Latest / Identity at the Center / #201 - IAM through CISO eyes with Helen Patton

Transcript

#201 - IAM through CISO eyes with Helen Patton · Identity at the Center

• 0:01
  This is identity at the center. If it has anything to do with I
• 0:08
  am this is the go-to podcast. So if you're a beginner or an
• 0:14
  expert or anyone in between you've found your new home
• 0:18
  welcome to Identity at the center now your host Jim
• 0:23
  McDonald and Jeff Steadman Welcome to the identity of the
• 0:29
  sender podcast. I'm Jeff and that's Jim.
• 0:31
  Hey, Jim! Hey, Jeff!
• 0:32
  How are you? I know what it is?
• 0:33
  I'm good. Well, I'm okay, I have
• 0:35
  allergies, I'm traveling, so it's good times.
• 0:37
  I don't know what it is, whatever.
• 0:38
  I kind of kick off the show. You look at me like with this
• 0:40
  smile and this is an audio podcast, but you give me this,
• 0:43
  you know, what eating grin and I have no idea what you're about
• 0:46
  to say next. So this is exactly the way I
• 0:48
  always, prepare something fun to talk about.
• 0:51
  And today it's I was thinking about a video call that I was on
• 0:56
  yesterday, and I mean, that's pretty much.
• 0:57
  HR lives, right? We just sit on video calls all
• 1:00
  the time and two people had the same virtual background.
• 1:04
  They were in like the same office space.
• 1:07
  You've, I'm sure everybody who's listening to.
• 1:09
  This has seen this virtual background.
• 1:11
  Looks like the person has like a corner desk and there's glass
• 1:15
  windows all around them and it's not the biggest city in the
• 1:19
  world but they're in some kind of urban area or two people were
• 1:22
  sitting in the same chair, in the same virtual background.
• 1:26
  And I thought to myself, Okay, for me, I've been working from
• 1:30
  home now for I think it's 11 12 years.
• 1:35
  I actually might even be longer than that.
• 1:37
  And you know, I think with the pandemic, it's kind of taken off
• 1:42
  and I kind of get the question of like one.
• 1:46
  When is software going to improve the virtual backgrounds?
• 1:49
  Give you more choices and not have that like awful blur around
• 1:53
  your hair and like cut people's ears off and stuff like that.
• 1:57
  And then number two, To what are people going to digital virtual
• 2:01
  backgrounds and kind of just like invest in having a nicer
• 2:05
  background and then that got me thinking?
• 2:08
  Like so I'm going to put that question on, see you?
• 2:11
  But then it got me thinking about, you know, remote work.
• 2:15
  And you know, it seems like it's here to stay.
• 2:18
  As far as I'm concerned, especially in our industry, I
• 2:21
  think the pandemic brought it to a new level, I think the great
• 2:25
  resignation got Is hiring it and infosec people especially from
• 2:32
  hey wherever you live. If you're good at what you do,
• 2:35
  you can work here. So I think it's here to say and,
• 2:40
  you know it, but it's interesting.
• 2:42
  You know, you traffic is back to.
• 2:46
  That's a very real thing. So what are your thoughts?
• 2:49
  Well, you have a few things there.
• 2:49
  Let's start with the virtual backgrounds.
• 2:52
  I mean, I think everyone remembers a couple years ago
• 2:55
  right virtual backgrounds, like the Rays or the rage.
• 2:58
  Zoom WebEx go to like everybody was adding in features into
• 3:03
  their video conferencing software to be able to do that.
• 3:08
  You know, there was fun ones at first and then you know people
• 3:10
  think got bored of it and then they didn't care and then they
• 3:12
  just was like a static, you know company logo or just one of the
• 3:16
  built-in ones that came with it. I think I know the one you're
• 3:18
  talking about, I don't know if that was teams or I think it's
• 3:20
  probably teams or WebEx that we were on yesterday, pretty much
• 3:23
  all day. And I know, I think another talk
• 3:25
  about sites like the white one was like the glass kind of
• 3:28
  window. Was and yeah, you get the weird,
• 3:30
  like fuzz around people's head with the the blur.
• 3:34
  I don't. So the blur one's interesting
• 3:36
  because that is extremely software dependent, but if you
• 3:41
  have the appropriate Hardware, you can actually make it look
• 3:43
  better. And if you have the appropriate
• 3:44
  lighting, it works even better. That is what I see is like the
• 3:48
  biggest downfall most people as they're lighting is just crap.
• 3:51
  It comes to web cameras and kind of setting up positioning.
• 3:54
  My favorite thing is People. So at home, when I'm actually in
• 4:00
  my normal setup and not traveling, I have a pretty I've
• 4:03
  invested. My background looks good, I have
• 4:05
  a nice, Sony mirrorless camera, I have lighting stuff like that,
• 4:09
  that you know, kind of comes off.
• 4:10
  Well and people always think that I'm standing in front of a
• 4:12
  virtual background and I back up into my virtual looks like you
• 4:17
  know it's like oh no this is like this is real.
• 4:19
  Like I actually like took the time to set up I figured he was
• 4:21
  like hey you know what I'm always on camera about for
• 4:24
  something might as well invest the time and you know get it set
• 4:27
  up the way that I'd like Kind of present myself rather than
• 4:29
  having that awkward, you know, up the nose angle, double chin
• 4:34
  turtleneck with her. It might be for people looking
• 4:38
  at. So I think that's one.
• 4:40
  If you have a, I will throw a pro tip out there.
• 4:42
  If you have a computer that has an Nvidia, a relatively recent
• 4:47
  Nvidia video card into it, and video has a software called
• 4:50
  broadcast that is free. It works off of your video card
• 4:53
  and basically does a much better job of doing like virtual
• 4:56
  camera. Depth of background, those sorts
• 5:01
  of things, but it does require pretty decent video card for it
• 5:04
  to work well. So that's my Pro tip for that.
• 5:08
  Now you mentioned, I think the other thing was what working at
• 5:11
  home, and if that's you know, whether it's going to stay, it
• 5:16
  has to be. I mean, come on, I mean,
• 5:17
  everyone found out in the last like what?
• 5:19
  Two, three years, the jobs that their managers and directors and
• 5:23
  CEOs were saying, no, we need you in the office, we can't work
• 5:27
  without that guess. They figured it out over the
• 5:29
  last two years, like, very few companies failed because people
• 5:33
  were working from home like that, just wasn't a thing.
• 5:36
  And now the technology is here, the bandwidth is here.
• 5:38
  We have all the tools to make it effective.
• 5:40
  I think actually, the work-life balance has gotten worse because
• 5:44
  of it. I know that I spent a lot more
• 5:45
  time working that I do that, I would the commute is gone, which
• 5:49
  is really nice, but I think people have filled that time up
• 5:52
  to some degree with just even, you know, getting more work done
• 5:55
  or whatever. Maybe, so I think it's my
• 5:57
  opinion on it, I think. Think every job is a little bit
• 5:59
  different. Some there is probably a better
• 6:00
  idea to be in. Maybe there's some kind of
• 6:02
  hybrid, you know, I think we missed sort of like the human
• 6:04
  interaction, some things, but I don't see hybrid work.
• 6:09
  At least going away. I think remote will have to be a
• 6:11
  component of it. Just for people stay competitive
• 6:13
  because those are really smart people all over the world.
• 6:16
  And you're telling me you wouldn't hire like this rock
• 6:18
  star, you know, identity person just because, you know, they
• 6:21
  live in, you know, let's say North Carolina and the rest of
• 6:24
  the company is in, I don't know, San Francisco.
• 6:26
  Like that doesn't make any sense like bitches.
• 6:28
  That's not a good reason. Well, that comment you just made
• 6:31
  their brought me to the other the the plan B topic which was
• 6:36
  the Super Bowl ad from work day which was you're going around
• 6:40
  and calling everybody rock stars and like Ozzy Osbourne's in it
• 6:44
  and it's like hi I'm Oswalt. That's good commercial.
• 6:48
  I enjoyed it. I think it's you know I don't
• 6:51
  know if it's overused term rock star.
• 6:53
  Whatever me but I think you know one thing that I always like to
• 6:55
  say is there's probably a bunch of you know, A hero's running
• 6:59
  around within an organization actually making it work.
• 7:02
  You know, I think a lot of organization wish they were like
• 7:04
  completely automated and had all the bells whistles Technologies
• 7:07
  and, you know, it just happens. It's magic right?
• 7:09
  Stuff like that. But the real, the real story
• 7:12
  behind it is this probably, you know, some were routine like,
• 7:15
  for and maybe, 20 people who are really done the scenes actually,
• 7:19
  making the stuff work, and they're going above and beyond
• 7:21
  on a daily basis, but we really care.
• 7:23
  That's right. And I think that for a
• 7:25
  management perspective, if you're in management, make sure
• 7:28
  That you Pat, those people on the back and let them know that
• 7:32
  they're valued and Etc and they are valued people will, if
• 7:37
  they're not, they don't feel like they're being taken care
• 7:39
  of. They will absolutely go look for
• 7:40
  something else. So take care of the people that
• 7:42
  are strategic to your organization.
• 7:44
  So as much as I love work from home, I've always felt like it
• 7:48
  should be done more. And now I'm glad to see it is
• 7:50
  where it is. I still like getting together
• 7:53
  with people, we've got a few conferences, lined up coming up
• 7:57
  and a Particular, I know I keep emphasizing this but the
• 8:01
  gardener I am Summit. You and I are doing a session,
• 8:04
  we're going to be facilitating. One's called was like inside the
• 8:08
  belly of the gardener Beast. We're going to have.
• 8:12
  Yeah, Henry K. And Becky to the, I am analyst
• 8:15
  over a gardener on stage with us and we're going to ask them some
• 8:18
  tough questions. Yeah.
