Latest / Identity at the Center / #328 - Continuous Identity with Sean O’Dentity

Transcript

#328 - Continuous Identity with Sean O’Dentity · Identity at the Center

0:00
The biggest thing is to have a story and know your data because
0:06
you could go invest tons of money in this.
0:08
And if your data is a swampy, you're going to have a swamp.
0:13
When I say know your data, clean data, marshalled data.
0:18
And I know that sounds like a very, a very pipe dream, but get
0:22
your identity data right first. What does that mean?
0:25
So how many companies onboard people without doing
0:28
verification or proofing in the workforce?
0:31
A lot. They take HTM systems work for
0:35
it. Like, yeah, I approve the person
0:36
they faxed me over the I nines and the the thought license
0:39
thing, manual entry. I mean, let's face it, it's out.
0:44
It's out. It's public knowledge that there
0:47
are some countries that are coming after domestically and
0:52
they're faking. They're faking documents.
0:54
Jenna, I is a thing. It's very easy to fake stuff
0:56
now, right? So getting that right at the
0:59
entry point makes everything else clean and simple.
1:03
But if you get it wrong at the entry point, you create a
1:05
fractured web of just distributed nonsensory.
1:08
And yes, you can trademark that word and use it royalty free.
1:11
But you want to create line segments like you want to have
1:15
event data, event action. But if you have is, is this
1:21
Jeff? I don't know.
1:24
But if you give Jeff the wrong entitlement, security risk, if
1:27
you give, if you onboard Jeff twice now I have 18 accounts to
1:31
worry about South, in a way, if you get your data right, you can
1:35
decrease your spend across the board on Pam, IGA systems,
1:40
account management. You might you won't have account
1:41
drift. You won't have account sprawl,
1:43
real sprawl. All those are real problems.
1:46
They always start at the base foundation of your data.
1:49
Like know your data. This is identity at the center
1:59
if it has anything to do with IAM.
2:03
This is the go to podcast now your hosts Jim McDonald and Jeff
2:09
Steadman. Welcome to the Identity of the
2:17
Center podcast. I'm Jeff.
2:18
And hey, you're not Jim. Who are you, stranger?
2:22
Not Jim. No, you're Sean Odell, your
2:25
identity guy at Disney. You're going to be my Co host
2:28
today. Jim is on assignment as we'd
2:30
like to stay in the press business.
2:31
So he's got the the night off. You and I are going to record
2:34
something here. So I'm going to have to swear
2:37
you in because we're going to have to make sure that this is
2:39
official. So I'm going to have you repeat
2:41
after me, Sean. I state your name.
2:44
State my name Sean Odell. Of my own free will, I'm here on
2:49
the Identity Center Podcast. Of my own free will am here on
2:52
the identity. Center Podcast.
2:54
The views expressed here are my own and do not necessarily
2:58
reflect that of my employer. The views expressed here on my
3:02
own and do not necessarily reflect that of my employer.
3:05
You got it. It's official.
3:06
Welcome to the Identity Center Podcast, Sean again.
3:10
Good to be back on again. So it's been about a year since
3:14
you were here with us. You know, we're just talking
3:15
here. Record Button one year and one
3:17
day since our last episode went live.
3:20
And I'm not going to make you relive your origin story.
3:23
I'll point people back to episode 255.
3:25
That was back in January to 2024.
3:28
This is going to be episode I think 328.
3:31
So we've been rolling along here.
3:33
I guess give me a little bit of update before we get along.
3:36
Anything new in your world that you want to share?
3:40
I have AI know I have two kids versus 1.
3:43
So I have a Kelly Ray named after, you know, Ray because
3:50
something is Luke named after obviously Luke Skywalker new
3:55
stuff at work, but just more responsibility doing more doing
3:58
more cool stuff. But other than that, I mean
4:01
taking more of the role in the industry, working more closely
4:04
with the likes of like Atoll, Toshiba, Inglazer, doors opening
4:10
a lot First off and O&OIDF. So I'm I'm pretty excited about
4:13
it, honestly. And it's like why we're talking
4:15
to you about this exact topic is because things are starting to
4:19
all meld together. So I thought this would be a
4:20
good topic to to bring to the, the, the greater population of
4:23
people. So a lot of is changing, but
4:26
it's for a lot of good stuff. Well, I'm glad to have you back.
4:29
You and I have actually kept in touch since that last episode
4:32
and I've gone back and forth with texts and messages and a
4:35
bunch of different stuff. I will say I'm going to give you
4:39
credit because you have the coolest background of, I think
4:44
any of the guests that we've had.
4:45
I know a lot of people like mine, but yours is next level
4:48
with all the Star Wars stuff. Give me a quick tour because it
4:51
looks like over your left shoulder is maybe some
4:55
lightsabers, and then you've got some figurines and statues and
4:59
things like that. So I have these are the dark
5:02
side sabers over here you can't see.
5:04
But in my office there's the light sides over there.
5:06
Then I have like a Mando closet and I have an Armory, but top
5:13
shelf is just more like statues of you can't see about.
5:17
Oh, I'm going to wiggle my camera if you're OK with that.
5:19
Sure, there's like Ahsoka and Ray and Ahsoka, but then the the
5:24
middle one is more of like my my clone wars army.
5:27
Then that's like the the traditional Jedi.
5:29
And the bottom shelf is the the dark side, but can't go that low
5:34
because I mean, unless you're OK with this.
5:36
So let's see how it turns out. But there's the dark side stuff.
5:38
You have the royal guard and more stuff.
5:40
But I've always wanted to and since I was a kid, like love
5:45
collecting. I have all, all the old, old
5:47
toys. But I have a very, very
5:51
forgiving wife who allows me to do this.
5:52
So I love having it. It's just, it's my thing.
5:55
It's it's my advice. You know, it's, it's pretty cool
5:59
and definitely forgiving. A partner is always helpful with
6:02
that. I also hear some younglings or
6:04
padawans rolling around the background.
6:06
So they're they've started their training early, I assume.
6:10
They have they're earning their both their IAM certificates and
6:14
their their paddle one training certificates at the same time
6:17
so. Sounds pretty happy about that
6:21
one too. The last time we were met in
6:25
person, I guess would have been probably in the fall and you and
6:28
I were at Identiverse. And are you going to be at
6:30
Identiverse again this year? Yep.
6:33
OK. And I assume you're going to
6:35
probably be looking to get on the schedule, do some things.
6:38
I know this stuff haven't announced yet, but you know, I'm
6:40
sure it'll be a fun. So people who missed it last
6:43
time you were nice enough to ask me to host a panel around shared
6:46
signals framework and Cape and I thought it went real well.
6:50
We have we had a full room. I think a lot of good questions
6:52
come out of it so. Yeah, it, it was, it was enough
6:55
to wear the Q&A, the Q&A format that that we did like you, you
7:00
asked, you asked great seating questions, but then it just took
7:02
off and you know, shirts didn't you know, the shirts didn't,
7:07
didn't hurt either. But I think the format went very
7:10
well. I submitted for another panel.
7:12
So if it, if it gets picked up, you know who I'm going to call
7:16
to come moderate. So I, I can't wait.
7:18
So we'll see if it gets if it gets picked up, but hopefully so
7:21
well. I'm happy to do it.
7:23
So you let me know and I'll be there for you.
7:24
I'm going to actually going to be at EIC for the first time
7:28
2025 in Berlin. Have you been to EIC before?
