Latest / Identity at the Center / #155 - An IAM Mailbag

Transcript

#155 - An IAM Mailbag · Identity at the Center

0:09
You're listening to the identity at the center podcast.
0:12
This is a show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:26
sender podcast I'm Jeff and that's Jim.
0:28
Hey Jim hey Jeff, how are you? Oh, not so bad yourself.
0:32
I'm good man. Second day of a new career
0:37
working here. Yeah, new career working.
0:40
As the, that sounds interesting director of digital identity
0:44
advisory services at RSM u.s. LLC.
0:52
I think I got that right. I'll pee I'll be darn it, darn
0:56
it. Yes, that's correct.
0:57
I'm getting there. It's very exciting.
0:59
It's day two. We're together again.
1:03
The the identity mullet lives on as our friend Jody says so
1:07
hopefully she's listening. Congratulations to you and to me
1:11
as well since we're building quite quite the quite the
1:13
practice here. So this is pretty cool but yeah
1:15
very excited to have you on board and you know to to the
1:18
Moon as the kids say. Yeah.
1:21
Yeah, I'm excited, man. I mean everybody, I've met so
1:23
far has been Super helpful. And, you know, it's like, it's
1:28
always a nervous thing starting with the new organization.
1:33
I mean, heck, you just went through it, not that long ago,
1:35
but you don't know you. And then all the other folks who
1:39
have been very gracious as I've made it quite enjoyable for the
1:44
first day and a half. Yeah, the honeymoon period is
1:49
alive and well, still, so yeah. Yeah, I've got, I've got a
1:51
little bit sorry. I would like I didn't scare you
1:54
off or, like crazy orientation, or stupid stuff like that.
1:58
No, no. And already starting to book
2:01
some travel. So, planning on being out at the
2:03
Gartner, I am Summit in Las Vegas, is that August 21st
2:11
through this 22nd to the 24th. It's a Monday through Wednesday,
2:15
this year, instead of the normal sort of like, after Thanksgiving
2:20
Before Christmas, they've moved it up to August.
2:23
So yeah. Yeah, we're both going to be in
2:25
Las Vegas which is very cool and we're going to plan on doing
2:28
some podcast recording out there as well.
2:31
Try to find a quiet corner for us to do our Shenanigans in and
2:34
maybe invite some folks over and have conversations with which
2:37
would be pretty pretty neat, I think.
2:39
Yeah, absolutely. Yeah I think that's a rookie.
2:42
So if you're if you're listening and you want to meet us or maybe
2:48
you know get involved with podcasting anyway just reach out
2:52
to either Jeff. I are both folks.
2:54
Use LinkedIn as probably the best tool to do so and we'd love
3:00
to hear from. You would love to meet you in
3:03
person. Yeah, absolutely.
3:05
Do they proverbial fist bump? And and yeah, just have a
3:09
conversation and, and keep it real.
3:12
And I feel like, I'm young and hip at this point with keep it
3:14
real, and to the moon. But to the Moon, is we have to
3:17
wait, not even close to New as it.
3:19
And that from like me. I think it says, like that.
3:21
Like the meme stocks and things like that.
3:23
At but that was kind of like, you know, at least where I've
3:26
heard it. Most recently is like in the
3:28
condo in the context of, you know, some junk crypto coin I
3:33
should say junk. But some cryptocurrency, you
3:36
know, being artificially inflated and pushed Sky High.
3:41
I guess I was thinking of the old Ralph from The Honeymooners,
3:45
to the movie with you Alice. I think it was like, you know,
3:49
one of these days pow right in the kisser.
3:54
So, politically until think you can probably say that TV these
3:56
days. Yeah, probably in a lot of
3:57
trouble. Yes, we're going to be a
4:01
gardener. Jim is join me over at RSM,
4:04
which is awesome. So, looking forward to continued
4:06
success there, I don't know about you, but I've gotten a lot
4:10
of like cool feedback over the last.
4:12
I don't seem like the last couple of weeks for people
4:15
who've been listening to the show on LinkedIn, which is
4:17
pretty neat. It's always interesting to see
4:19
kind of like who's listening, right, who's setting in the
4:22
feedback, but also, where they're at.
4:23
At and it's pretty. We're truly are a global show at
4:26
this point got thousands of folks listening to our to our
4:31
identity stuff, pretty much every week, which is very neat.