• 8:20
  They've been pretty graceful with us and letting us really
• 8:25
  touch on a lot of topics. We had sort of our first
• 8:27
  planning, Last week to kind of run through here is.
• 8:30
  Here's the idea. Here's the sort of questions
• 8:32
  that we're thinking about asking are these, okay.
• 8:35
  And we didn't hit anything. That was a know yet and some of
• 8:37
  them I think it will be, you know, polarizing shocking.
• 8:41
  Put them on the hot seat a little bit.
• 8:43
  Maybe make them play defense for a little bit, which I always
• 8:45
  find, you know, interesting. But we'd love to have as many,
• 8:50
  you know, questions as we can from our listening audience.
• 8:52
  So, feel free to hit us up on LinkedIn, Twitter Mastodon.
• 8:56
  All the places that were at, And those in, if you we have people
• 9:00
  who've sent them in anonymously, some people are fine with having
• 9:02
  their name attached to it, you know, I will put my journalist
• 9:06
  hat on which doesn't exist. And say, I will protect sources
• 9:09
  and not tell you know where things came from and things like
• 9:12
  that. If it's an if it's an especially
• 9:15
  challenging question, right? I think we want challenging
• 9:18
  questions, not mean questions. Like, you know, hey Jeff, why
• 9:21
  are you so short? I do, I just am next question.
• 9:24
  You know, there may be right but you know, those types of
• 9:26
  questions like is Gartner, Foreplay, you know, before you
• 9:30
  tell me that it's not pay for play because of course, you're
• 9:33
  going to say, it's not, why isn't it, right?
• 9:35
  Explain that sort of system. So those types of questions, I
• 9:38
  think will be interesting to kind of put them on.
• 9:40
  We have 30 minutes and we have a lot of content already.
• 9:43
  So we're looking for the best of the best.
• 9:46
  I've seen a few themes, come through some sort of by
• 9:48
  combining similar questions and to maybe, you know, one or two
• 9:51
  is kind of go things go his lines but it's it's going to be
• 9:54
  fast. I mean, that 30 minutes is going
• 9:55
  to be over before you even know it.
• 9:56
  And I will be Surprised if we get through half of what we
• 10:02
  like, have scheduled as we go through it.
• 10:05
  Yeah. And so the other thing that I
• 10:07
  wanted to mention, not sure when this episode is going live, but
• 10:11
  we are doing out. Idac podcast Community meet up.
• 10:17
  We're looking at it being Monday night, I'm sorry.
• 10:20
  Just a night at Gartner. So, if depending on when this
• 10:25
  episode goes out, if they're still open, Spas, while the link
• 10:29
  to the registration in the show notes, if it's not there.
• 10:32
  It's because, you know, the episode went out late and maybe
• 10:36
  it's all filled up already because we will have a limited
• 10:38
  number of spots. So encourage you to get out
• 10:41
  there register, if you can make it and we'd love to have you.
• 10:45
  Yeah. What do you have planned?
• 10:47
  You've been working on this for a little bit with different
• 10:50
  counterparts kit. Can you share yet with that is
• 10:52
  or do you want to wait? I'm going to share it so the
• 10:57
  idea is that we're going to go to an axe throwing event.
• 11:03
  So this place that we found has ax throwing and like retro video
• 11:09
  games, like Donkey Kong and Miss Pac-Man, and stuff like that.
• 11:12
  So everybody will get to be there.
• 11:14
  Have things to do. Socialized will be food Etc.
• 11:19
  And so I was able to line up a few organizations, including the
• 11:23
  one that you and I work for our SM, just sponsored the event.
• 11:27
  The, the other sponsor going to be OCTA and one Cosmos, but it's
• 11:32
  an event for the listeners of this podcast.
• 11:35
  So, feel like I work for a competitor of one of those three
• 11:39
  sponsors, I don't want to go there.
• 11:40
  That's not the idea. The idea is this really about
• 11:43
  the identity at the center podcast and the people who
• 11:45
  listen to it. So you know consider yourself.
• 11:49
  Welcome. Yeah definitely and you know,
• 11:52
  come on man, throw axis, that's hot.
• 11:54
  Her done that. I'm looking forward to it.
• 11:55
  Yeah. So why don't we?
• 11:57
  Let's see what else we got. We got identifiers coming up in
• 12:00
  May I think you and I are working on getting out there for
• 12:02
  that. We got your pain identity and
• 12:03
  Cloud conference from Cooper. Nicole is out in Europe,
• 12:07
  obviously coming as well. I don't think we'll be at that
• 12:10
  one, but that's always a great conference.
• 12:12
  I think a lot of people get, a lot of value out of that one
• 12:14
  too, right? Yeah, yeah.
• 12:16
  And I think, you know, RSA is attended by a lot of identity
• 12:20
  people as well. So, you know that one's coming
• 12:23
  up as well. Well, and then we get into the
• 12:25
  fall where, you know, I think it's probably a little too early
• 12:28
  to start talking about those conferences, but, you know, you
• 12:32
  and I are kind of like conference junkies, like you
• 12:35
  can't really come up with the conference that we wouldn't be
• 12:38
  interested in attending. Yeah, I mean, it's a great way
• 12:42
  to network and talk with people meet folks stuff like that,
• 12:46
  continuing education, right stuff, like that.
• 12:48
  And especially if we can get the podcast out there to do stuff,
• 12:50
  that's always interesting to be able to sit down and have
• 12:53
  conversations. Since you know, like we've done
• 12:55
  for previous conferences. I'm sure we'll do for future
• 12:58
  ones as well. Absolutely.
• 13:01
  All right. So why don't we get to our topic
• 13:04
  of the day? And I think we haven't settled
• 13:06
  on a title this but my working title is identity and access
• 13:10
  management from a cisos eyes. So why do we invite some Cecil
• 13:14
  eyes into here? We've got Helen patent, she's a
• 13:17
  chief information security officer for the Cisco security
• 13:20
  business group. Welcome to the show Helen.
• 13:23
  Yeah, thanks. For having me here.
• 13:24
  I'm excited. Yeah pumps.
• 13:27
  So let's get into it. I think one of the things that
• 13:29
  we always like to do with first timers on our show is we kind of
• 13:31
  understand their identity journey and their background and
• 13:34
  kind of understanding. What is the origin story for
• 13:36
  Helen patent? You know Cecil and the things
• 13:39
  that you've worked on in the past they have formed, you know
• 13:41
  where you are at today is identity something that you
• 13:45
  chose or did it Choose You? It chose me?
• 13:47
  My whole career is a series of accidents and opportunities that
• 13:51
  I wasn't planning for so I've been doing this security thing
• 13:57
  in, in various forms for longer than I care to admit.
• 14:02
  Now, certainly in the 90s. I was doing it.
• 14:07
  I hadn't got into the security space in the 90s, but a lot of
• 14:10
  the problems of it were identity related, active directory,
• 14:14
  structures, and this and that. And the other thing when I got
• 14:17
  into security proper it was it was at JPMorgan Chase.
• 14:21
  And I was there in the like from And for through 2013, and
• 14:28
  identity for the banks was a big deal.
• 14:30
  It was heavily regulated. It was, it was, it was a focus.
• 14:36
  So there are two kinds of identities that JPMorgan Chase.
• 14:39
  There is the employee identity store and then of course, there
• 14:43
  were customer identities my focus at the bank.
• 14:46
  There was around employee identity and there was a big
• 14:49
  focus at the time on certification.
• 14:52
  So I cut my teeth. Less on the tech of identity and
• 14:56
  more on the process of identity. And this is where I got
• 14:59
  introduced to Concepts like is identity as security function.
• 15:03
  Is it a, it function, is it a business function?
• 15:06
  Is that some combination of the three, you know, what does it
• 15:10
  mean to have a role? Do we only have defined roles?
• 15:15
  Does everyone have their own role?
• 15:16
  If everyone has their own role? Is it a roll?
• 15:18
  You know, those kinds of existential questions, so I was
• 15:22
  at JPMorgan for a while. I I left there and I went to
• 15:25
  higher education as a vertical and I went, and I was the sea.
• 15:28
  So for Ohio State and there I learned about the joys of
• 15:32
  munging together, your customer base, AKA your students and your
• 15:37
  employees and your alumni, and you're visiting Scholars, and
• 15:42
  every, and all your vendors, and everybody into a singular
• 15:45
  identity store, which blew my brain.
• 15:48
  So, I went from role-based access to attribute-based access
• 15:51
  to as soon as you leave, we're going.
• 15:53
  Cut all your excess off to. Hey, we're gonna keep your
• 15:57
  access for forever because you never know.
• 15:58
  Someday, you may come back, like what?
• 16:00
  Like a complete 180 in terms of the way we do access and
• 16:04
  identity and having to deal with identity Technologies in that
• 16:10
  environment is really hard. So, questions for Gardner, do we
• 16:14
  see consumer identity, and corporate identity?
• 16:19
  Merging is is a super important question for me to know.
• 16:24
  And then I left there and I joined Duo and Duo is part of
• 16:29
  Cisco and I am so I am now as it turns out the C.
• 16:33
  So for the security business group at Cisco for those who may
• 16:37
  not know Cisco does more than cell network gear.
• 16:39
  So we do a security thing and my job is is now to protect that.
• 16:45
  And so some of that is you know, how do we do identity management
• 16:49
  of cloud? How do we what does the role of
• 16:52
  identity mean in? Texting data stores, that don't
• 16:56
  sit on our own infrastructure, all of that kind of stuff.
• 16:58
  So much more into the tooling and the technology of it in this
• 17:02
  role, then I was in previous roles and all of those
• 17:05
  transitions were accidental and just a product of timing but I
• 17:11
  love identity it for me. Identity is the core of security
• 17:15
  and I will I will die on that hill.