7:31
European Identity and Cloud Conference now a card to travel
7:35
across. The the big ocean when you have
7:38
a three month old right now, can't, can't we do that?
7:40
Yeah, I can see that. It's also expensive too.
7:42
So yeah, we're figuring that one out.
7:44
But Jim and I are planning on being out there, give people a
7:46
heads up. It's like, hey, we're going to
7:47
be out there in May. We've got a discount code.
7:49
So if you're going to be at EIC 2025, it's May 6th to the 9th in
7:53
Berlin. I've mentioned some previous
7:55
podcast, my first time going to Berlin, so I'm very excited for
7:57
that. And I'm probably going to hit
7:59
Europe at large around. They're not sure yet what I'm
8:02
going to be doing, but I know that like Amsterdam is on the
8:05
table, maybe Denmark, somewhere in that area, maybe somewhere
8:09
like Munich. So still figure it out.
8:11
But you can show support for the show.
8:13
If you want to register, we've got discount code.
8:15
It'll be on our website right on the homepage.
8:17
It'll also be in the show notes. But if you use the code ID AC25
8:21
MKO, that gets you 25% off. So be sure to use our discount,
8:26
take advantage of free savings, doesn't cost you anything and
8:29
just show support for the podcast here.
8:31
So I appreciate that if you guys.
8:33
I know you're AI, know you're a foodie.
8:35
I am Europe unmatched. The food is amazing there.
8:41
I'm looking forward to the food. I think that's the one thing
8:44
that is is always unique when you go somewhere new and if
8:49
there's local or regional type stuff.
8:50
And we actually had Martin Cooper on here last couple weeks
8:54
ago, I think it was at this point.
8:55
And so I asked him some questions about that.
8:56
So if you've got food suggestions, hit me up on
8:58
LinkedIn, especially in the Berlin area, because I'll be
9:00
looking for stuff to do while I'm there for that, that EIC
9:04
week. So yes, thank you for bringing
9:05
that up. I had some of the best carbonara
9:09
in Berlin, really, which is on me.
9:11
I don't even understand how. But then I went to Italy and had
9:14
like, oh, just kiss like. Yeah, stand that.
9:18
You know, hold my jacket here while I make you real Carbonara.
9:23
I introduced you as an identity guy at Disney.
9:26
Help me understand what an identity guy does.
9:28
Maybe just kind of level set and kind of provide some context
9:30
around sort of your background. So I my official title is Senior
9:36
Staff Security Engineer for consumer and workforce.
9:40
I am because identity and security should should be
9:43
planted into into one domain. I think most companies are.
9:46
Most companies are going that way anyways.
9:50
I, I do, I traverse the consumer.
9:52
I am domain at Disney. I work a lot with a lot of you
9:56
may know him, Chuck Mortimer, you know, you did a lot, a lot
9:58
of stuff with Oauth and on the workforce side.
10:01
I every global brand you can think of at Disney, I have my
10:05
hands in the pie of I am pick the pick the flavor of domain
10:09
you want to talk about provisioning, LCMSSOO, factor
10:13
management, all of it's there. So my scope is a global, so I
10:18
don't really have like fix this one use case.
10:21
It's more like here's this problem for 100,000 people go
10:25
after it. So it's it's a lot of fun.
10:27
Yeah, every day is different. Learning a lot that identity is
10:33
the lifeblood of the business and it all starts there.
10:36
It's very it's a very identity is intertwined in almost
10:40
everything you do at at a company.
10:41
So it's very tangential and it's also important to not get wrong.
10:47
Yeah, kind of I would say it's at the center, right.
10:50
We call the podcast for that that reason and I don't know
10:53
about you. I did.
10:53
Not say that out loud, but it is at the center.
10:55
You're correct, yes. Cha Ching that trademark you
10:58
have to give me a nickel every time you say it.
11:01
I, I have seen at least, you know, from my clients in my day
11:04
job and things like that and other people I've talked to
11:06
where it seems like at Denny's having a little bit of a moment
11:09
here where the recognition I think is starting to get to what
11:14
I would call the appropriate levels even within an
11:16
organization, say, oh, this is, this is something we can't skimp
11:19
on or wait on. We've got to get it right.
11:21
And it could be for any number of reasons, right?
11:23
It could be security, it could be appliance or risk type
11:25
things, or it could even just be, hey, you know, we, we need a
11:27
better user experience for our customers, right?
11:30
Things like that. Do you see that same sort of
11:33
trends in your travels and discussions with other folks in
11:36
the space? I.
11:37
Do I used to always think consumer identity got all the
11:40
bang for the buck, all the money because of the user experience,
11:42
But it's, it's traversing into workforce.
11:46
A lot of the stuff that you're seeing like in the, in the
11:49
consumer world, you have like consumer data platforms.
11:52
You want to know the 360 view, you want to have the 360° view
11:55
of your customer to know how you upsell market, cross market,
11:58
make money, right? Same concept in workforce.
12:01
You want to know what your workers doing, why they're doing
12:04
it. How's it more efficient?
12:05
Like if you can drive down login times 10X, that's efficiency.
12:09
If you login less, you can be more productive.
12:11
And you know, everyone's talking about AI now you're going to
12:14
want, you have to know what a worker's doing because if you
12:16
start offloading work to a, to a bot, get to understand, is it
12:21
ethical for that bot to do what that, what that person's doing?
12:24
But AI is a different conversation.
12:25
Not why not, not why we're here. But I do, I do see it very much
12:28
so. And across many travels I had
12:32
with a lot of friends who work in different companies, they're
12:34
seeing the same thing. They they really are.
12:36
So the last time you were here, we talked about some new, at
12:39
least to me at the time, a year ago, we talked about shared
12:42
signals framework, SSF and continuous access evaluation
12:47
protocol. I got it right.
12:48
Tape is how we pronounce it. CAEP.
12:50
I want to take a stab at sort of summarizing it real quick and
12:53
then you can tell me if I got it right.
12:54
Because they feel this is an area that people are still kind
12:56
of trying to get their heads around and, and understand.
12:59
But I see this as potentially a next wave that we're going to
13:02
see here. And I am, but let me start with
13:04
SSF. It's basically a standardized
13:06
messaging system that allows different security platforms to
13:10
share threat information in real time.
13:12
And I guess maybe not necessarily threat information,
13:14
but share information in real time.
13:17
Stated stated a little bit a little bit differently.
13:20
It doesn't have to be a security platform or you just do
13:22
platforms, but you're you're you're you're spot on and I.
13:26
Guess what, it is it similar to what we feel like?
13:29
Think of maybe like a service bus or a messaging bus.
13:34
The messaging bus is how you orchestrate it.
13:36
The framework is how you talk the same language because like
13:39
to get to 0 trust people gotta talk.
13:41
So if you speak Japanese and I speak English, I gotta
13:43
translate, right? But as long as you speak the
13:45
same framework, it works out. So if I, if you're company A and
13:49
I'm, and I'm company BI, send you these three things and these
13:52
three things together, you know, oh, these things map.
13:54
So we're, we're good to go. So the messaging bus is more
13:57
about how you orchestrate it. The framework is more about how
14:00
you talk the same OK. And then Cape or continuous
14:04
access evaluation profile is basically leveraging SSFI.
14:08
Got the thumbs up. Thank you.
14:10
To continuously monitor user access, user sessions, things
14:14
like that. And then because it's an event,
14:17
you're able to do maybe more dynamic things like, you know,
14:20
access controls or just sharing that, hey, this particular thing
14:24
happened and you share that on using SSF, other things can pick
14:29
up on that and do what they want with it or not, right?