4:34
And so what I thought we'd do this week is take some of the
4:37
questions that we've gotten over the last really kind of few
4:39
weeks. And do you know what we like to
4:42
call in the biz? A mailbag episode ended up
4:45
taking questions in the biz. That's right.
4:47
As professional podcasters is take a few questions that we've
4:51
received that we thought were pretty interesting and maybe the
4:53
audience Spike, get some interest from and you know,
4:57
answer them put our spin on it and see where things go.
5:00
So we selected three and we'll start with the first question
5:05
and I'll just read them off here.
5:07
This is from Joanne California. What we will leave last names
5:10
and companies out to keep just make sure that we you know don't
5:14
out people where maybe they don't want to be or whatever it
5:16
is. But Joan California, what is
5:19
more important having and I am program and I think by this he
5:22
means the people And sort of like the process or having I am
5:26
technology, like OCTA sale point or cyber-ark.
5:29
So things like access management identity governance privileged
5:33
access tools. So I think the intention here is
5:36
like where do you start maybe do you start with people and
5:39
process in the program? For do?
5:41
Get a technology first and then it's kind of build around that.
5:45
What are your thoughts? Jim, let's see both be
5:48
successful. I think that this one of those
5:52
Consulting answered Pounds because I think it depends on
5:55
the size and maturity of the organization.
5:58
Even very large organization. You've got to assume that
6:01
there's some kind of footprint of the technology already in
6:04
place. Maybe some some old work'll
6:07
technology or maybe a custom homegrown solution for managing
6:12
access request, rotting provisioning request, things
6:16
like that. Maybe some kind of spreadsheet
6:19
process for reviewing access, certainly doing some Some level
6:24
of authentication, right? People don't just even in
6:26
smaller organizations. You do you just go to an
6:29
application and get access to the crown jewels of the
6:32
organization so you know single sign-on and the even privileged
6:37
access to, it's got to be some level of Technology there even
6:41
if it's not good, right? Even if the end users have to
6:45
have a 2 usernames and passwords or even if you're doing some
6:49
kind of, you know, not very secure way of managing, Shared
6:54
passwords and stuff like that. So in that case where you've got
7:02
technology but you know it's not the right or appropriate
7:05
technology. I say start with the program
7:08
because then you bring the stakeholders to the table, you
7:13
put together a strategy and you go through a formal process to
7:17
select the right Technology based on your use cases and
7:21
requirements. Now, If you're the case where
7:24
you actually have been absolute vacuum of technology or you're
7:28
coming up, right? Especially smaller.
7:31
Organizations is not going to be appropriate, probably for 100
7:35
200 person organization to have a whole, a lot of hoopla around
7:40
having an I am program, I think starting with, you know, ideally
7:45
you have a trusted partner who knows the landscape well enough
7:50
and can advise you In more of an informal way rather than going
7:55
through a whole strategy development and here are the
7:57
technologies that would be a good fit for you that I think
8:01
are, you know, map to your technology skill sets or
8:05
whatever. And then I think it makes sense
8:07
where you can start with technology.
8:09
But I think for again larger organizations who find
8:11
themselves, you know, it's kind of become laggards in this area
8:15
in terms of their technology footprint.
8:18
Starting with a program. Really make sense.
8:20
What do you think? Yeah, if I did.
8:23
Difficult to believe, there's not any technology there.
8:26
You know, active directories, probably the most prevalent.
8:29
Most most organizations have that, or they have Azure or we
8:32
Google by way of, like, Google office or Google mail.
8:37
I guess I still want to start with people and process, though,
8:41
because If I don't know who owns identity and who's responsible
8:47
and accountable for those Services, it's really tough to
8:51
get anything going from a measurement aspect, just have an
8:55
accountability aspect, you know, those sorts of things, I know,
8:59
plenty of organizations, they'll go off and say, yeah.
9:01
We're going to go by, you know, X tool, and there isn't an IM
9:05
program. And they sometimes struggle with
9:09
that because they don't really have any direction.
9:11
They're like, oh yeah, we need a password tool.
9:12
So we're going to go by LastPass not to pick on a particular
9:16
company or OCTA, or Duo, right? For MFA or whatever is maybe
9:20
they're buying a tactical solution and not really thinking
9:25
strategically. So I tend to lean towards people
9:28
and process because my thought is lots of companies.