• 17:17
  So yeah, I financially the mentioned last on the tech side
• 17:22
  of more in the business side of identity.
• 17:23
  And I think this is personally, I think this is a weakness that
• 17:27
  a lot of organizations have is not really understanding the
• 17:30
  business of identity. And I think that there's a lot
• 17:33
  of, you know, conferences and organizations that really don't
• 17:36
  spend enough time in that. I think a lot of people try to
• 17:38
  measure identity intelligence based on how much sam'l you
• 17:42
  know, do you know how much, you know, open ID code?
• 17:44
  Can you write in a great apps which is important stuff to
• 17:47
  know? Of course, you kind of need to
• 17:49
  know at least the basics of it. But yeah, I like to focus on the
• 17:53
  business side. Which is, I think, probably my
• 17:56
  particular strength is, how do you run an eye in program?
• 17:59
  You know what are the, I am program manager, things that
• 18:02
  need to happen, you know? You're out there, you know,
• 18:04
  shaking hands, kissing babies, you know, getting by in getting
• 18:08
  budgets together, right now? Okay.
• 18:10
  That's kind of makeup is examined.
• 18:11
  And then I turn it over to the smart people, to like, you know,
• 18:14
  Deuce do the actual stuff, but I think we have a blind spot in
• 18:17
  the industry about the non-technical side of identity
• 18:20
  which does us at the service. Because I think there's a lot of
• 18:23
  really Only smart people that would be really great for
• 18:26
  identity but there's this maybe there's a maybe just me.
• 18:28
  Maybe there's a perception that it's all you have to be
• 18:30
  technical for the identity. I don't think that that's true.
• 18:33
  Do you agree with that or you know you have different thoughts
• 18:36
  on it? Yeah, I think I'm probably
• 18:40
  somewhere in the middle and every time I get asked this
• 18:42
  question and I get this question asked a lot.
• 18:44
  I change my answer by the way so if you've heard me on another
• 18:47
  podcast and you're like this is a different answer is why I
• 18:51
  think there's need for for both when I At Ohio State.
• 18:54
  I had the pleasure of working with people who had had
• 18:59
  developed some of the identity solutions that we use in higher
• 19:03
  ed and they continue to support those things.
• 19:06
  And higher ed has a really complicated identity management
• 19:10
  structure and business process. It has to be dealt with.
• 19:13
  And there were technical people that were right in the center of
• 19:18
  getting identity to work, not only with all these different
• 19:21
  kinds of people. But also, So all these different
• 19:24
  kinds of applications and networking structures like as a
• 19:28
  c. So I would have networking
• 19:30
  vendors show up and go. What what networks do you use?
• 19:32
  And I go yes. Because we literally had some
• 19:36
  every piece of every vendors, networking equipment ever.
• 19:39
  And they all had different ways of managing identity and so you
• 19:42
  say single sign-on and well, what a single sign-on mean.
• 19:46
  So, you know, being able to work with developers who were dealing
• 19:49
  with shibboleth and other things.
• 19:51
  I learned so much and these people They've forgotten more
• 19:55
  technical identity information than I've gotten my you're like,
• 19:59
  I can't, I'm in awe, right? And where we messed up with
• 20:05
  identity was never on the technical side.
• 20:07
  It was always on the business process side and I'll give you a
• 20:10
  story around this security story.
• 20:13
  We decided I would never do this again.
• 20:15
  By the way, we decided we would fish our own people and so we
• 20:19
  went to our identity teams and we said give us everyone.
• 20:22
  And so being the literal All developers, they are, they gave
• 20:25
  us. Everybody turns out, we'd
• 20:27
  included people who had died in our fishing pool and some of
• 20:33
  them responded, huh? And the reason, some of them
• 20:36
  responded was that the employee had died but their spouse wanted
• 20:42
  to use their OSU identity to get football tickets.
• 20:45
  So, the spouse kept the account active and because the employee
• 20:52
  was an, was a Ray, who was alumni, who was a professor
• 20:57
  emeritus, I who would come back and guest lecturer every now.
• 21:00
  And again, the HR department was not managing those identities
• 21:04
  because they weren't active employees, but neither was
• 21:06
  anybody else. So we had all these sort of
• 21:09
  emeriti Faculty, who ultimately would die, but their accounts
• 21:14
  never would. And their accounts were being
• 21:16
  actively used for things that weren't caught at the central
• 21:20
  organization, right? So all of which is to say
• 21:22
  because I did this, Security effort of trying to fish people.
• 21:26
  We found out that we had this business process problem where
• 21:29
  when people retired HR stop thinking them as current
• 21:33
  employees and I had to go and fix the HR lifecycle problem in
• 21:36
  order to fix my identity problem, in order to fix my
• 21:39
  security problem. So it's not about the tooling,
• 21:44
  it's about the people in the process and then and then it's
• 21:47
  about the tooling. So we need people who can do all
• 21:50
  three. Actually, I would imagine that's
• 21:53
  a He interesting bar chart or like pie pie chart to look at
• 21:56
  was like here's the age of our respondents, you know, 02:21.
• 22:00
  And then there's like, dead and dead, a slice of the pie, right?
• 22:05
  Yeah, yeah, yeah. It's like mmm.
• 22:07
  Interesting. How that works.
• 22:08
  I guess OSU to, you know, the Ohio State University, right?
• 22:12
  Football tickets are probably pretty value.
• 22:13
  I'd imagine since this one of the Premier programs at least in
• 22:16
  the u.s. right, the show. Yeah, yeah, it's great.
• 22:20
  So Helen you're one of the Stroke your ego here a little
• 22:25
  bit. You're one of the big brains I
• 22:26
  think in the identity space but I think there's a lot of big
• 22:30
  brains in the I do space. But you put your thoughts out
• 22:33
  there. You've got a Blog.
• 22:35
  I've been looking at it and it seems to me, one of the main
• 22:40
  topics that you blog on is the intersection of identity and
• 22:44
  ethics. Can you explain to us at a high
• 22:46
  level? What that is, what?
• 22:48
  That means. Yes.
• 22:51
  Oh, I geek out. Out on technology ethics and so
• 22:56
  things like artificial intelligence are right now,
• 22:59
  completely ringing my Bell because there is like land mines
• 23:02
  all over the place to mix my analogies.
• 23:06
  I started blogging because I was wrestling with topics that I
• 23:12
  just couldn't go and find a LinkedIn learning school on and
• 23:17
  in our industry and identity and insecurity in general, there's
• 23:20
  so much sort of community knowledge out there and I was
• 23:23
  trying to Tap into it. So two things happened when this
• 23:29
  was still. When I was back at Ohio State
• 23:30
  won, I was asked to take on management of the digital
• 23:35
  accessibility team. So this is about making our
• 23:37
  Technologies accessible to people primarily through the
• 23:42
  Disabilities Act legislation. So people with visually
• 23:46
  impaired, functionally impaired, you know, whatever but it also
• 23:51
  coincided with a lot of stuff. Around.
• 23:54
  How do we do? Diversity, and equity, and
• 23:56
  inclusion, in organizations, within a company.
• 24:00
  But also for our customers and I was managing this identity team
• 24:07
  and all of those topics of equity and inclusion and
• 24:10
  accessibility and security all seem to fall into my lap all at
• 24:15
  once. And so, a lot of the blogging
• 24:17
  that I do tries to pull those things apart and then the second
• 24:22
  thing that happened was, when denied Either who became my boss
• 24:25
  when I joined Duo and Cisco came to be a keynote speaker at Ohio,
• 24:30
  State, for one of our cybersecurity days.
• 24:33
  And she talked about being the daughter of Aging, parents, and
• 24:36
  trying to manage help them manage their affairs, from a
• 24:39
  distance, when she wasn't them, and the banks had no way of
• 24:44
  provisioning her access to act on their behalf.
• 24:47
  Without having her having to have her, go to a lawyer and get
• 24:51
  power of attorney like the path. To her being a legitimate
• 24:57
  executive for her parents. Technically was really
• 25:02
  difficult. And at the same time, she was
• 25:04
  also the mother of a Teenage child and she was managing the
• 25:08
  Affairs of the teenage child. And the same thing was applying.
• 25:12
  And so what if you combine all that Equity access inclusion
• 25:17
  question with the, how are we living our lives today?
• 25:20
  Question it really sent me down there This this path of are we
• 25:25
  designing our systems and identities, right in the middle
• 25:28
  of it? Are we designing our systems in
• 25:31
  such a way that people can live the lives?
• 25:33
  They want to lead using the systems that we have and I
• 25:38
  haven't I'm not hugely optimistic that we are actually
• 25:42
  doing that at the moment. And so I want to continue to
• 25:45
  have that conversation globally. To see how we can collectively
• 25:50
  deal with this because they don't think we're going to solve
• 25:52
  this as individual companies. Technologist.
• 25:54
  I think it's going to have to be a collective effort, so I know
• 25:59
  there are places doing it, but, but that's why I blog about it.
• 26:02
  Just to get people thinking about it and raising the
• 26:04
  questions. Probably keep going back to your
• 26:07
  experience at OSU, but I've worked with a lot of large
• 26:11
  research institutions and the identity management challenge is
• 26:16
  probably more difficult than any other industry.
• 26:19
  Now, Financial Services, you've got the regulatory, The
• 26:24
  environment and that is like insane price.
• 26:27
  So you went from the higher ed or there's basically no
• 26:33
  regulatory except maybe FERPA Oh you mean by that?
• 26:41
  So let me run this down. I'll student data.
• 26:44
  Al financial aid is regulated like a bank where subject to
• 26:47
  glba our hospitals. HIPAA, we got that our retail
• 26:52
  and we got millions of A retail PC, I know, except for all of
• 26:58
  our nuclear reactors and other things that we've got going on,
• 27:03
  all the FAA stuff. Because guess what, we had an
• 27:05
  airport of our own leak. If there is a regulation, cmmc
• 27:11
  fedramp blah blah blah. It's happening on Research
• 27:15
  universities but what we do is segment our environment.