14:33
Spot on. Very session based, very very
14:36
user heavy. You it is.
14:39
It is a a layer on the framework.
14:41
You're correct. Cape can be done with more than
14:43
just users though. It's identities.
14:44
So you can do different things like groups of people like or or
14:49
units. You can do people, you can do IP
14:51
addresses, you can even do machines if you wanted to.
14:54
Not there yet, but you are spot on about it.
14:57
You are absolutely correct. So Jim and I had this
14:59
conversation a little bit. I'm going to throw something out
15:01
there that we we haven't really had a chance to talk about, but
15:04
is can non humans have an identity or is identity reserved
15:11
for humans going to? Channel my inner Dean here.
15:17
Non humans can have an identity, but not every non human identity
15:22
should be backed by a carbon based identity.
15:25
I like that description actually.
15:26
That's pretty good because I, I feel like there's a delineation
15:28
between identity and account or whatever thing you want to call
15:34
the access vehicle of how you're going to get to something.
15:37
That's the way I look at it. OK, we're going to stop there
15:39
because I'm, I'm winning now because that means you're, you
15:42
agree with me and not Jim. So sorry, Jim, I.
15:46
Am Jim. I'm acting as.
15:49
The other thing that I've noticed is Interop events seem
15:52
to be picking up for SSF and and I guess maybe Cape by extension
15:57
is part of that. There was one at the Gartner
15:59
conference late last year that I know like Mike Kaiser was, was a
16:02
part of. And I guess tell me about these
16:07
interop events like what are these things and help other
16:11
people, normal people understand what what value they provide to
16:16
framework developments like like SSF and Cape?
16:19
So the interoperability events happened at Gartner.
16:21
I mean that they're huge. There's one happening in London
16:23
as well. The last one was it was at
16:25
Dallas, huge turn out. I mean it was magnanimous here.
16:32
So Mike Kaiser was there from Sail Point Otto Toshi Begwale,
16:36
the the godfather of Cape, he works for, he works for signal
16:40
ease. He was there, he was blown away
16:44
by how many, how many companies and how many vendors are have
16:47
have adopted in our in our promoting.
16:48
And it was again immense. Like I know I'm like touting it,
16:52
but it was it was like when he gave me the readout, I was just
16:55
like, wow, this many people. It was enough so that like,
16:57
because I'm also a side note, I'm also a Co chair of the
17:01
shared channels working group along with Shane Neil from Cisco
17:06
and and and Otto. We had to be very careful about
17:09
how we made our made SSF backwards compatible to not
17:13
break implementers. So the the interoperability
17:17
event is there to to really understand how companies can
17:20
share security information and demonstrate how like vendors
17:25
that support it can help you achieve zero trust principles.
17:29
Because again, the way the way you that's where the link zero
17:33
trust and like Cape ish things is we're her talk about is you
17:37
never trust. You always verify continuous
17:40
identity is the foundation of a zero trust environment.
17:43
And how you get to that is you got to talk, you got to
17:45
communicate. How do you communicate shared
17:47
signals, right? Cape events ride on a searchable
17:50
framework. So that interop event is how do
17:52
you share things like session revoked, assurance level change,
17:56
token claims change, session presented, session established
18:00
or a risk level change. Those are all Cape events.
18:04
But if I send you an event, Jeff, it says, hey, this guy,
18:07
Sean looks suspicious. You're like, oh, I have Sean on
18:10
my system. I got a Nope, Sean's gone.
18:13
But that's hard to do because you'd have an API.
18:16
You have an API. How do you, oh, you speak this
18:18
language? I speak this language.
18:19
Whereas Cape gives you the mechanism whereas SSF gives you
18:24
the highway to say how do I how do I communicate?
18:27
And so I know you weren't able to make the one in Dallas
18:31
because you were introducing, you know, new members of the
18:34
family to you, to your side. What I guess take me behind the
18:37
curtains if you can. Like, do you know what takes
18:38
place these things? Is it basically a bunch of
18:40
people talking? Is there like demonstrations
18:42
actually? You're right.
18:44
It it's demonstrated. So they actually, they actually
18:45
get a room there and they set up tables and they actually
18:48
showcase like here's how this works.
18:50
Like no smoke and mirrors, like actual hands on keyboard.
18:53
Like watch this Cisco interrupted with vendor company
18:58
A for example. And I'll use Otto and Shane, for
19:00
example. Cisco and Signal can talk,
19:02
right? Or like to be very agnostic
19:05
here, Microsoft Octa can talk, Octa and Bing can talk.
19:08
I'm not saying they can or they can't, but just it's that kind
19:09
of that kind of that kind of that kind of a situation.
19:12
So company A can do it at Company B.
19:14
It doesn't mean that there's there's not political or legal
19:18
barriers, but you've demonstrated the ability that I
19:20
can share with it with another company.
19:23
But then legally can you do that?
19:25
That's a whole different conversation, but it's a, it's a
19:27
really hands on interrupt to showcase that we can we can
19:31
actually share, we can actually share information.
19:33
So it's actually really, really, really awesome.
19:37
I'm I'm convinced that this is really important and I don't
19:41
know if people really understand it yet because it probably won't
19:45
manifest to normal. I am people like me into
19:50
products probably for a little while still yet while products
19:54
are being updated or developed to take advantage of it.
19:56
But the idea here of having sort of this shared language and
20:00
being able to take the best out of different products and
20:04
combine them in new ways that we just haven't been able to do
20:07
before because everything's been so siloed and proprietary.
20:12
I, I don't, I don't, I, I don't want to sell this short because
20:15
I think this is really a really exciting development and it's
20:18
going to be open up a lot of eyes for people.
20:20
Am I drinking the Kool-aid too much or are you with me?
20:24
I'm thumbs up. I'm right with you.
20:27
It, it is going to breed in Iran because not everyone, not every
20:31
company is going to be all in this vendor.
20:34
They're going to be, I have a suite of vendors or I have a
20:36
suite and it's going to force standards to work because I, I,
20:41
I keep saying this standards will set you free if you adopt A
20:45
standard, it works, right? So.
20:49
On the timeline of kind of where we're at as a industry, where do
20:54
you see us now? Because I feel like maybe we're
20:57
on the bubble of maybe another era or another phase or a coming
21:02
phase that might be coming through.
21:03
I am but help me understand, like where do you see I am today
21:07
for people? It's a very loaded question.
21:11
It's actually a good question too.
21:13
I think where we're at right now is we're in a mixture of like an
21:16
admin and runtime. So we're still very much like
21:20
offline back office happens before login.
21:23
And then there's the runtime that can't ever go down.
21:25
Like I got a login, I have SSO, I need access management like
21:29
and the admin pieces are more like your IGA stuff like your,
21:32
your provisioning, your role management, your access request,
21:34
your certifications, pamish things, you know, PIM
21:39
privileged, any privileged, any management things.
21:41
So it's like an awakening like the calm before the storm.
21:45
But I right now we're still very much the between runtime and
21:48
admin time. And it's starting to creep into
21:53
efficiency of work and even security because stay full
21:58
entitlements that last for years as you, as you travel between
22:01
jobs or job titles in your where you're employed.
22:06
You shouldn't have access to things if you, if you, if you
22:08
change job roles. But right now that's on a that's
22:11
on your new hire manager to say, oh, Sean left his job A to job B
22:16
go revoke roles or entitlements. We both know that never happens
22:19
at companies. It it just doesn't happen
22:21
because they just don't have the cycles right.