9:31
Get away without having a ton of I am technology.
9:36
Probably have a syndication, like you mentioned, but that's
9:38
companies don't have identity Governor's administration
9:41
technology, lots of companies still don't Have a you know, a
9:44
privileged access management, Vault or session monitoring and
9:47
recording you know capabilities or key rotation or Secrets
9:51
management and rotation, you know, things like that.
9:53
But they do have people and they do have processes.
9:56
So even if you know, it is a manual environment at least
10:01
there's some direction and some accountability for the delivery
10:05
of those admittedly, very manual services.
10:08
So I like to start with people and process because it generally
10:12
takes some You know, some buy-in and some consensus consensus
10:17
building to buy some of these more dedicated technologies that
10:22
are frankly, getting, you know, more and more expensive all
10:24
time. So that's tender, you know,
10:27
that's, I guess that's where I tend to start.
10:29
But, you know, the Consulting answer, it depends.
10:32
But I think in a vacuum, I'd want to know who owns, I am.
10:35
And to me that's people and process, the IM program itself.
10:39
Yeah, I mean, I think when you think about moving up the
10:43
Maturity rankings in terms of having a program you're talking
10:47
about, formalizing the program making more formal.
10:51
When you think about other areas of maturity, it's about
10:55
instituting automation, automation paper trail, you
10:59
know, things to make it operate better.
11:02
In terms of that, that program formality, I think the smaller
11:08
more immature organization. You still need a strategy,
11:12
right? I don't think it makes sense for
11:14
anybody to just go out by technology and through
11:17
technology as solution and hope it works, but you probably don't
11:20
need all the formal steps that a large organization would
11:24
require, you don't need maybe a steering committee meeting with
11:28
representative from all these different parties.
11:31
You can do it a little more informally.
11:33
If you're the technology leader, you kind of come up with the
11:35
strategy or work with your trusted partner to come up with
11:39
the strategy and Start implementing it that you're in
11:42
the larger organization, especially a global organization
11:45
where you've got stakeholders different business units or
11:49
different geographies, as well as different departments.
11:52
You've got to come up with a way to keep those folks included.
11:57
You have get their buy-in to the strategy, keep them, you know,
12:01
knowing understanding what their involvement has to be going
12:04
forward. So you know, I think it's
12:08
Everybody needs a strategy is just how much, how much
12:13
formalization do you put around that process?
12:16
Depends on where you are in terms of your size and maturity
12:20
of an organization. You know, I'm glad you mention
12:23
that word formality because they think sometimes we get stuck in
12:28
sort of like this definition of like, oh it's yeah, it's a, it's
12:32
a black tie, you know, suits and super formal and you know, very
12:38
rigid. And I hear that all times like
12:41
okay, we need a more formal. I am program, but it doesn't
12:43
necessarily mean it is, you know, 8 people sitting at a
12:47
conference room, you know, raising their thumbs like
12:49
American Idol to say yes or no whether or not this project is
12:52
going to go forward, but I do think it it that there is some
12:56
structure to the way that the program is being run doesn't
13:00
mean that you need to have you know suits and ties and all
13:03
that. All that fun stuff.
13:05
It can be more informal as long as there is.
13:08
Is someone in charge that there is some Rhyme or Reason that
13:12
things are moving forward. You're right.
13:13
You don't need, you know, all that hoopla.
13:16
As you mentioned for the smaller organizations, you might have it
13:20
that you're worried, you know, wearing multiple hats Etc.
13:21
So I'm glad you got to pick up because I sometimes struggle
13:25
with that word and kind of talking with clients.
13:27
Okay, well you know we got to get just more formal with the
13:30
identity program itself, but what does that actually mean a
13:33
real world doesn't necessarily mean you know death by committee
13:36
or, you know, 800 steps to get? Anything done.
13:39
I think it just means having more structure to the program
13:42
and maybe and maybe structures a better word when it comes to,
13:45
you know, hey, let's let's make sure we have a more structured.
13:47
I am program that there is some, some guidelines are rails to
13:52
keep people on. Yeah, well I think, you know,
13:55
the bigger organ bigger, the organization is the more that
13:59
structure is going to be important?
14:02
The, you know, let's take this example, you know, the way I
14:06
like to run, I am program. In the larger organizations you
14:10
have a set of policies and standards.
