08:13
are what leads to what's next and what you'll see in products
1:08:17
and services and eventually those things trickle into
1:08:20
organizations. So I would definitely recommend
1:08:22
that and I did find the link for the avoid the Noid.
1:08:25
So you'll see a Wikipedia article for that as well.
1:08:27
So with that, we'll go ahead and leave it for this week.
1:08:30
You can find us on the web, IDC, podcast.com, visit Ian's
1:08:34
website, weaveidentity.com. Even though it won't let me
1:08:37
access it, go ahead. I'm sure other people will not
1:08:40
have the same problem that I have.
1:08:43
All right, Thanks everyone for watching and or listening and
1:08:46
we'll talk with you all in the next one.
1:08:49
You've been listening to Identity at the Center.
1:08:53
We hope you've enjoyed the show. Make sure to like, rate and
1:08:57
review, and we'll be back soon. But in the meantime, hit the
1:09:00
website at identity@thecenter.com.
1:09:04
See you next time on Identity at the Center.