22:24
Or they forget, right? Humans involved.
22:25
Humans are kind of human, as I like to kind of put it.
22:29
It's. Go ahead.
22:31
No, we're we're very much at that pre Renaissance layer.
22:35
Like it's like, OK, we got to do something.
22:37
We don't know what that something is yet, but it's
22:38
something. I like that, that description
22:41
though, of admin and runtime, because I think that maybe helps
22:44
people understand. It's like, yeah, admin, right?
22:46
It's people doing stuff and they're doing it to the best of
22:49
their ability, I hope, right, Or at least best effort, and you're
22:53
only as fast as the humans can do it.
22:56
This idea of runtime though, I feel like it's like this is
23:00
where the puck is going and hockey and we're skating towards
23:03
it. So this idea of runtime is I'm
23:06
assuming things like automation and more data-driven or maybe
23:12
it's more event driven, right? And leveraging things like SSF
23:15
and Cape and other things like that.
23:17
Is that fair? Are they just?
23:18
If I say something is event driven or data-driven, are they
23:21
the same thing? So one quick, one quick
23:26
terminology change there. The runtime is more of like
23:28
where we're at now like login, OK, moving towards event driven,
23:32
you're correct. And now your question is, is it
23:35
a vent driven or deed driven? The answer is yes.
23:37
Chicken and the egg carton, the horse, peanut butter and Jelly,
23:40
which, which one you put on 1st? We are very much there.
23:43
We're, we're most companies that I, that I'm, that I have people
23:49
that I'm friends with in, they're doing it.
23:52
They just don't know they're doing it or they're doing it in
23:54
pockets like, you know, oh, I had to side project this thing.
23:57
They're like, oh, I have this data feed coming in.
24:00
You're doing it, you just don't know it.
24:01
So if you're making, if you're making decisions off of data and
24:05
taking actions on it, you're, you're essentially doing event
24:08
driven IAM, which is AKA continuous.
24:12
Any management or whatever garden wants to call it.
24:14
I Ian and I Ian Glazer and I will talk like they will fix the
24:18
terminology. We're just going to call it one
24:20
of those two things and hopefully it sticks.
24:21
And if it doesn't, great, we'll we'll we'll pick a new buzzword,
24:23
right. But you were right, you need
24:27
data to drive the vents, but in order to get data, you need
24:31
events. So chicken on the egg, right?
24:34
So that unlocks a lot of things like signal processing,
24:38
continuous auditing. It changes.
24:39
It's going to change governance as, as, as we know it, which is
24:41
a different conversation because that's hours of talk there.
24:46
It's going to change the dating management, session management,
24:48
access management. And it gets you to like zero
24:51
trust, but the real zero trust, not like network access, but
24:55
like essentially moving more towards a zero trust foundation.
24:59
But I can't trust enough that with change, auditing,
25:03
governance, it's all going to change.
25:06
But again, slowly, bits and pieces, not, not, not not all at
25:09
once, But it is coming. It is like the the golden age of
25:13
I am the Renaissance. It's like, hey, I am figured
25:15
out. Oh, this is event driven
25:17
architecture. This is awesome.
25:18
Let's do this. And it's like it is.
25:21
Like we just invented like I don't know, the the calculator
25:24
or something like that. It's like it's going to get a
25:27
lot better, but I, I tend to be a little more conservative when
25:31
I think timelines and I am because while certainly
25:36
organizations might be on cutting edge, I think for every
25:38
cutting edge organization there's probably 100 or 1000
25:42
that are not right. They're still trying to get the
25:45
basics done. They're still maybe accepting a
25:47
fax and saying here's my onboarding form, right to get
25:50
onboarded or they're just now getting into multi factor
25:53
authentication and maybe they're forced to do it because of
25:55
either cyber risk or an event or things like that.
25:58
As much as I like where this is going, I tend to be more
26:03
conservative from a timeline perspective.
26:05
So I'm going to throw out there something and say, OK, is this
26:08
like for my, from my perspective, I think this is a 5
26:11
to 10 year sort of migration or shift from runtime to event
26:18
driven for the majority of I would call organizations that
26:22
are doing something for identity to really kind of do it.
26:26
I don't think it is like this is going to happen this year or
26:29
next year. I think those are going to be
26:31
leading edge. They're going to be early
26:33
adopters. They're going to be
26:35
organizations that are well funded and really have their
26:37
sort of identity act together. Is that a fair?
26:41
And I don't wanna call it a criticism 'cause I don't think
26:43
it really is criticism. It's just, hey, this is the
26:44
timing of the real world. But is that a fair, I guess,
26:48
observation that I'm having? Or should I readjust that's
26:50
amount? If only money grew on trees,
26:54
right? The fact is businesses operate
26:59
on a budget and everyone's budget is different.
27:02
I can see the the mom and pop shops going slower.
27:05
I can see the companies that do Billings and trillions of
27:09
dollars in revenue to have more risk will adopt this faster.
27:12
It's going to sound crazy, but it's going to be it's going to
27:14
be a risk based approach. Because if you look at it from
27:17
from that aspect, you're going to want to secure something that
27:20
makes $14 million a minute. Whereas if you're securing a
27:24
flower shop that brings in $100 revenue a year, no.
27:28
Well, if. You're doing a flower shop at
27:30
$100 a year Maybe. Maybe.
27:32
It's not really a shop, it's more of a an Etsy or a hobby.
27:35
At that point. But.
27:37
But you, you make, you make a, you make a solid point where I
27:40
don't think it's 5:00 to 10:00. I, I, I, I think it's three to
27:42
five, I think. Organizations will move that
27:44
quickly on to this. I think they're not gonna have a
27:47
choice because of the advent of technology and how fast it's
27:50
going where even if they can't move it that fast.
27:58
I mean, the what I'm seeing and I am right now is the startup
28:01
community is rampant. They're they're taken off.
28:05
There's a lot of start-ups out of that are going to offer this
28:07
as a service and it's going to work, do you think?
28:12
Organizations get pulled along by their vendors.
28:16
Or do organizations push their vendors in this case?
28:19
Depends on depends on the organization, but some people
28:22
like the tell me what you want me to do approach.
28:24
Some people like to actually drive a vendor.
28:25
I mean, I've, I've, I've seen both in my tenure across my
28:30
career. I think you're going to get the
28:32
early adopters that are going to push the vendors to, to, to play
28:35
with standards like Cape and SSF.
28:38
But like every company's in in it, every company has businesses
28:41
just to make money. But if you, if you're marketing
28:44
to like the Fortune 50s makes sense.
28:50
The Fortune 5 hundreds again, you, you, you hit a nail on the
28:54
head. Is it data or event companies
28:57
that know their data that can invest in their data will drive
29:01
this because they're gonna, they're gonna, they're gonna
29:02
drive the vendors and be like, here's how I wanna talk to you.
29:05
I wanna talk to you using these standards Then.
29:08
And then at that point, this sounds very draconian, but
29:12
things like your ID, PS your Pam systems and your IG assistant
29:15
become, become appliances, but they're important appliances.
29:17
It's just, it's not gonna be like a converged solution.
29:20
You're not gonna have like, oh, vendor A does all my stuff that
29:23
I, that chip is sale. I think get my opinion again it
29:27
it can work for some companies but not all.