• 27:19
  So all the PCI stuffs over here. All the hippest stuff is over
• 27:22
  there and what's really Ali confusing.
• 27:24
  Now, is that all these? It used to be that the
• 27:28
  individual colleges were segmented.
• 27:30
  So you could go. Okay.
• 27:31
  Helen works for College of Medicine.
• 27:33
  She's going to be subject to HIPAA.
• 27:34
  We're going to manage her identity that way.
• 27:37
  Well, the problem is now that the College of Medicine is doing
• 27:39
  shared research with the College of Engineering and the School of
• 27:42
  Dance, go figure and all of them have different regulatory
• 27:46
  profiles, and now we've got to manage to multiple regulatory
• 27:50
  profiles its when I left JP, I thought I was going to higher ed
• 27:56
  which would be easier. Oh God, I was so so wrong.
• 28:01
  Like Financial Services is high pressure.
• 28:04
  I get it. But from a security and identity
• 28:07
  perspective, it is easy peasy. You want hard?
• 28:09
  Go to universities is crazy. Okay, sorry, I retract that
• 28:14
  comment but we hey we're doing this conversation real-time,
• 28:17
  right? So, but really where I was going
• 28:20
  with the conversation was around to decentralized.
• 28:23
  Nature of, you know, universities, you typically find
• 28:28
  that there is a kind of like a corporate it where you have like
• 28:33
  a net ID or maybe it's your buck.
• 28:35
  I hid for Ohio State. I'm not sure.
• 28:38
  I made that up actually, the Buckeye date.
• 28:41
  Well guest. All right, and then you have all
• 28:45
  of your colleges and Departments of rub.
• 28:47
  Basically run their own, it Department, right?
• 28:49
  And so, Where are you going with this decentralized?
• 28:54
  Decentralization is tying it to the idea of decentralized
• 28:58
  identity verifiable credentials and kind of the future of that.
• 29:04
  So I'm not sure if there is a tie in but I wanted to just
• 29:07
  explore that with you. Do you see where I'm going with
• 29:10
  this? I do.
• 29:11
  And I will say that in the eight years that I was in higher ed.
• 29:15
  I did start to see a move at least from a technology
• 29:18
  architecture perspective to more of a Realized function.
• 29:22
  So there's a lot of downward pressure on universities to be
• 29:25
  more efficient in their dollars, so that we're not charging our
• 29:28
  students so much tuition. And so there was this
• 29:31
  recognition that having multiple it departments in multiple
• 29:34
  places, didn't really make sense.
• 29:35
  So, one of the things we did at Ohio State, for example, every
• 29:40
  college and Ohio State has lots of colleges had their own active
• 29:44
  directories. Probably more than one, right?
• 29:48
  We had a big program where if We couldn't get rid of those active
• 29:52
  directories, we at least linked them so that identity management
• 29:56
  cascaded through the active directories.
• 29:58
  And it wasn't just an independent identity for every
• 30:03
  college and that kind of thing. So, we centralized and
• 30:06
  rationalized to the degree we could.
• 30:10
  But there's a lot that goes on in universities that you just
• 30:13
  doesn't make sense to do that for sure.
• 30:15
  The other thing that's happening sort of is this concept of bring
• 30:19
  your own identity? Is that a Is that a way of
• 30:22
  dealing with it? So in universities, more than
• 30:25
  any other verticals, we're seeing this trend of people that
• 30:29
  want to have a separate identity at work, and digital identity at
• 30:32
  work, and a separate one at home.
• 30:34
  They just want the same that they want it to be all the same.
• 30:39
  So is there an opportunity to do distributed identities and be
• 30:44
  able to use that both in a consumer sense, and in a
• 30:47
  corporate sense, I think you'll see that to be played with at
• 30:52
  universities. There's certainly also a sort of
• 30:54
  a secondary thing that says, can we put transcripts on the
• 30:59
  blockchain and so rather, if you have to go to a new school
• 31:03
  because maybe your undergrad was at one school and you want to do
• 31:06
  your Masters and you doctor at another school started having to
• 31:08
  go back to your old school and say, please can you forward the
• 31:11
  transcript from from here to there?
• 31:13
  Can you just bring your own use it where you need to use it and
• 31:18
  be able to just you know, shop yourself around a little bit.
• 31:21
  We're seeing that on that transcript side.
• 31:24
  I think the concept is the same on the digital side of
• 31:29
  identities. The infrastructure behind.
• 31:32
  It's pretty massive though. So, and again it goes back to
• 31:35
  people process and tools. It's not just the technology,
• 31:37
  the process. And the people have to be able
• 31:39
  to handle that too. So, I think we're a long way
• 31:41
  from it, but I would say look to universities as a, as a testing
• 31:45
  ground for a lot of that stuff. For sure thing.
• 31:48
  Testing grounds are great idea. You know, it's kind of like, I
• 31:51
  favor the term self Sovereign, identity over.
• 31:54
  Bring your own identity. Yeah, that's great.
• 31:56
  Been around long enough. To remember, bring your own
• 31:58
  identity used to mean log in with your Book ID.
• 32:01
  And I don't even as a student, I don't want my Facebook.
• 32:09
  Which I would think most gen Z's and more recent don't even use
• 32:14
  Facebook anymore, but they used social media and you want some
• 32:18
  separation between your professional life and your
• 32:21
  personal life. But what got me thinking about
• 32:25
  this topic? A lot was, I heard that there's
• 32:29
  some Legislation potential that would be going through or up for
• 32:35
  a vote anyway that you know basically they say okay you have
• 32:41
  to be a certain age to sign up for social media.
• 32:43
  Now conceptually we can say whether or not that's a good
• 32:48
  idea. But ultimately if regardless of
• 32:51
  what the age is, what are the penalties?
• 32:53
  If the company drops the ball, unless the person who created an
• 32:57
  account and how is that going to?
• 33:00
  To work behind the scenes. So I'm wondering like, okay.
• 33:04
  Well, you know, if the penalty is like, hey, for everybody who
• 33:07
  you let take an account whose under this age, if it's a ten
• 33:11
  thousand dollar fine. I mean, this could really rack
• 33:14
  up if you don't have good processes to stop it.
• 33:17
  So I'm thinking maybe that's an area where these self Sovereign
• 33:21
  IDs, really can can take effect decentralized identity
• 33:26
  verifiable credentials. You know, can we get to a point
• 33:29
  where It's like your government issued ID or some reputable
• 33:34
  organization can vouch for the fact that you are of a certain
• 33:38
  age. For example, it's an it's a
• 33:41
  super complicated topic and I'm watching it with interest.
• 33:45
  So in the u.s. we already have the copper regulation which is
• 33:48
  about protecting minors online, right?
• 33:51
  Which already says things. Like if you're under I'm going
• 33:55
  to get my age is wrong. I'm not a lawyer don't quote me
• 33:57
  on this, but if you're under the age of, I think it's 16 your
• 33:59
  parents. Have to consent to you being on
• 34:02
  an online platform and how well is that working out for us?
• 34:05
  There's that sort of question, but there is also the question
• 34:08
  of if we're going to do Sovereign identities, does that
• 34:14
  presume that the person who owns that identity is legally able to
• 34:21
  own that identity? Like, what what makes someone
• 34:25
  eligible to be the owner of a sovereign ID?
• 34:30
  And if it's legal, well then they can't have a sovereign ID
• 34:33
  until they're 18 depending on the state or 21 rate.
• 34:38
  There's no Federal Regulation that says, legal age of owning
• 34:41
  digital assets. Maybe they're going to need to
• 34:44
  create one. So there's sort of a question
• 34:47
  of, are you legally able able to enter into a sort of a
• 34:52
  contractual agreement? That says, my sovereign identity
• 34:55
  is going to be used to access this corporate thing whether
• 34:58
  it's tic toc or Of our there's that.
• 35:01
  And then there's also a question of usability is the technology
• 35:05
  to a point where a minor a ten-year-old or an
• 35:09
  eleven-year-old can actually use this thing and let's not get
• 35:14
  into the conversation of digital accessibility of sovereign
• 35:18
  identities which is a whole different ball of wax.
• 35:21
  But let's just say for the typical ten-year-old, how easy
• 35:26
  is it going to have to be to be usable and Have we got those
• 35:30
  structures in place and right now the answer is no, we don't.
• 35:34
  And we're going to have to think of all of those things before
• 35:38
  we're going to be able to bring Sovereign identities to the
• 35:41
  table. Yeah, I think you're referring
• 35:44
  to the Copa regulations which I believe is 13, but I'm not sure
• 35:48
  what the penalties are. If you let somebody in who's
• 35:52
  under 13, it's interesting. I went to a Jack Daniels website
• 35:57
  if you know me that you're not surprised but It's you know
• 36:01
  first screen was splash page. Are you at least 21 years old,
• 36:05
  or put your birthday and something like that, right?
• 36:09
  What's the summary from lying? Nothing?
• 36:12
  No. Come on.
• 36:13
  Everyone tells the truth on the internet.
• 36:14
  Yeah. Well and quite frankly every
• 36:17
  security person ever never puts their real birthday, right?
• 36:20
  We all lie like everyone's birthday is like, 1st of January
• 36:24
  1985 or something, right? So old enough to be dangerous,
• 36:28
  but not my real birthday. Like there is no way to validate
• 36:33
  that the information being put into any of these fields is
• 36:37
  accurate. It's all self-reported.
• 36:39
  So why should kids be any different?