14:12
This policy is to standards are meant to be applied to all of
14:17
your technology. So if you have a password
14:19
policy, for example, pastors got to be 12 characters, long, that
14:23
applies to every system in your organization right now.
14:29
You may have a group that runs a Mainframe that can only do an
14:33
eight character password. I'm picking on this because it's
14:36
such a common example, right? I'm system only allows an eight
14:40
character password can live with the cat password policy can
14:43
integrate to your SSO technology.
14:46
I think the proper solution is that they should have to apply
14:50
for a formal exception, you know.
14:53
Now if you're in a 200-person organization, that's that's
14:56
Overkill, right? And it's what's the point.
14:59
It's like you've only got so many applications that you need
15:02
to manage, but if you're an organization with, you know,
15:06
hundreds or even thousands of applications, you know, you've
15:10
really got to run things through the formal process.
15:14
How do you attract it right and I think even if you're just
15:17
writing it down on a piece of paper it's okay.
15:19
We know that there is this app out there, you know, we're not
15:22
going to formally manage it but at least we know about it.
15:25
I think that's just having that structure in the process to it
15:28
and kind of grow into it. I don't think it's something you
15:30
need to like, solve overnight, but I think you should start to
15:33
think about as the organization grows.
15:35
Maybe you're not going to be a 200 person or a 50-person
15:37
organization forever. You know, maybe the you do grow
15:41
at some point, the sooner you start to have structure The
15:44
easier it will be to kind of grow and mature, that sort of
15:47
thing. Yeah.
15:50
Any other question. That is a mailbag.
15:52
Yeah let's go do Andrew and Georgia.
15:54
I like this question because this is something that I like to
15:58
ask when I'm talking with customers to is he asks this our
16:02
social media accounts in the scope of I am I think.
16:06
Yes. But my management disagrees.
16:08
What are your thoughts? So Jim, our social media
16:12
accounts in the scope of I am, do you side with Andrew?
16:16
Or are you management? Boo.
16:19
Well I think it's I think it's a great question because I don't
16:23
think there's one answer. Here's what I kind of think.
16:27
I don't think it's in the core of what most I am programs are
16:33
focused on most. I am programs are going to be
16:37
focused on the use case around, you know, employee access.
16:42
Now, views, the broad definition of who has access to what is
16:46
definitely included in that. So is also included is Is all
16:50
the people who work for your company if they have access to,
16:54
you know, Wells Fargo and Bank of America systems or other
16:59
systems. Are they have accounts that were
17:00
issued by other companies. So you should be managing all
17:05
that as well as your social media, I guess where I'm going
17:08
with it is that I don't think it's core scope of I am, but I
17:12
do think it eventually gets there.
17:13
So, if you're building, if you're starting from very
17:16
immature Point, you're probably not all the There.
17:20
So, I guess what I'm saying is that, if you're an organization,
17:23
that is very much in the public eye, it becomes much more
17:26
important that you're able to manage those social media
17:29
accounts. But I'd say also, you really
17:31
have to work with the team, say use them to make sure it's a
17:35
good user experience, right? It can't be like, hey the
17:38
person's got to go to cyber-ark to check out a password to use
17:41
the Twitter account. That's just not that's not going
17:45
to flow well enough. So you have to look at Solutions
17:47
designed specifically For social media.
17:51
Yeah, I'll be honest I was not with you until you added your
17:54
caveat at the end about, you know, social media being a core
17:59
use case. Definitely that I think it is
18:01
that the scope. I think in general should be in
18:05
scope, but I think after Define what that scope is, are you
18:09
actively managing the account, or are you providing guidance to
18:12
the team probably marketing or Communications?
18:15
That is actually controlling the account?
18:17
I think at a minimum you're at Providing guidance and a set of
18:21
policies procedures standards, whatever may be for them to
18:25
follow that aligns with your I am program policy and standards.
18:30
Make sure MFA is turned on. Make sure that if you know,
18:33
there's a review of who has access to those accounts and
18:35
that they're not posting stupid stuff because we see that all
18:37
the time, you know some is getting breach making sure they
18:40
have MFA. So those breaches are, you know,
18:42
minimize the chances of it, those sorts of things, there are
18:45
certainly dedicated tools out there to manage those accounts.
18:49
But They are pretty specific it surprises.
18:52
Me a little bit that the privileged access management
18:55
players, the big ones, like cyber-ark Beyond, trust de línea
19:00
formerly known as psychotic and centrify and others.