29:30
We kind of hit where I was thinking here is, is it is a
29:33
data problem to solve for a lot of organizations just don't have
29:38
good data management or maybe they're collecting, they haven't
29:41
done anything with it. So now we're back to that
29:43
chicken egg of events, generating data data, being able
29:48
to generate more events, right? Things like that in the real
29:51
world, what do you see as like, OK, you need these things to
29:57
really think about this next step when it goes to event
30:00
driven, is it go get your data. If you're if you know you're
30:03
talking to the the millions of identity, the center viewers and
30:08
listeners and they're like Sean told me to go do this so we can
30:12
set up for the next stage, which is this what is this?
30:16
And then, then. The biggest thing is to have a
30:20
story and know your data because you could go invest tons of
30:26
money in this. And if your data is just swampy,
30:28
you're going to have a swamp. When I say know your data, clean
30:35
data, Marshall data. And I know that sounds like a
30:38
very a very pipe dream, but get your identity data right first.
30:43
And what does that mean? So how many companies onboard
30:46
people without doing verification or proofing in the
30:49
workforce? A lot they take HCM systems work
30:54
for it. Like, yeah, I approve the person
30:55
they faxed me over the I nines and the the thought license
30:59
thing, manual entry. I mean, let's face it, it's out.
31:04
It's out. It's public knowledge that there
31:06
are some countries that are coming after domestically and
31:11
they're faking. They're faking documents.
31:13
Jen, AI is a thing. It's very easy to fake stuff
31:16
now, right? So getting that right at the
31:19
entry point makes everything else clean and simple.
31:23
But if you get it wrong at the entry point, you create a
31:26
fractured web of just distributed nonsensory.
31:28
And yes, you can trademark that word and use it royalty free.
31:32
But you want to create line segments like you want to have
31:36
event data, event action. But if you have is, is this
31:42
Jeff? I don't know.
31:45
But if you give Jeff the wrong entitlement, security risk, if
31:47
you give, if you onboard Jeff twice now I have 18 accounts to
31:52
worry about South in a way, if you get your data right, you can
31:55
decrease your spend across the board on Pam, IGA systems,
32:00
account management. You won't have, you won't have
32:01
account drift. You won't have account sprawl,
32:03
real sprawl. All those are real problems.
32:06
They always start at the base foundation of your data.
32:10
Like know your data when I say know it intimately, know it like
32:16
know how bad it is. Like, do you accept people to
32:21
come in with like my last name's?
32:22
Oh, really? Why?
32:26
Oh, it's an apostrophe. Oh, I hate when that happens,
32:28
right. You don't want to do the, the
32:30
ampersand NBSP calling. No, I don't want to do that.
32:32
That's just what is that? We're just going to scrap that,
32:34
right. So, and, and, and this is, this
32:37
is, this is a different topic, but when you get to continuous
32:39
management, you're, you're providing building blocks for an
32:43
architecture that has real benefits for security, privacy
32:45
and user experience. And you're gonna, you're
32:48
evaluating context and data signals.
32:50
Context is supplementary to data signals.
32:52
So getting your, you know, going identity first as a, as a dream
32:57
for most companies. But how you on board and who you
33:02
are as a person are two different things.
33:05
Prove to me you are who you say you are through a vetted process
33:08
using identity document verification like talking
33:12
licenses, passports, etcetera. Once I have that and you are who
33:16
you say you are, the rest of it is just a relationship and it's
33:19
an it's an engagement and it's just consent.
33:22
Jeff wants to work for company A.
33:23
Do you consent her? Do you consent to share this
33:26
information with me? Absolutely.
33:27
Great. This is you.
33:29
I'm good to go. I know that you now now
33:33
contextual signals. Jeff always logs in using a
33:38
device from a location to these to these places.
33:41
It feels very Orwellian, but it's not.
33:44
It's meant to keep you safe and your company safe because it's
33:48
it's a problem right now. The government's passing
33:50
sweeping regulation to where they're putting the onus on the
33:53
companies to keep their data safe because we're a target.
33:57
Every company, that every company is a target and goes
34:00
back down to never trust, always verify.
34:03
That's the beginning. Continuous identity is the
34:05
foundation of a zero trust environment.
34:08
As much context you can pull into your, your, your data
34:11
fabric if you will, like you pulling stuff like your ITSM
34:14
systems, your CMDB systems, your change management, JIRA, GitHub,
34:21
anything you can hang off of an identity that says this is what
34:25
Jeff normally does and it's good.
34:28
You can derive what's normal, what's not normal, because at
34:30
the end they're not that no one should be tracking what you're
34:32
doing. It's more of that one time you
34:36
accept that push, you're like, oh, I shouldn't have done that.
34:39
That's the time. That's what you don't want to
34:42
happen. So the this this idea of data
34:48
hygiene and knowing your data really strikes me as a business
34:52
process problem to solve for, you know, you're a lot of times
34:57
identity teams are not the ones generating the data.
35:01
And I'll go beyond things like authentication and
35:03
authorization, things like that, right?
35:04
Might be application owners who really are the ones who are, you
35:07
know, generating authorization data.
35:09
It might be like you mentioned that, you know, HR teams or
35:11
Hirs. However, your organization works
35:13
for people data. Maybe there's not even a source
35:16
for non humans. Maybe it's well, service
35:19
accounts to live in our Active Directory and it is what it is.
35:22
What are some tips for having this this this discussion with
35:28
non-technical people to help them understand that we need to
35:32
fix the business process so we can fix the data problem?
35:36
Or. Part of the data problem I
35:37
should say. I think I already alluded to it.
35:40
You have to have proofing and verification at the gate whether
35:44
you do it at hiring, interview or onboarding.
35:51
A lot of times the person you interview for the job who shows
35:53
up may not be the same person. That's the security aspect mind,
35:57
I think. So you're talking about business
35:58
process if you really look at it from identity first, not access
36:04
first standpoint. If you flip the model and say
36:08
Jeff wants to work in a company, prove to me who you are Jeff.
36:12
OK, thank you. Appreciate that.
36:13
Now you have an engagement with a company I want, I want to
36:16
employ Jeff a company a awesome identity drives it all.
36:21
So I now can provision to your HRHIS systems and seamless user
36:26
experience. You can do, let's use the word
36:29
birthright provisioning, which I personally don't like because
36:31
it's, again, you need good data for this.
36:34
So if you hang, hang off this great identity data and you have
36:38
supplemental HRHRISHCM data attribution, you can start
36:42
driving things like if Jeff's the manager in finance, he gets
36:47
access to these things. But vice versa, if I still know
36:51
you're Jeff and you're always Jeff and you say who you are and
36:54
you change jobs automation or it's like, oh, there's another
36:59
manager had to onboard Jeff again because they got a new job
37:01
title and you know. Or maybe converted from
37:05
contractor to Employee or vice? Versa, let's go there yeah, I'm
37:08
glad you went there a lot a lot, a lot of times it's I can't wait
37:12
for process of the fire. I'm just going to circumvent him
37:15
and go that way. This would stop that because it
37:18
wouldn't allow that data to come into the ecosystem and create
37:22
that. No more of a line, just a
37:24
fractured web. Because now it's like there's
37:26
three Jeffs, who are you here? You're the same person.
37:30
But it's like, why do I need to have nine accounts, 15 profiles
37:35
and SAS application 12245? Just really annoying, right?
37:40
I cannot stress enough that your data is the most important piece
37:45
of this because without without your data, the event stuff is
37:47
just it's more problematic, honestly.
37:51
So let's talk about that. Data because I feel like what
37:55
the, you know, we're going to find data everywhere.
37:57
Like everything is generating data.
37:59
Is this a situation where we need to do maybe some internal
38:02
cleansing or centralization of it?