• 36:41
  I want to ask you a question going back to you know
• 36:45
  University is a breeding ground or testing ground or for the
• 36:50
  decentralized identity. It got me thinking about and
• 36:53
  going back to my original opening dialogue, with Jeff
• 36:56
  about work from home. You know I started in the
• 36:59
  workplace in the 90s couldn't have liked working from home was
• 37:03
  like it was just not done, you know if it snowed You can still
• 37:10
  take a snow day and not a right now days.
• 37:13
  Like this knows it's like, you're expected to be online
• 37:17
  like any other day. So there's the technology aspect
• 37:22
  part of it was, you know, working back then.
• 37:25
  If you had a laptop you could bring home, you were in the
• 37:28
  minority, right? And you were connecting with a
• 37:30
  modem, so the technology has gotten a lot better but also,
• 37:36
  you know, entering the workforce at that time as a young person.
• 37:39
  And it's kind of like there were people who worked in that
• 37:42
  company for 30, 40 years and people just didn't do that sort
• 37:48
  of thing. Now you've got folks who are
• 37:51
  coming up who, you know, there were, you know, a little kids in
• 37:55
  the backseat on iPad and they had technology as part of the
• 38:00
  life from the, from the very beginning of their life.
• 38:03
  And I'm wondering, you know, this push for.
• 38:07
  I-i'm me, I want to use my Generally how much of that is
• 38:11
  the technology versus? How much of that is being driven
• 38:15
  by, you know, the fact that they are, you know, digital first
• 38:19
  their whole life. It's a super good question.
• 38:22
  I have I challenge the whole, they're digital Natives and and
• 38:27
  they just know what to do know. They don't like, we're old Duo
• 38:30
  out at Ohio State and we rolled it out to everybody.
• 38:36
  Pretty much all at once. We rolled it to all our faculty
• 38:39
  and staff. Staff.
• 38:39
  And by the way, a third of our student body are also staff
• 38:43
  because we pay them to work on campus, right?
• 38:46
  The biggest issue we had in rolling out Duo was not using
• 38:50
  Duo the biggest issue. We had was helping people find
• 38:54
  the app store on their phone find the app store.
• 38:58
  These are our digital natives finding the App Store really
• 39:02
  rate. So the two year old who's in the
• 39:05
  back of the car seat with an iPad, I guarantee you is not
• 39:08
  going to be using a nice An iPad when they turn 18 and they show
• 39:11
  up in the work force because iPads won't exist in.
• 39:14
  So, the, the technology they're learning May probably will not
• 39:19
  be the technology they have to work with.
• 39:22
  And this is true for our teenagers and our college
• 39:25
  students today. So, You know, hopefully by the
• 39:31
  time they become 18 year olds and going into the workforce or
• 39:35
  21, year olds or whatever that we do have Sovereign identities,
• 39:40
  but they won't have grown up with it.
• 39:41
  It'll arrive when they're like 14 or 15.
• 39:45
  So they're in there is much in the dark as this 50 year old
• 39:48
  woman is sitting here, right? Because the technology is
• 39:52
  changing too fast. What the technology is doing?
• 39:55
  It's making it easier to use because I remember, What tech
• 39:58
  was like in the in the 90s I had to build my own PC and I mean
• 40:02
  the whole box not like I just went to Micro Center and got a
• 40:05
  box and plugged it in and work like this whole Self Service
• 40:09
  thing that we do for people. Now, it's sort of like cars, you
• 40:13
  know, in the old days you had to build your own car and be your
• 40:16
  own mechanic and now, like you don't, you should probably, but
• 40:23
  you don't and, and we're doing the same thing with text, so
• 40:26
  we're calling all these kids did.
• 40:28
  Will - no no we've just made the tech easier to use and by the
• 40:31
  way, a particularly in the identity space, the people that
• 40:34
  really know identity. They're about to retire.
• 40:38
  So we've got a knowledge retirement Cliff that is about
• 40:42
  to happen in Security in identity in some of the
• 40:46
  technology fields that I'm not sure we're quite ready to deal
• 40:50
  with and that's a whole different topic by the way.
• 40:52
  But but yeah, it's it's it's going to be a thing.
• 40:58
  NG and I don't think our schools.
• 41:02
  I don't think our K through 12 or our colleges are preparing
• 41:05
  our students properly for what they're going to be facing
• 41:08
  digitally and from an identity perspective.
• 41:10
  They're just not Yeah, I couldn't agree more but
• 41:15
  hopefully the answers are my next question is not so dark and
• 41:19
  dystopian because I want to know what is the future look like.
• 41:23
  I mean it seems like the Technology's there that you
• 41:28
  know, it could recognize you tie you to a record or identity.
• 41:34
  I mean this could get to the point where it's very automatic
• 41:37
  that you know, maybe goes even Beyond.
• 41:40
  I would assume some point it goes Beyond the point of self
• 41:45
  Sovereign identity that, you know, it just could recognize
• 41:49
  you and tie you back to your hell and patent your Jim
• 41:52
  McDonald. Etc.
• 41:54
  But I think there's the counterbalance, which is that at
• 41:58
  least today we expect some level of privacy, right?
• 42:02
  That's why we don't, you know, agree with the idea of like,
• 42:06
  you're walking in the mall and there's cameras watching you and
• 42:10
  just identifying you and knowing everywhere.
• 42:12
  You go because we expect some level of privacy.
• 42:16
  What do you see in the future? I mean, do you see the this
• 42:19
  privacy wall breaking down and Technology over?
• 42:23
  Is it a good future or a dystopian future?
• 42:26
  So you wanted something that was positive and uplifting GM.
• 42:29
  And I'm about to go deep back down into this dope, Ian angst,
• 42:33
  and despair with this question. I have to tell you, I know it's
• 42:37
  okay. You're okay, Helen, this is par
• 42:40
  for the course for Jim. He loves to bring this down
• 42:42
  here. There is a lot of work being
• 42:47
  done around how to manage this balance between privacy and
• 42:51
  access and privacy and convenience which sort of parts
• 42:56
  of this conversation, but they're the people who are
• 42:58
  thinking about it. I'm going to generalize really
• 43:01
  badly here and I'm sure there's people out here who don't fit
• 43:03
  this mold. But in general, the people
• 43:06
  thinking about these questions are sitting in think tanks and
• 43:09
  universe. These are not practitioners and
• 43:11
  the people who are Building Technology and other
• 43:14
  practitioners of the day-to-day, don't have time to think about
• 43:17
  these things. Deeply and strategically, and
• 43:21
  we've got no regulation right now that deals with it, like the
• 43:24
  Privacy regulation. He's I can sum up every privacy
• 43:27
  reg ever and it is don't lose any pii.
• 43:34
  Like, we can get into definitions of what pi is.
• 43:37
  And you know what the definition of lost is, but as far as
• 43:42
  regulations, he's concerned, it's about confidentiality, not
• 43:46
  the right of privacy. It's not, there's no regulation
• 43:50
  that says as a company. You can't hold someone's
• 43:53
  privacy, Hostage to convenience, like someone should have as much
• 43:58
  convenience as anybody else and be able to have control over
• 44:02
  what they want to share and how they want to.
• 44:04
  Share, share it, right. But we're not doing that yet.
• 44:09
  And so right now Technologies plowing ahead at a million miles
• 44:12
  an hour and the people who are thinking about, what would it
• 44:14
  take from a regulatory operational framework, kind of
• 44:19
  way to make this work. They are not.
• 44:23
  They are not in sync and they're not talking to the degree they
• 44:26
  should. And so, I think we're going to
• 44:30
  continue to see privacy thrown up as a barrier to Ecology
• 44:34
  progress. But I think the bigger issue
• 44:37
  isn't with the consumer interface, which is where we're
• 44:40
  seeing this. The bigger issue is with the
• 44:42
  data analytics and the data control that goes on behind the
• 44:48
  scenes. So a lot of the Privacy stuff is
• 44:50
  like when it when a consumer goes to your website, they
• 44:53
  should be able to choose which cookies that are activate.
• 44:57
  That's not their biggest. Privacy risk, their biggest
• 44:59
  privacy risk, is the fact that you can go and buy Healthcare
• 45:02
  information online. Line that is meant to be
• 45:05
  anonymized. But actually, if you look at the
• 45:07
  data, you can find out who it is.
• 45:10
  Who the Australian woman sees who's sitting in Columbus Ohio,
• 45:14
  who just went to the doctors and found something that she would
• 45:18
  like to keep be kept private. Thank you very much.
• 45:20
  It's all out there. So we need, we need again,
• 45:24
  people process and tools, the whole back end process of, who
• 45:28
  knows what. And what they do with that
• 45:30
  information is the bigger risk. That I don't think we've Not
• 45:34
  solved yet. Jeff, do you have any thoughts
• 45:36
  on that topic? I mean how and I think a tire
• 45:39
  think are thinking the same lines, here is I guess the other
• 45:43
  thing I'll add is a lot of these controls that I see, I feel like
• 45:47
  our first show. They don't really do anything
• 45:49
  and they're not, they don't they don't make an impact.
• 45:54
  Okay? Now every website I go to has
• 45:57
  this stupid cookie thing that either I can click OK.
• 46:00
  Or I can X out of it or I can hit the The really small button
• 46:05
  that says, let me go manage my cookies and then do a bunch of
• 46:08
  things before I get to. The thing that I want to get to.
• 46:10
  It's a usability problem. It just I'm glad you hit that
• 46:16
  one Helen because I find those so irritating and so useless
• 46:20
  that they just it doesn't make any sense, right?
• 46:24
  So technology can can help and Technology can also enable Bad
• 46:31
  things and people have to make decisions around that.
• 46:35
  And again, I've always been a, my sandbox moment is, we need
• 46:41
  practitioners to have a voice in to some of the think tanks and
• 46:44
  some of the policy engines that are going on, in identity, and
• 46:47
  in all kinds of security areas and the practitioners are oft
• 46:51
  practicing and they don't have time to do this other stuff.