19:04
Haven't really embraced figuring out how to manage those use
19:09
cases. Some of those social media type
19:11
of cats, more directly rather than just having a simple Vault.
19:16
It's not it's not an area that I'm next in an expert on from a
19:19
technology Standpoint but you have things like HootSuite that
19:22
has some capabilities out there that you know, can probably help
19:25
out. I know there's another one
19:27
actually there was somebody who reached out on LinkedIn
19:29
recently, we got to get in touch with that person and maybe get
19:32
them on to talk about kind of management of social media
19:35
accounts from an identity perspective but I do think they
19:38
should be at a minimum governed by policy and standards, but
19:43
they should not be forgotten and just left for some other team to
19:47
kind of figure out, I think they should be included.
19:49
Part of the strategy. Yeah, I totally agree with you.
19:52
I mean, see you have the advantage that I have to go and
19:56
answer first and then you get to just.
20:00
Yeah. So, so yeah, I mean, what you
20:02
just said, there were two, the my mind went right to, okay, how
20:07
do you get to a point where you're actually responsible for
20:11
managing them which is much harder than, you know, having a
20:16
policy in place in having a policy in place.
20:18
Let's let's Be frank is like there's no money involved with
20:23
putting a policy in place and even tracking whether or not the
20:28
policies being followed is not that much.
20:33
There's not that much of an investment.
20:34
They're now in terms of using technology to do it to deal with
20:39
essentially what I think are going to be shared accounts,
20:41
right? Because let's imagine you're a
20:43
sports league and you've got social media.
20:47
Like you've got a Twitter account.
20:49
And you, you know, are taking pictures from games or videos
20:54
from games and you want to get them post on the Twitter.
20:58
I'm not sure exactly how most is lease work.
21:00
If they've got 30 people or 15 people who are at all the
21:04
different games who could potentially do that or if it
21:07
gets funneled back to some Central source and they post it.
21:10
But the more bureaucracy that is involved with that process.
21:16
The slower is going to be to get that video online and like the
21:20
name of the game I think is got to be speed to getting it online
21:24
before somebody else goes and seals Earth under our if it
21:27
takes 12 hours to get a 5 second video online, then, what's the
21:31
point? Yeah, that title in us.
21:34
I think of the delivery of the content is obviously important
21:37
social. Yeah, I guess that wasn't
21:40
thinking about actively managing it.
21:42
I think that frankly is a losing battle right now.
21:45
If you don't have specialized social media technology identity
21:53
controls, like you're trying to do it through your average
21:56
access management, or identity, governance, or even produce at
22:00
privileged access management tools.
22:02
I don't think, It's a winning fight right now, but I do think
22:06
they should at least be a counter for form a strategy from
22:08
a program perspective. And then you know the
22:10
organization aside for they want to make the investment in
22:13
asbestos specific tool that covers those specific use cases
22:17
or not. I think it really we have to
22:20
get, I'm guessing you also don't need to give someone on who can
22:23
kind of give us the lay of the landscape in terms of the
22:27
technology that's available. you know, the circuit manager but
22:31
you're right on but the in terms of the policy I think what I
22:35
was, you know, where my head was with Andrews question was you
22:39
know, if I'm a company that somewhere in the United States
22:42
and we make boxes Like, you know, all right.
22:46
And they called me in to put together and I am strategy.
22:52
My big Focus isn't going to be on their Twitter account, Right
22:57
and it's it's way out in terms of of priority.
23:04
However if you're obviously the higher profile company the more
23:10
The more you are a target for those social media account
23:13
hacks. I think I at least take a minute
23:17
to ask the question and find out and if I'm comfortable with
23:21
what's being done and the controls, you know, something
23:23
about like from a either, an I am program manager or maybe a c,
23:26
so I have a lot of targets, right?
23:31
It may not be the highest priority, but at least I asked
23:34
the question and sort of make a mental note of where that is and
23:38
maybe if I'm not using enough, a baby us, the media thing get MFA
23:42
in that account and will Come talk to you in a couple of
23:45
years, right? But at least get MFA.
23:48
I'm going to say is I would at least ask a basic question and
23:51
then move on to things that might be more strategic from an
23:55
identity perspective, for example.
23:56
Yeah, we're Emma faking can start to be a real headache,
23:59
though. We did talk about this.