38:04
And I think, you know, things like the data lakes have been
38:07
and probably still are popular. Do you dump everything into sort
38:10
of like, hey, here is a central repository of everything that we
38:14
want our identity team to do stuff with?
38:18
Maybe it's a SIM, or maybe it's something custom.
38:21
How? Much of that I don't know.
38:24
Cleansing or centralization of data really needs to take place
38:27
for this to work. Can I get away with having 810 a
38:31
hundred different data sources? In which order do you want me to
38:36
answer those questions? Whatever.
38:37
Order makes the most sense to make make sense of my
38:39
gobbledygook, so. Ian and I talked about this ad
38:42
nauseam there. There's a need for a schema.
38:47
So that'll be a different conversation for hopefully a
38:49
different, a different podcast. But let's just pretend that
38:53
there's one out there. The the reason why you want to
38:56
centralized this, it's for taxonomy and single pane of
39:03
glass. A lot of companies want to get
39:06
to the question who has access to what, why and when and who
39:10
did it. That is the easiest question to
39:13
state and the hardest to answer. I'm sure, Jeff, in your travels
39:15
with your client, just like, yeah, everyone wants to get to
39:18
that. Yeah.
39:20
The. Angel's usually like IGA can do
39:22
this. No I can't.
39:23
It can, but I can do. Parts of it, but not everything.
39:26
Exactly. So how many sources do you pull
39:30
in? That is a very that is a very
39:32
subjective answer. I would start with separating
39:35
identity from HR because the two are not the two are not the same
39:42
and they are, they should be treated mutually exclusive.
39:44
Because here's a use case for you.
39:48
I may have pre hire activity that I have to do that won't put
39:52
me into an HR system. So how do you, how do you get
39:55
access to those applications? You have to do it from an IAM
39:57
context. I got, I got to give you some of
39:59
the log in with to access some systems, but you're not, you're
40:02
not an HR backed identity yet. You're just like you're Jeff.
40:06
You're a guest. I'm sorry for the company.
40:08
Yeah, you're you're interested. So that's the first concept is
40:13
like, get that right. And that comes back down to how
40:15
do you, how do you ingest that? And that that's a four hour
40:18
conversation. But again, you could, you could
40:20
do proofing verification. You could just have a form Excel
40:23
spreadsheet. Don't recommend any of that
40:24
stuff. It's bad.
40:26
But going identity first solves a lot of a lot of this problem
40:32
because this isn't, this isn't a knock on anything in HR.
40:36
It's just they don't, they don't fed it like you get a request
40:40
and it's like, hey, I'm a hiring manager, hire this person.
40:42
Cool, safe. They don't.
40:45
They don't check. Well, I don't.
40:47
I don't, I don't know if that's fair because I, I feel like, I
40:51
feel like our HR people out there do do things like I nines
40:55
at least in the US, right? Kind of initial verification,
40:58
no? They do I'm.
40:59
With you and that it doesn't take place past that first day.
41:04
Correct. But let's let's play your your
41:05
contract a full time employee case again, I'm converting.
41:11
There's take your work days, your SA, PS, your bubble, your,
41:14
your, your Bamboo software, the stringent, the stringent
41:20
security model you have to have an IAM does not exist in HR
41:22
systems because that's getting you into their system to do
41:25
their stuff. But if your HR systems get
41:28
access to things you've opened up, you'll open up can of worms.
41:33
And to your point, it's not fair to say all HR, all HR employees
41:39
are all HR workers. Don't don't don't validate or
41:42
Fact Check it but talk to practitioners.
41:48
They I'm not. It's not a hill I'll die on to
41:51
say it's 100% I think. But it's.
41:53
Not zero. It's not.
41:54
Definitely not zero. I think what typically happens
41:56
is especially in this world of changing from a contractor to an
42:01
employee, that is sometimes very iffy because a lot of
42:05
organizations don't do a good job of tracking their
42:07
contractors being with all they're not employees, vendors,
42:10
partners, etcetera. People have access to different
42:12
things. I think it's gotten better over
42:14
the last five years or so as I've been in the consulting biz
42:18
for about 9 years now. I've I've seen it improved, but
42:21
it's still not where it needs to be.
42:24
So my question now becomes, OK, now we're talking about a
42:27
business process and I keep going back to the business
42:29
process of this and say, OK, whose responsibility is it to
42:32
let HR know that, oh, this is a contractor converting to a full
42:38
time employee or vice versa? Is it the manager?
42:42
Is it the contractor themselves? But what is like, I, I think
42:46
there's a, a shared responsibility here for people
42:49
who are responsible or have accountability for identity or
42:54
person data to have a business process that makes sense and is
42:59
livable the real world. And I see organizations do it a
43:02
lot of different ways. I don't necessarily I, I don't
43:03
think there's like a right way and a wrong, the wrong way to do
43:06
it is to not do anything. There's a lot of right ways you
43:09
could do it. And I guess you know that that
43:12
idea of business process seems like it's such an important part
43:17
of this data problem. Yeah, you're right.
43:18
I I think it's, it's more about shared responsibility and I
43:22
think when you combine HR teams and managers and identity teams,
43:26
that's why having both HR context and any context in your
43:31
data lake swamp helps to give a feedback loop.
43:37
So you should always be pushing back and forth to say, listen,
43:40
this looks weird. Is it legit?
43:43
Oh, it is OK, cool. We're good to go.
43:44
But it's, it's always good to have like a reconciliation or a
43:47
feedback loop in any data platform.
43:49
It's actually one O 1 by building data platform.
43:53
So. Well, I'd say it, but there's a
43:54
lot of one-on-one that needs to maybe take place for for data
43:57
for a lot of companies. I know there were some other
44:00
things you wanted to bring up. We haven't really talked about
44:02
things like sessions and and things like that.
44:04
But what else is important here that people should be thinking
44:07
about? Yeah.
44:08
So it's it's more of the, it's more of the continuous aspect.
44:11
So I want to get into like session management and access
44:13
management. So let's say for example, that
44:17
you're valuing some context and you have you're pulling in
44:21
endpoint logs or you're pulling in device logs from pick your
44:25
vendor, pick your vendor of choice.
44:28
This is the whole problem of like some really big companies
44:34
that are in the news for security incidents that happened
44:36
then like he could very keep his very, very high level.
44:41
When you have context coming into your fabric and you, you
44:45
know that something looks that looks anomalous, you now have
44:48
the ability to start revoking sessions.
44:50
Now is it just like, oh, put this into a data lake and it
44:52
magically happens? No.
44:54
But this comes back down to like all of your IM systems become
44:57
appliances to help you orchestrate session management.
45:02
So an example, if I know you continually come in from North
45:07
Carolina on an Apple device, it's you.
45:10
But if I see you all of a sudden coming in from Nebraska, Texas,
45:15
you travel a lot. OK, But ordinarily same, same,
45:20
same things. But what this gives you is
45:25
session manager at scale, which is very hard to solve it in in
45:28
in identity right now. So that that's that's one
45:30
example that I think is tantamount.
45:33
What is what another another good, important one is I'm going
45:38
to say identity management. And what does that mean?
45:41
So not only can I not only can I can I, can I revoke things, but
45:44
this is going into like the Cape ish things.
45:46
But if I know that you're constantly under under attack,
45:50
like everyone's going after Jeff because he has privileged access
45:52
to a ton to a ton of stuff and they're spraying it across the
45:55
board. And let's say forbid someone
45:59
grabs your session has your token and they're just going
46:01
after all your apps. Not only can I revoke it, but
46:04
now I can be like, oh, there's a pattern here.