• 46:55
  And we got to find a way to bring them together because the
• 46:59
  you know, those really smart People working on shibboleth at
• 47:02
  Ohio State, for example, have all kinds of input into what we
• 47:07
  need to be doing to be managing identities, in a secure and
• 47:11
  private way, but they haven't got time to go up to Capitol
• 47:14
  Hill and talk to a senator about it.
• 47:15
  We you know, we've got to find those bridges.
• 47:18
  Yeah good luck trying to talk to anybody.
• 47:21
  There's actually going to make it happen in your role as a c.
• 47:24
  So I guess what are some of the threats that keep you up at
• 47:27
  night, you know, from a security perspective or I Identity
• 47:31
  perspective. I'm just curious.
• 47:33
  You know, what is it that concerns you that we should be
• 47:35
  watching out for if you'd have asked me this 10 years ago, I
• 47:38
  would have rattled off all the threats of the day.
• 47:41
  I've got to a point where a threat is just a threat.
• 47:45
  It's another threats, different kind of threats going to be a
• 47:47
  threats. Got, there's always going to be
• 47:48
  a threat. It's it's a thing for me though.
• 47:54
  I'm going to say people, but that sounds trite.
• 47:56
  I'm going to say people. And I don't mean because I think
• 48:00
  people are the weakest link. I think that's an easy out to
• 48:04
  say our processes suck, but we're going to blame the person
• 48:07
  cuz we can like when you need a throat to choke.
• 48:10
  It's got to be a people throat. It can't be a process throat or
• 48:13
  governance throat. So what do I, what am I
• 48:17
  concerned about? I am concerned that organization
• 48:22
  and Society leaders. Do not understand the systemic
• 48:26
  risk that we are all facing and I think that they can manage
• 48:31
  their risk as an independent Silo and they can't.
• 48:36
  And I think as a society, we're going to something something
• 48:41
  society-wide will happen. And we will realize that we just
• 48:46
  didn't get it right. And and super people will run
• 48:48
  around and fix it and everyone will go.
• 48:50
  Whoo, boy, we dodged that bullet, aren't we good?
• 48:53
  That's great. But one of the reasons I see so
• 48:57
  many people in security burning out, is because Cuz we've been
• 49:01
  working this for a really long time and really even though the
• 49:04
  threats have changed the attitude towards it hasn't
• 49:07
  really significantly changed yet.
• 49:10
  So the things that worry me are one that we're going to have
• 49:14
  something really big and we're not ready for it.
• 49:17
  That's sort of the community concern level.
• 49:20
  But at a tactical level, I'm actually concerned about the
• 49:23
  mental health of our technologists and our, and our
• 49:26
  practitioners. I think that is a bigger problem
• 49:29
  that we need. To be thinking about.
• 49:32
  Now, it's kind of refreshing. I don't normally hear that.
• 49:33
  Answer from folks is taking care of people.
• 49:36
  Basically, we're talking about, this is an identity podcast, for
• 49:40
  the most part, when we're not talking AI or other things, but
• 49:45
  I'm curious, you know, from a sea so perspective again, and
• 49:49
  kind of, we putting that hat on. We are always looking for
• 49:52
  funding to get things done and as I see, so I'm sure you're
• 49:57
  juggling multiple funding priorities and say, okay, well,
• 50:00
  You know, I have this part of the budget and I'm sure your
• 50:02
  budget is constantly, you know, being added to shrunk, you know,
• 50:06
  changed up throughout the year. What is some tips that you can
• 50:11
  give to Identity people out there who know they need to get
• 50:15
  stuff done? And they need to go to a seesaw
• 50:17
  or somebody to get funding, like, what is a tip that we can
• 50:20
  say, okay? Here's don't, come to me with a
• 50:23
  problem. Country is a solution, right?
• 50:25
  Those types of things. But, you know what?
• 50:27
  How can we get more funding, allocated, take care of some of
• 50:29
  these. Done with your identity issues
• 50:31
  that might be out there. Yeah.
• 50:33
  Assuming right. That the other things are
• 50:35
  covered the people, the process, you know, things like that.
• 50:37
  Right? Yeah.
• 50:39
  Every organization is going to have a different cultural way of
• 50:43
  allocating resources. So it's going to be really
• 50:45
  company dependent, but organizationally dependent.
• 50:49
  If one of the things that I have seen to be successful, is to
• 50:53
  look at whatever the organization is doing, that is
• 50:55
  their big priority item. Now to the degree.
• 50:59
  And I Identity team can get involved in these conversations.
• 51:03
  Early enough is going to be a bit of a challenge, but every
• 51:07
  organization has got some big effort that is there sort of
• 51:10
  Flagship effort that's going on. It could be some kind of digital
• 51:14
  transformation thing. It could be, they're moving in,
• 51:17
  they're doing mergers and Acquisitions.
• 51:19
  It could be they're going into a new country.
• 51:21
  It could be any of those things. Those big projects are
• 51:24
  opportunities to do something, interesting and identity
• 51:27
  management, you're not doing it necessarily for the Company.
• 51:30
  But you're doing it for that thing and when you do that, you
• 51:33
  get the money because that if you make the case that identity
• 51:37
  is important to that thing and I can't think of any place in an
• 51:41
  organization where identity isn't an important contributing
• 51:44
  factor. But to the degree you can say
• 51:47
  hey this big thing you want to do.
• 51:49
  You need to make sure your identity processes tools,
• 51:52
  whatever are ready for this tie. The funding of what you need to
• 51:57
  get that thing to that big project.
• 52:00
  And then when it's successful, I'm trusting, here's my
• 52:02
  optimistic side of medium. When that successful then you
• 52:06
  can go and say, look what we did over here, we should be doing it
• 52:09
  elsewhere and you can grow it. So that's how that's a bit of a
• 52:13
  big company answer but that's sort of how I see it on a
• 52:17
  smaller side. I think there's opportunity to
• 52:21
  work perhaps with a customer. If you're in the if you've got
• 52:24
  that consumer, sort of identity side of things, go find a
• 52:28
  customer with the unique use case that Think identity can
• 52:30
  support and then go partner with their customer to get the
• 52:34
  funding for that kind of effort. Again, prove that it works and
• 52:38
  then grow it across. The team is a great way to go.
• 52:40
  So I've seen those kinds of strategies work, but good luck.
• 52:46
  It's always it's always hard. I love that answer Helen.
• 52:51
  I really don't have anything to add.
• 52:52
  Except yeah, that's what that's what I've seen is.
• 52:57
  Well, if you could tie, I am to a bigger and Issue of like
• 53:00
  digital transformation like an MMA.
• 53:02
  I mean that's that's what there's budget carved out for
• 53:06
  that big initiative and if you can make your case, you can get
• 53:09
  a chunk of that funding. So you've been super generous
• 53:13
  with your time today but I want to try to get as much content
• 53:18
  for our listeners out there as possible.
• 53:21
  And so I'm going to bring you out on to the lightning round or
• 53:25
  I'm going to throw a few topics out there and ask you, where are
• 53:28
  we at in the hype cycle? All for that technology and why
• 53:35
  so, you know, one to two minutes.
• 53:37
  So the first one is AI in the context of I am.
• 53:41
  I'm going to get my hype cycle terminology wrong, but I'm, I'm,
• 53:46
  I think it's in the trough of Despair.
• 53:49
  Yeah. Yeah.
• 53:50
  We don't have to use the, the Tactical hype cycle terminology.
• 53:54
  Yeah. To let you off the hook for
• 53:56
  that, you know, we're at a point every vendor is going.
• 53:59
  Out there and saying, we've got AI for this and AI for that.
• 54:02
  So, first of all, I want to call BS.
• 54:04
  I think we've got really fast machine learning.
• 54:06
  I don't think we've got AI in the way most people understand
• 54:10
  AI to be, but I also think if you go and buy that tool with
• 54:16
  the AI, there is sort of also an assumption that that tool
• 54:19
  integrates with your rest of your Tech stack and often it
• 54:22
  doesn't. So I think the promise of AI is
• 54:26
  there and I think there are some folks who are starting to
• 54:29
  leverage it. But it is fine.
• 54:32
  It is proving to be more difficult than people thought.
• 54:35
  And so I think people are sort of it's like, touching a hot
• 54:40
  stove. It's like, you know, you get
• 54:41
  this momentary flash of and then your back away from it.
• 54:45
  I think people have touch the hot stove of AI and now they're
• 54:49
  backing away from it going. Okay, we got to wait and see
• 54:51
  when this is got to get a little more usable before we can really
• 54:54
  get value out of it. Yeah, I think it's I'm going to
• 54:58
  pull it back to a Thing you brought up earlier where you
• 55:01
  would build your own car you know how to work on it and it
• 55:05
  seems like nowadays, you just have a computer chip in your car
• 55:09
  and you don't know how it works. It just works and to me that's
• 55:14
  the part of AI in your I am context is like it's going to
• 55:19
  start doing things. And if you don't know, if you
• 55:22
  can't predict how, you know, it always seems like business
• 55:26
  process. When you automate business
• 55:29
  process, you had to. How it would work if it was
• 55:31
  manually, step-by-step happening.
• 55:34
  You couldn't just say, well, the computer shifts going to take
• 55:36
  care of that and we trust the computer chip, but I think
• 55:40
  that's where AI is taking us so good.
• 55:43
  Good answer on that one. The next one, I'm not sure if
• 55:46
  you've heard of this before, but it's zero, trust zero trust.
• 55:54
  I I'm actually really bullish on zero trust, although you get 100
• 55:59
  people in the room. You get three definitions of
• 56:00
  what zero trust is. So on the hype cycle, I would
• 56:06
  still say it's emerging. I think if you talk to most
• 56:09
  people, they would tell you, they're beginning, their zero,
• 56:11
  trust Journey. They're not fully into it yet
• 56:14
  even the Google as might think that they're not quite fully
• 56:18
  into it yet. So emerging, but I think the
• 56:23
  potential of getting zero trust if you get it right,
• 56:26
  particularly in the ident. So let me put a death Around it.