24:00
In our MFA discussion is shared accounts.
24:04
So if you're using it I'm using it.
24:06
All right? Well because the SMS text.
24:09
Yeah, exactly. Hey and by the way your you know
24:12
here's it maybe this is a little bit of banter but You're
24:16
controlling the questions in the mail bag.
24:18
But I just got a message from Matt asking.
24:22
Oh, so you and Jeff both went to RSM.
24:25
What's going to happen to the podcast while we are still
24:29
actively recording at as we speak as as both employees of
24:35
RSM. So, that's what's happening with
24:37
the podcast. Yeah, nothing is happening.
24:39
We are going to continue to do this as we have for the last
24:42
three years. We just celebrated our A
24:45
birthday. This is episode 155.
24:46
I think we're averaging like 1.1 episodes per week.
24:51
If you do sort of like the math, but yeah, the plan is to keep
24:54
this going to still keep it, you know, as weekly is as we can as
24:58
we have over the years. So no changes not anticipating
25:01
any huge, you know, commercials or branding exercise, or things
25:06
like that. I'm sure we might talk about
25:07
some things in the future, but it'll be the same, you know,
25:10
vendor-neutral Jim and Geoff, show, you know, that we run kind
25:14
of Dependent from from our real jobs.
25:17
So good question. I'm glad somebody brought that
25:20
up. Yeah.
25:22
All right. Anything else in the mailbag?
25:24
Yeah, let's do one more here on Nigel in Belgium where this is a
25:30
good one. Where does privacy sit within an
25:33
organization? Should the?
25:35
I am team own that generally, I would say no, the am team
25:40
doesn't own privacy, there's going to be, you know, a bigger
25:44
organization show up, like, Chief privacy officer and a
25:47
whole privacy team that I think, Am has privacy is a stakeholder.
25:56
Is our privacy is going to provide requirements.
26:00
I think getting them involved early in the development of your
26:04
strategy is the way to go. If you already have your
26:07
strategy developed, you don't work with them to make sure that
26:11
they support the strategy that it accomplishes.
26:14
I think the other thing to be aware of is that there are
26:17
spaces, evolving even more quickly than than ours.
26:22
As with the I am digital identity space.
26:25
I am digital identity is definitely evolving quickly by
26:28
privacy keeps evolving even more quick than that because, you
26:32
know, states and countries are constantly putting out new
26:36
regulations and it's changing that landscape.
26:38
So that could be impacting the regulatory environment with the
26:43
legal environment for your organization and your, I am team
26:48
needs to adapt to that. So, Yeah I think it's it's a
26:52
matter of working had to have with privacy.
26:55
Yeah, I agree with that. I think the overlap becomes a
26:58
little stronger. If you're thinking about it from
27:00
a customer, I'd any perspective where those controls need to be
27:05
built potentially into like a profile management system or
27:08
something like that. I see a greater hand in the
27:12
steerage, maybe of how that might work within the concept or
27:16
the cotton that the framework of what the I am programs.
27:20
Looking to accomplish with the customers probably less Sony
27:22
employee side because they don't think I typically see privacy
27:26
management for the employee, but definitely the customer side.
27:30
I would say I agree though. I don't think I am owns it.
27:33
I think they're a partner in potentially delivering some of
27:38
the services behind it from a user, just user experience
27:43
perspective, maybe or storage, maybe of certain bits of data
27:46
within like, a master user directory or profile or It may
27:50
be that sort of thing. Yeah, I think I've been involved
27:53
with enough projects where as this whole privacy landscape
27:57
from GDP are on, has evolved for a.
28:01
And when I am teams kind of, get in their own sphere of trying to
28:06
solve, okay? What is our privacy landscape?
28:08
And what how do we have to build our?
28:10
I am systems, it can really throw a whole wrench in the
28:14
works in terms of data residency and things like that and do like
28:19
you just don't have The knowledge to answer those
28:23
questions as beneficial to be able to go to somebody who can
28:28
speak authoritatively on this, is how these regulations affect
28:32
our company and how we need to address them in terms of our
28:38
system deployment. And so if you have a privacy
28:42
office that's you know the starting point.
28:45
I also think you know, if you don't essentially pulling in
28:48
somebody from your legal team, whose Is responsible for how
28:52
those regulations affect your company is going to be key?