46:06
There's a behavioral pattern that they're going after this.
46:08
I now can turn your accounts off, revoke your access.
46:11
I can call your IGA platform and start revoking all your roles
46:14
and entitlements to keep, to keep the company safe and keep
46:17
you safe because you may have not done it knowingly, right?
46:22
So there's access management pieces to this in the, in the
46:24
continuous aspect where it, the, the data fabric, the ingest of
46:31
data signals gets you more secure, but it also gives you
46:36
the ability to start being dynamic.
46:38
And this is Jeff. We'll just use Jim because he's
46:42
he's out here. So sorry, Jim.
46:45
Jeff and Jim are of like roles when you have a data lake and
46:49
you collect like Jeff's a manager, Jim's a manager.
46:54
Why do you have access to 500 system that he has five Who's
46:57
right, who's wrong? So now you get to actually go
47:00
look at this from from from an analyst standpoint and be
47:02
proactive to say, do we have roll drift here?
47:05
Is this right or is this wrong? And then you actually can using
47:09
this framework, act on it and say, please do this.
47:12
And then when I'm saying way the magic wand, I'm those of you who
47:15
are listening on podcast, I'm waving my hand across right now.
47:20
You can use your ID, PS, your ID, your ID platform to say,
47:24
remove them from Group A Group B, remove them from this role,
47:27
remove, remove these applications.
47:30
So we're getting towards more event driven.
47:32
So when you have an HR signal that changes that says Jeff has
47:36
went from engineer one to manager, guess what?
47:39
You've lost your GitHub reply access, your confluence, your
47:43
lassie and stuff. This is policy now.
47:46
Now you could drive this to a policy framework.
47:48
So this is gets even more interesting now.
47:49
So this is where auditing comes into play.
47:53
You're no longer doing user access reviews.
47:56
Your policy states that any manager in this company is
48:01
baseline access, any engineers baseline access.
48:04
So if I have an event that comes in and says event went, I'm
48:07
sorry, job title went from an engineer to manager policy
48:13
happens now when your auditors come in and say I want to
48:15
evaluate user access usually like you don't have to here's
48:18
the policy and you want audit logs, insert vendor insert
48:22
thing. Here you go here, here, here,
48:24
your auto logs. Not only does this revolutionize
48:28
things, but it actually drives costs down from an auditing
48:30
standpoint. I mean, the the big four, maybe
48:32
like the big four will have to probably change how they audit
48:36
some things, but it should make it easier all along.
48:39
Because if you, if you have a policy that states these four
48:42
things, these four things, that's more binary.
48:45
Is everything going to fit into this puzzle?
48:48
No, absolutely not. Is the 80% we hope shrug
48:54
question mark. But I, I do, I can't say it
48:58
enough that identity management and session management access
49:02
it's, it's I purposely couple identity management and access
49:05
management as different things because one's behavioral and
49:08
one's data-driven. I, I think it's this is changing
49:13
how we're going to do our jobs at in identity.
49:17
I really do. Well, I think it it'll
49:19
definitely change the way auditors need to look at it.
49:22
And I think this is some education will probably need to
49:24
take place by identity teams out there to say here's how this
49:27
thing works. You know, they're going to want
49:30
proof and you know, isn't working the way the system is
49:33
designed, right documentation and all that.
49:35
And there's probably a break in period where, you know, they're
49:38
probably going to look at a little bit harder or weirder as,
49:42
as they get more comfortable with it.
49:43
But as, as it becomes more commonplace, then identity teams
49:46
are able to demonstrate that, look, it does work.
49:48
We do have a policy. Here's how the policy works and
49:51
how the configurations work. And that comfortability grows.
49:55
It'll become a lot easier, I think for for auditors to look
49:58
at it and. What you can and and you make
50:00
you make a great point. You made me think about
50:01
something to that one and I wanted to touch on it.
50:03
It's a zero touch principle. I love Wendy and said this and
50:10
he always takes the contrary viewpoint, which is which is
50:12
great. At least privilege is a lie.
50:15
I am, I'm a, I'm a believer of that.
50:17
I know we've talked about that ad nauseam.
50:23
When implemented the right way, purchased, implemented, built,
50:28
purchased hybrid of things, you kind of get 0 standing privilege
50:33
for some aspects of things. Let me explain what that means.
50:37
You have this data fabric of HR signals and contact signals.
50:40
I want to say you, you do change management right now.
50:43
You can start taking your most targeted system and let's take
50:46
the the most beloved cloud provider that has the the most
50:50
target in most companies, which is AWS, right?
50:54
I gave a talk about this at at identifiers last year.
50:58
You now can take authorization with context that says Sean does
51:04
not need this access. Sean is an engineer, he should
51:07
have access. Awesome.
51:08
That's one guardrail. Do I need it on Saturday at 8:00
51:12
PM at 9:00 AM? Maybe, maybe not.
51:15
How do I know that you use things like Salesforce, whatever
51:19
ticket system you want to use, ServiceNow, Jira, GitHub, take
51:23
your pick, right When you have that additional context on your
51:28
fabric that says Sean is an engineer that has an open thing
51:31
attached to him, I'm, I'm going to be granting him AWS access
51:35
for this ephemeral period of time.
51:37
Great. So you just minimize your
51:38
footprint. You haven't really destroyed a
51:40
user experience. You should have proper change
51:43
management in place for production system that connects
51:44
do that could do financial harmful company.
51:47
That's your business. All right, there is we need this
51:50
for security, but it's also not going to it's actually going to
51:52
improve user experience if you, if you think about it, because
51:58
you're still going to be able to to apply provisioning aspects to
52:01
this with security mindset. So I just gave you a zero trust
52:08
principle, but with provisioning, it's the it's the
52:10
same concept. Shawn's been proofed.
52:12
He got hired. Here's your policy.
52:15
Shawn's an engineer. He should have access to GitHub,
52:18
GitLab, take your shoe to short of of systems.
52:22
That doesn't mean I'm granted access to every, every project
52:25
in there. It means that I can get into it.
52:27
Great, now what? OK, now I'm working with team
52:30
A-Team B, Team C OK, I have a jury item associated to me.
52:34
I can now grant you really granular access to the to those
52:38
platforms based on a task or a just in time approach to me as a
52:44
practitioner, I love that because you don't get that call
52:48
saying like, hey, Saturday, I need to know what so and so had
52:54
access to. It's so and so point in time
52:56
because so and so hit that accept that MFA prompt like,
53:01
Dang, I hate we'd be able to keep people keep doing that,
53:03
right? But that's the security side of
53:05
me. But there's also business value
53:07
here where provisioning in this gets more real time versus like
53:12
see you in two weeks, see you in a week, wait for a device, wait
53:16
for an e-mail where event driven gets you both business
53:20
procurement quicker, better security, better access
53:24
management in, in better session management.
53:27
So to me, it's the, it's the, I want to say trifecta, but it's
53:30
wrong because there's five things there.
53:32
So 5 facta if you will, I mean. Quinfecta.
53:35
Is that a quinfecta? That's right, yeah.
53:37
Penfecta, if you will. Penfecta.
53:40
This smells a lot like 0 standing privileges to me, which
53:45
to me and, and, and shout out to John Morton, who opened my eyes
53:48
up to this a couple years ago when I when we first met.