• 56:30
  I know this is lightning round and I'm not helping here through
• 56:33
  the lens of identity. I think zero trust becomes more
• 56:37
  Dynamic, authentication, and authorization and continuous
• 56:42
  authentication and authorization.
• 56:45
  It's not zero. Trust it's like contextual trust
• 56:48
  and I think identity has a huge role to play in that.
• 56:51
  I think the challenge has been that the companies have tried to
• 56:54
  use tools to do zero trust and not made it an identity first.
• 57:00
  Activity. And I think if they make it an
• 57:02
  identity first activity, they're going to get further and faster
• 57:05
  further along faster. You know, I've been to our say
• 57:08
  the last couple years and last year, I came away with the
• 57:11
  message that art zero trust has been solved because literally
• 57:14
  every single product there was some sort of zero trust I in and
• 57:18
  I feel like this isn't a New Concept been around for at least
• 57:21
  a few years. If not more, it's this is the
• 57:23
  marketing term that's being used.
• 57:25
  Now for this, you know, continuous it's an occasion
• 57:28
  really which is what you just Hit on.
• 57:31
  And I'm curious though that the u.s. government has put out now,
• 57:35
  you know, memorandums and other things to say, hey zero trust is
• 57:39
  where you should be going. How does that affect cisos?
• 57:42
  Do they look at that and say, yeah, well, you know, no crap.
• 57:44
  We already that's, we already knew that.
• 57:46
  Or does it spur a call to action to say, hey, if it's good enough
• 57:51
  for nest, and federal government and CSUN stuff like that?
• 57:55
  Yeah, we should be looking at it if I haven't already been
• 57:57
  thinking about that. Like I guess the question there
• 57:59
  is Is how much does guidance from government help?
• 58:05
  Inform a cisos strategy when it comes to that sort of thing?
• 58:08
  Honestly, I don't think it does a lot.
• 58:11
  I will I'm actually I've read all of the federal government's
• 58:14
  documents about it. And there is a whole sort of
• 58:17
  cascade of documents from a strategy document, to an
• 58:19
  architectural, diagram to a standards like the, you know,
• 58:23
  Nest, I. So I'm going to get it wrong.
• 58:25
  120 nist 127, something like that.
• 58:28
  Anyway, I read all of them. Give Lee.
• 58:31
  It's actually really great reference document so if you
• 58:33
  don't even know where to start zero trust, that's a that's a
• 58:36
  really good place to go. Look.
• 58:38
  But you've got to remember, they wrote it for the federal
• 58:40
  government. They didn't write it for the
• 58:42
  Silicon Valley startup. They didn't write it for the
• 58:45
  hospital in the midwest. They wrote it for federal
• 58:47
  agencies and so you can you take what is you take what resonates
• 58:52
  and you leave the rest. So I don't know, a see.
• 58:56
  So who doesn't create a strategy by going out and looking at sort
• 58:59
  of The landscape of things, what's happening?
• 59:02
  Where are they compared to? Where they're seeing the
• 59:04
  industry, go, all of those things, this is just another
• 59:07
  data element for them to consider, but unless they're to
• 59:09
  see so of an agency, it's not going to be a driver.
• 59:13
  Do you guys remember the most likely and group?
• 59:16
  It was a Saturday Night Live skit.
• 59:17
  Actually, as a PBS show, as they would do, like our lightning
• 59:20
  round, then John McLaughlin would go wrong.
• 59:24
  Compensating controls will continue to make zero trust and
• 59:29
  unimportant. Factor.
• 59:31
  Yeah, possibly. So alright.
• 59:34
  That was just eating away at my brain so I had to throw it out
• 59:36
  there. All right, the third lightning
• 59:38
  round item is blockchain again. Within the context of I am nice
• 59:43
  n't on the hyped Dyson time. Again, I think identity is one
• 59:48
  of these places where you, it's hard to solve purely with
• 59:51
  technology and so the I think that, you know, the idea of
• 59:57
  using the blockchain is intriguing.
• 1:00:00
  Where we can take it, I think is being explored.
• 1:00:04
  But again you've got to have if you're going to consume it as
• 1:00:07
  either an individual person or as a company in your, in part of
• 1:00:10
  an identity management team, it's got to be able to play with
• 1:00:13
  all of your other pieces and all the other pieces aren't ready
• 1:00:16
  for it yet. So I would give it a 5 to 10
• 1:00:21
  year Horizon to be able to be really ubiquitous you think it's
• 1:00:25
  a still a solution in search of a problem or do you think the
• 1:00:30
  Albums have been identified. It's just taking longer to
• 1:00:32
  really figure out and apply the solution correctly.
• 1:00:35
  Neither actually I think the way we do technology is someone
• 1:00:40
  comes up with the idea for Tech and they come up with a use case
• 1:00:43
  and they go out and they realized that the use case they
• 1:00:47
  thought they were solving for wasn't really the use case that
• 1:00:50
  it was a best fit for and we iterate on that, right?
• 1:00:53
  So I think blockchains going through the same thing.
• 1:00:56
  People are going to iterate on it for a while before we We find
• 1:01:00
  the mesh of this is a technology that solves this kind of
• 1:01:04
  problem. Right now we're going, we think
• 1:01:05
  this technology can solve this kind of problem.
• 1:01:08
  Let's test it out. That's where we are.
• 1:01:10
  I think at the moment I I think someone will find a really valid
• 1:01:15
  use for it. I don't think they've done it
• 1:01:17
  yet. I don't think they've done it
• 1:01:19
  yet. The valid use for, it usually
• 1:01:22
  comes about because of either advances in other kinds of
• 1:01:25
  technology which is certainly on on the cards and I think
• 1:01:29
  blockchain and Artificial intelligence are really closely
• 1:01:32
  linked. Actually, so where as, as each
• 1:01:37
  side of those things improve that that will accelerate the
• 1:01:41
  movement for both of them, but the other piece to it is the
• 1:01:44
  regulatory, you know, what's the community willing to do and to
• 1:01:48
  tolerate, and I don't think the community writ large
• 1:01:52
  understands, how to use this stuff.
• 1:01:55
  Well, enough to have an opinion yet on on the blockchain side.
• 1:01:58
  All right, I know what I'm going for.
• 1:02:00
  An hour and but I have to follow up here in something.
• 1:02:02
  You just said the the linking of AI and blockchain.
• 1:02:07
  I think is really interesting because I think if they were
• 1:02:10
  working together, it might solve some of the issues.
• 1:02:12
  The early issues that we're seeing now with things, like
• 1:02:15
  chat GPT and Lambda, and barred, and all that stuff out there
• 1:02:20
  with sources of information being used for treating data.
• 1:02:25
  If that training data was part of a blockchain, theoretically,
• 1:02:28
  you could opt in or Opt out and track where that data was coming
• 1:02:32
  from. And it's just when you when you
• 1:02:34
  talked about it being linked together, I wonder if that is
• 1:02:38
  something that is in the cards for, you know, the this this
• 1:02:42
  future of where data may be shared, sort of the self
• 1:02:45
  Sovereign identity and the associated data that might come
• 1:02:50
  along with that identity and where it may or may not be used
• 1:02:52
  to be able to track it, and I don't know if there's an answer
• 1:02:55
  for it now, it was just an interesting.
• 1:02:57
  You know, thing picking wait my brain here as we were talking
• 1:02:59
  but yeah. Any reaction to that.
• 1:03:03
  This is where I'm hoping that people are actually paying
• 1:03:06
  attention. I trust that there is some
• 1:03:08
  researchers somewhere doing this work and I'm looking forward to
• 1:03:12
  seeing that published or someone listening to this podcast
• 1:03:16
  telling me it's already been done and finding me on LinkedIn
• 1:03:18
  and telling me that. But yeah I think that the what
• 1:03:24
  the blockchain brings is some Assurance of Integrity of data.
• 1:03:30
  And some Assurance of immutability we can get into
• 1:03:33
  arguments about how immutable a blockchain item is and all that
• 1:03:37
  kind of stuff. But I think that brings that I
• 1:03:39
  think that what the AI promises to bring is the ability to
• 1:03:45
  understand context really really quickly and to be able to gather
• 1:03:50
  disparate data sources and make connections that we wouldn't
• 1:03:54
  otherwise be able to see for ourselves but what it lacks is
• 1:03:58
  any level of confidence in Integrity or immutability.
• 1:04:01
  And so I think they're I think they can prop one another up
• 1:04:05
  that way. So I'm looking forward to seeing
• 1:04:07
  that happen. I think it's happening but I
• 1:04:10
  haven't seen it in any sort of commercial sense yet.
• 1:04:14
  Yeah, I think it's just interesting and I'm bullish on
• 1:04:16
  the i stuff I think like you kind of still figure out where
• 1:04:19
  the leverage, you know, when is Chatty Patty.
• 1:04:21
  Gonna take my job. I think, things like that,
• 1:04:24
  right? But until it's until it's in a
• 1:04:27
  spot where I think, You know, people can trust the data and
• 1:04:32
  Trust the response that that trust in the identity is going
• 1:04:36
  to have to be a key part of it. And just Jim's gonna smile
• 1:04:39
  because that's upcoming episode that we're going to talk about
• 1:04:42
  his trust and identity with Eve mailer at some point.
• 1:04:44
  You're in. Excellent.
• 1:04:46
  Yeah. That's a good teaser.
• 1:04:47
  So you're welcome for that. Jim.
• 1:04:49
  Alright, so we've been going out for about an hour, but I do like
• 1:04:51
  to end on a lighter note around here.