28:56
Yeah, it's all agree. It's hard to be an expert in
28:58
everything. Privacy is evolving so quickly
29:01
and the methods with which to control that and the laws around
29:06
the world are constantly changing seems like there's a
29:08
new one popping up every six months or a year or so different
29:12
countries. So it goes, I think for me, I
29:16
think about it from a base use case perspective because this is
29:20
like a Not that. I think I hear a lot is, you
29:22
know, how we're going to manage all these different privacy
29:25
regulations. And my general guidance is,
29:28
they're all pretty similar. It's really about making sure
29:31
you have the appropriate audit Trail.
29:33
You've got the appropriate, you know, controls to be able to
29:36
remove, or, you know, or obfuscate data based on the
29:41
user. Those sorts of things.
29:42
If you can do those basic things, chances are, you're
29:46
probably in a much better position to comply with
29:50
whatever. Privacy regulations come up, and
29:53
those are sort of like base, you know, Plumbing essentially, from
29:57
add any perspective. No, those are great points.
30:01
All right, why don't you? Go ahead and wrap it up for this
30:02
week. Thanks to Joe, Andrew Nigel.
30:06
And and a few others who said two questions in before we go.
30:09
I Jim I know that you I just moved, I think you're looking at
30:13
moving soon and we're going to go positive this week because I
30:17
think when people think about moving they think of ways I do
30:20
it maybe. Hassles that go on with it.
30:22
Right? You know, it moving stinks or
30:24
you know, whatever maybe. But what's your favorite thing
30:27
about moving everything about moving.
30:29
It was top views. I'm one of those people who
30:32
might my general belief is that? We can all agree that moving is
30:38
being the neck are. So yeah, I could easily get
30:43
dragged into that. That - but I think if you think
30:47
about Moving from the standpoint, not the the act of
30:51
moving, because the act of moving, I don't think, I think
30:55
you have to be a sadist to think that's fine.
30:59
But if you think about the end product of moving, it's like
31:02
you're moving. Hopefully to have a better life
31:06
and I'm thinking, you know, with my move like the company that
31:10
does my trash pick up some weeks, they just don't show up.
31:14
And so I have a trash can that's like overflowing with trash from
31:17
really hoping that that's not going.
31:19
Happen anymore. My internet my Wi-Fi, you know,
31:24
good once a month I'll just be garbage for an entire day and
31:28
it's really hard to do customer calls and things like that when
31:33
your Wi-Fi is just going up and down all day, so hopefully my
31:37
Wi-Fi. Provider will be better.
31:39
And I, you know, when I think about that I'm like, I know
31:43
people like you've gotta live in the moment.
31:46
I've been hearing this advice on my life and I I think it's good
31:50
advice because you don't, otherwise, you'd like just B's
31:52
by you. But when you're in these times,
31:55
where it's like, time to hunker down, just get stuff done, and
31:59
maybe your circumstances aren't that.
32:01
Great. Like you're in the middle of a
32:03
move or, you know, whatever reason.
32:08
Don't live in the moment, living like this picture of the future
32:12
of where you're heading. And if you're not happy with
32:16
where you are, don't fixate on the fact that you're not happy
32:20
where you are think about where you're going.
32:22
And so that's what I also like about movie is like isn't a
32:26
picture of like, where I'm going is going to be better and I can
32:31
go through kind of those hard times to get to that that better
32:35
state. Sounds to me like you're full of
32:37
Hope when you're moving hope for better things that I think
32:42
that's a good outlook. I think for me, I think the best
32:45
thing is it's a good opportunity to like clean house.
32:48
Get rid of drawers, full of crap that you don't need.
32:52
You know, everybody think everybody.
32:53
This point has like that box of cables that they've stored, the
32:57
like, oh, here's my, you know, USB type B cable from like 20
33:02
years ago. Well, maybe I might need that if
33:04
it's been in a box for 20 years, Or five years or whatever it is
33:07
you probably don't need it. Probably a good idea to like
33:09
Purge or recycle you know, some of that stuff.
33:12
So I certainly did that. I cleaned, I cleaned the major
33:15
house when I moved. Like I just had you know,
33:19
Decades of just stuff as I can. I haven't used it.
33:23
It's time to go and so I think I think that that that fret that
33:28
helps with a fresh start to, it's like, okay we've we're not
33:32
bringing that baggage literally, you know, with us to the new
33:35
place. Is, you know, start with a
33:37
little bit more of a clean slate, which is always kind of
33:39
cool. I don't know about that man.