53:51
But this is kind of like the the Holy Grail almost for
53:55
authentication authorization, where people are walking around
53:58
and they have this ephemeral access where they only need it
54:03
and the point in time that they need it and then it goes away.
54:05
And then right, you know, super secure if account gets popped.
54:09
It's less about authentication, it's more about authorization.
54:13
I I said it at at my talk. Take, take my session, have it.
54:18
I don't care. I mean, I not really, but like
54:21
I'm saying, you can have it. That isn't the attack point
54:24
anymore. Like you can go after and go
54:25
after my session hijack it. OK, have fun, have Syria menu
54:31
but talk talk. Elsewhere, and you're using
54:35
shared signals framework and you're taking advantage of
54:36
things like that and Cape and interop between all these
54:40
different tools, right? They've, they've signed on and
54:43
now their tools are capable of it.
54:45
Can you imagine, right? It's almost like identity 2
54:48
point O or three-point O or whatever phase we want to call
54:51
it, right? It's like, OK, this is I love.
54:53
What you're talking about? I.
54:55
Love what you call it that because I was actually, I had a
54:57
conversation with a couple of people about it and I'm like, is
55:00
it continuous? I am or is it identity 2.0?
55:02
They're like too soon, too. Soon.
55:04
Yeah, it's too soon. We got to wait.
55:06
It's got. All I know is it's got to have a
55:07
cool acronym. That's the most important thing.
55:10
And then we'll figure out the name.
55:11
So we need to come up with the acronym first and then we'll
55:13
figure out what to call it. Exactly.
55:18
Let's see, I feel we covered a lot of ground.
55:21
I'm sure we missed something or I'm not thinking of something.
55:23
Is there anything else that you want to bring up to the table
55:25
now? Because I know you're going to
55:26
have maybe, probably more conversations about this
55:29
Identiverse and it's too much to cover in a 45 minute or an hour
55:32
episode. Oh yeah.
55:33
Yeah, there's going to be a 2 hour workshop at Identiverse.
55:36
I highly encourage you to go to the site, check it out.
55:39
Might be running it. I'll know later in February,
55:44
maybe given talks if if I'm if I'm chosen by the the board,
55:48
which is great. I do want to end on like, you
55:51
know, we never really covered like define what continuous IAM
55:55
is or continuous identity. And I just want to give a very
55:58
blanket statement that way you people are like, this is great.
56:01
Give me a sentence that I can go back and say this is what this
56:03
thing, this thing is so, so continuous identity thing is I
56:07
am used and used interchangeably is the ability to apply controls
56:13
to an existing identity based session utilizing signals
56:18
received and processed by your fabric.
56:20
Fabric is very nabulous term, but it could be like your data
56:23
lake or in your or your orchestration layer.
56:26
But essentially that's what this is and you're building a
56:29
foundation to get to real time and continuous and event driven
56:32
things. And you're right, Jeff, we
56:35
covered a lot. I think it's almost like sensory
56:39
overload, but it's a lot, a lot to think about.
56:43
I'm open on LinkedIn questions. Hit me up.
56:46
I'm I love talking about it so doesn't bother me at all.
56:51
All right, let's end on a lighter note here.
56:53
Jim and I were very fortunate to be at the Gartner conference at
56:56
the end of 2024 and turnabout is fair play.
57:01
Our friend Rebecca Archambault invited us on stage to interview
57:05
us, which is really a shoe on the other foot because we did
57:07
that to her and Henrique Teixeira when we were when he
57:11
was with Gartner, I think two years ago at this point.
57:14
And so we had this conversation kind of, you know, learn more
57:16
about kind of like what do we do in the podcast and some of the
57:19
interesting stories we had. So it was like one of the last
57:21
sessions of the event. So thank you for all the people
57:24
who showed up for that. And I think we had a really good
57:26
kind of fun discussion. One of my favorite things that
57:29
I've introduced to the show over the years has been this lighter
57:32
note because it gets me, it lets me ask really challenging,
57:37
interesting questions. And this is one that I brought
57:39
up to the audience and I brought it up before in the show.
57:42
And so, Sean, I'm going to ask you, this is a profound question
57:46
of if you were a potato, how would you want to be prepared?
57:50
Initial thought is not like Mark Watney on The Martian.
57:55
OK, but bad. So don't don't like that so.
57:59
There's a couple ways you can take this, and I and I shared my
58:02
my thoughts on this with the audience of Gartner.
58:04
But do you take it with the idea of, oh, what's delicious right
58:10
in your mind? Like what's your favorite style
58:11
of potato when you eat them? Or do you take the gym route,
58:15
which is an, and Jim, Jim McDonald as in like, like, oh,
58:20
is he thinks about it from a pain perspective.
58:23
What is going to be the least painful way to go as a potato?
58:28
And there's there's other very variations on that, but those
58:31
seem to be the two most common. Yeah.
58:36
I was thinking raw, but that's not how you serve potatoes
58:38
because Melanie's raw potato. This is not happening.
58:43
Somebody out there the The Raw Potato gang is getting ready to
58:46
send you a bunch of DMS and and messages on LinkedIn.
58:49
I'm, I'm almost leaning towards loaded or mashed and I, I think
58:57
I'm going to go with mashed because it is the most
59:01
delicious. I love mashed potatoes.
59:02
I am, I love potatoes. So butter cream potato.
59:07
It's the simplest thing. It goes with anything.
59:08
It it, it goes well with all the, all the, all the things and
59:11
it blends well. So and.
59:13
Eat just that and have sustenance.
59:16
Potato the perfect food. I don't know, maybe that's our
59:19
next our next podcast episode also.
59:21
Because my kid loves potatoes, so he's like potato.
59:23
I'm like, OK, we're good. I mean, it's, it's hard to beat
59:26
a McDonald's French fry. I feel like when it's prepared
59:29
and fresh, that's really good. I'm an all gratin person myself,
59:32
so I have like kind of a cheesy potato, you know, experience as
59:36
I'll call it. Hash Browns are really good.
59:39
A nice crispy hash brown. I mean, yeah, I could go on and
59:42
on for hours. Maybe we'll make it potato at
59:44
the center. At some point, potato at the
59:47
center. That's funny.
59:49
All right, well, you're hungry. I'm hungry.
59:51
We've been talking to you for a bit.
59:52
I do appreciate coming back. I'm looking forward to seeing
59:54
you at Universe Away this year. And congratulations on the new
59:58
addition to the family. And again, very cool setup you
1:00:02
got behind you. So if you're listening to this,
1:00:04
hop on over to the YouTube channel and take a look at
1:00:07
Sean's background. It's rife with Star Wars stuff,
1:00:10
which is super cool. Thanks, we'll go.
1:00:13
Ahead and leave it there for this week as I mentioned, I'll
1:00:15
have links in the show notes for your LinkedIn profile.
1:00:18
Sean also have linked for our discount for EIC again ID AC25,
1:00:23
MKO. What else links to Jim and I
1:00:26
and. Yeah, like.
1:00:29
Subscribe to all that fun things that are great for social and
1:00:33
share it with friends and enemies.
1:00:35
I don't care who you share it with as long as they listen and
1:00:38
or watch. So go ahead and leave it.
1:00:40
Thanks everybody for watching and are listening and we'll talk
1:00:43
with you all in the next one. You've been listening to
1:00:47
Identity at the Center. We hope you've enjoyed the show.
1:00:51
Make sure to like, rate and review, and we'll be back soon.
1:00:55
But in the meantime, hit the website at
1:00:58
identity@thecenter.com. See you next time on Identity at
1:01:04
the Center.