33:40
I'd never through cables way and I've had so, especially plugs.
33:45
So if you a plug that in the other end has some kind of
33:49
random connection. You just never know when that's
33:51
going to come in handy. Yeah, that's true.
33:55
I, you know, I just, I bit the bullet.
33:57
It was just kind of, like, I had so many cables.
33:59
It's like, okay, well, maybe I'll use that.
34:01
And I downside integrator, get rid of them all.
34:04
So now I have like, Box with cables.
34:07
I have a box with like power related items but not only have
34:12
one box of each instead of like multiple.
34:15
So I feel like I made progress and, you know, now I'm starting
34:19
to pull some that stuff out and kind of redeploy.
34:22
You know how things are in the new house we got.
34:24
So I like that and you actually know where it is now.
34:27
Yeah. Try to be a little more
34:29
organized with some. That stuff was good.
34:31
It was good opportunity to like, okay.
34:34
You know, you start, I still have a junk drawer.
34:36
So of course, you know, it's like my odds and ends everything
34:38
goes in there. But try to be a little more
34:40
consistent with what I'm doing with other stuff but I'm still
34:43
working on my office and the new place I haven't been home much
34:46
for the last few weeks since we moved because I've been on the
34:47
road as I come to you live from Racine Wisconsin as I record
34:52
this in a hotel. So I'm looking forward to having
34:56
a couple days at home at some point till today to work on what
34:59
is your Racine Wisconsin known for Well, let's see Frank Lloyd
35:06
Wright. Probably, because this is where
35:07
lots of his architecture resides from homes.
35:11
To SC Johnson, has their headquarters here, they have the
35:16
research Tower, that's part of their property.
35:19
They also have the administrative building that
35:21
has, if the building that has what they call it, the called
35:24
the water lilies where it is like these essentially spires
35:29
that are inside their one of their offices.
35:33
So there's that Kringle which is like a pastry up here.
35:39
It's kind of similar to like a Danish is very popular around
35:43
here. I'd never heard of it until I
35:45
started coming here with some regularity, but I think those
35:48
are probably the two things that would be like Frank Lloyd,
35:50
Wright, architecture and Kringle.
35:53
And I'm sure my friends and Racine will probably tell me.
35:56
There are things but those are things that I think.
35:58
The Kragle thing reminded me of when we were in Buffalo, what
36:02
was the famous meal that we had in Buffalo and buffalo Rochester
36:07
of Rochester? Your top, the garbage plate then
36:11
we do an episode of the podcast called garbage Fleet.
36:15
Yeah, we definitely got. I think it was like another
36:17
odds-and-ends episode. It was a kind of like this.
36:19
It was that I think I called it. Like, they're like the I am
36:22
garbage plate or something that but yeah, it was something we
36:24
did around right around the time but we were both of Rochester
36:26
for so for people who don't know what the Garbage.
36:28
Plate is just like whatever they have the kitchen could be french
36:32
fries. Some meatloaf some whatever,
36:36
throw it on the plate. Leftovers leftovers.
36:40
I like what I have placed. Yeah, leftover pizza left over.
36:44
Was that second day of lasagna is amazing know what it is about
36:48
like that but it's good stuff. All right, we are way off topic
36:53
but again let's go ahead and wrap things up.
36:55
F, that's fine. This is the this is our Our time
36:58
our fun time. Yeah, we'll go ahead and wrap it
37:01
up for this week again will be at Gartner, so if you want to do
37:04
the fist bump or maybe you know, help contribute or be part of
37:07
the podcast. Jim.
37:08
And I are planning on doing some live recording out there and
37:12
kind of making plans, aren't that hit us up on LinkedIn.
37:15
We're always happy to talk with folks.
37:17
If you've got questions about different things or when our
37:19
thoughts and opinions, you know, send them our way, we'll get em
37:22
incorporated into the show at some point.
37:24
And yeah, with that hit us on the web Denny at the center.com
37:29
Twitter at idac podcast and thanks for listening and we'll
37:34
talk with everyone in the next one.
37:39
Thanks for listening to the identity at the center podcast.
37:42
If you like what you heard, don't forget to subscribe and
37:45
visit us on the web and identity at the center.com.