• 1:04:53
  We've got really deep into the identity things and I think it's
• 1:04:58
  safe to say that we're all a little A bit nerdy.
• 1:05:02
  Just haven't gotten to know each other over the last, you know,
• 1:05:03
  couple hours or so. We've been kind of been meeting
• 1:05:05
  and prepping and stuff like that and recording this.
• 1:05:08
  And I'm curious. What is everyone's nerdiest
• 1:05:10
  hobby? That you might have I'm looking
• 1:05:13
  at Helen and I'm looking at her visual background.
• 1:05:16
  I see some really interesting things and maybe that's it.
• 1:05:19
  Maybe there's other things that are that she considers nerdy and
• 1:05:23
  I know that and I mean this as a term of endearment, right?
• 1:05:26
  I think having interesting hobbies and cool.
• 1:05:30
  The people do an aside is fascinating can understands the
• 1:05:32
  human side of things. But what is the nerdiest, what
• 1:05:35
  you think is the nerdiest hobby? You have Helen want you go
• 1:05:37
  first? Yeah, so my background right
• 1:05:40
  now. Includes some Lego Star Wars,
• 1:05:42
  but that is actually not the nerdiest thing that I do.
• 1:05:45
  So for the longest time, I can't, I don't, I don't know
• 1:05:48
  when this started but I geek out completely geek out on business
• 1:05:53
  management books. And when I was at Ohio State, I
• 1:05:58
  had the opportunity to do, My masters in public policy.
• 1:06:01
  So that, that pivoted slightly I went from just sort of, generic
• 1:06:07
  management books. Like How to be a good leader,
• 1:06:09
  and how did, how to make change in an organization.
• 1:06:12
  Now, I've pivoted to policy, technology policy books.
• 1:06:17
  So as we think about things like the adoption of sovereign and
• 1:06:22
  identities. What is the policy implication
• 1:06:24
  of that? Who in the federal government at
• 1:06:27
  the u.s. level or the Australian level, or the British Whatever
• 1:06:31
  who gets to decide what that policy is, how would they decide
• 1:06:34
  whether the policies, giving them the outcomes, they want
• 1:06:37
  that kind of stuff. So, on a weekend you will find
• 1:06:40
  me with, you know, cup of hot chocolate or glass of wine, or
• 1:06:44
  whatever, and a policy book, and my husband thinks I'm a complete
• 1:06:49
  idiot. But that's, that's my nerdy
• 1:06:52
  Hobby and I must admit, I'm starting to Pivot a little bit
• 1:06:55
  more now into ethics. May, I Identity, ethics,
• 1:07:00
  accessibility ethics. That kind of stuff.
• 1:07:02
  So it's all munging together in my head and you've written a
• 1:07:05
  book and I'm there. So I want to give it a chance to
• 1:07:07
  talk about that book, that you've written.
• 1:07:10
  But what's a other than your own, which, of course is require
• 1:07:13
  reading. What's a recommendation for a
• 1:07:15
  book perspective? That you think people should be
• 1:07:17
  checking out? So there's a book called
• 1:07:22
  artificial intelligence, by Russell and norvig, and it is,
• 1:07:25
  it's a textbook. So again, nerdy Hobbies, I read.
• 1:07:30
  Books for fun. But it is a textbook about
• 1:07:32
  artificial intelligence in the use of artificial intelligence
• 1:07:35
  in in society. And this question that Jim
• 1:07:39
  raised around, you know, how much are we willing to trade
• 1:07:42
  privacy for usability and accessibility and those kinds of
• 1:07:45
  things and it really opened my eyes to some thinking, so worth
• 1:07:49
  a read, all right? And then we're reading actually
• 1:07:51
  the Phoenix project internally as part of our identity team and
• 1:07:55
  security able team here at RSM. So we have at the book club for
• 1:07:57
  this quarter. So yeah, I blasted through In
• 1:07:59
  the first month or so of the year.
• 1:08:01
  So I'm kind of ahead of the game where everyone we try to do like
• 1:08:03
  a couple chapters like five chapters, every couple weeks or
• 1:08:05
  something like that. And we come together as part of
• 1:08:07
  a group to kind of discuss, you know, thoughts and feelings
• 1:08:09
  around it. So definitely recommendation for
• 1:08:11
  people who are looking who are looking for more of like a
• 1:08:15
  fiction based approach to learning ITI.
• 1:08:19
  Think it's really fascinating, it's not it's probably the
• 1:08:21
  opposite of a textbook. I would type isn't I am part of
• 1:08:26
  a committee of folks we that runs the cyber security Canon.
• 1:08:30
  Which is a list of books that have, we've all read that we've
• 1:08:32
  done a reviews on that's in cyber security.
• 1:08:35
  So if you go to cyber security Canon.com, you will find that
• 1:08:38
  link and all everything in it. Phoenix project was one of our
• 1:08:42
  Hall of Fame award winners at, but I will tell you is the sea.
• 1:08:45
  So the character of the sea. So in that book is a complete
• 1:08:48
  bumbling idiot and I resent the implication, but it's an
• 1:08:53
  excellent book, loved it, loved it.
• 1:08:55
  The Seesaw transformation that book was very interesting.
• 1:09:00
  But I think it's a good lesson for folks to keep, you know, to
• 1:09:03
  take back to their because I think the the personalities are
• 1:09:07
  probably the more along the lines that aside the name like
• 1:09:10
  us, Jim. What's your nerdiest hobby?
• 1:09:14
  Well, I think all of my hobbies are very cool.
• 1:09:17
  Otherwise I wouldn't do them. But I just a cool guy, man.
• 1:09:20
  But my my hobby that most people probably think is extremely
• 1:09:24
  nerdy. As I love watching documentaries
• 1:09:29
  and My favorite documentary is the Civil War by Ken Burns.
• 1:09:34
  I watched it the first time in the late 80s, with my father,
• 1:09:38
  watched all like Eight Episodes and I don't know if you ever
• 1:09:41
  seen it but no no don't say that.
• 1:09:43
  I want to know what happens if you want to know what happened.
• 1:09:47
  So 90% of the documentary is black and white photos and
• 1:09:52
  storytelling and there's a lot of you know, different voices.
• 1:09:57
  Like Morgan Freeman is in it. It and Sam Waterson is in it and
• 1:10:03
  I don't know, I just love it. So I'll be watching it on TV and
• 1:10:07
  my son will sit down and watch it for about 15-20 minutes.
• 1:10:11
  He's like, Dad, can we watch something else?
• 1:10:15
  What do you mean? This is great.
• 1:10:17
  Why would I'm watching this for the 30th time?
• 1:10:20
  And I love it. So, that's my insolent.
• 1:10:23
  I've seen it too. He also the National Park series
• 1:10:27
  that he did was also just like that.
• 1:10:30
  Excellent. So and there's one called the
• 1:10:32
  West which is also really well done.
• 1:10:34
  I mean all of his I'm Ken Burns is a genius, right?
• 1:10:38
  Yeah. Vishal so here's a nerdy fact
• 1:10:40
  for you. Ken Burns is an actual effect in
• 1:10:45
  Apple's motion and Final Cut software.
• 1:10:49
  And basically what it does is you can choose the photo effects
• 1:10:52
  as you're putting together a video on timeline.
• 1:10:54
  So here I am explaining my nerdiness is and it's actually
• 1:10:57
  called Ken Burns in the actual software.
• 1:10:59
  And it's you set a point in time for one focus on the picture.
• 1:11:04
  And then another another spot on the picture and it will slowly
• 1:11:07
  pan between the two to give you that effective what you've seen
• 1:11:10
  in his cylinders. Yeah.
• 1:11:11
  So they redid that documentary and basically did that effect to
• 1:11:16
  a lot of the pictures so that they it's more visually
• 1:11:19
  interesting but I guess I prefer the old one.
• 1:11:22
  Yeah I guess myself it's not going to come as a surprise.
• 1:11:26
  Probably anybody? Who knows?
• 1:11:27
  Me I'm just a general. Tech geek.
• 1:11:30
  So I'm constantly playing with stuff software Hardware, just
• 1:11:34
  trying to find the next cool thing that I think is
• 1:11:36
  interesting, and I don't know if it's necessarily nerdy but I
• 1:11:40
  collect bags, backpacks, much to my wife's Chagrin because I have
• 1:11:46
  at least three dozen different styles of backpacks, and travel
• 1:11:52
  bags, and things like that. My search for the Holy Grail of
• 1:11:55
  the perfect bag is still eluding me.
• 1:11:58
  I've got a bag for every Occasion Dua, one bag.
• 1:12:01
  Travel to bag travel as this. You know, how many days, you
• 1:12:05
  know, I've gotten it down to a science where I can, I can
• 1:12:07
  pretty much travel for. I would say, you know, a week on
• 1:12:11
  one bag something that splits under under the under the front
• 1:12:14
  seat of an airplane, just to make sure that things go
• 1:12:17
  through. So I think that's probably like
• 1:12:21
  the nerdiest thing I do. I know if it's dirtiness so much
• 1:12:23
  as kind of a weirdo thing, but there's a subculture out there
• 1:12:26
  for like bad collection, things like that.
• 1:12:28
  So that's my nerd. This one, I don't know, maybe
• 1:12:31
  it's just me. I know.
• 1:12:33
  My husband is also a bad collector.
• 1:12:36
  I yeah, I get it and I, I feel for your wife, she's always
• 1:12:42
  like, well, can you get rid of that one?
• 1:12:43
  I'm like, no, I might be, I might use that one someday and
• 1:12:46
  that's how bad it is. Like some of these, I have not
• 1:12:48
  taken out of the house yet, but there is this.
• 1:12:51
  It's almost like sneakers, you know, there's people who like
• 1:12:53
  click whilst speakers and things like that.
• 1:12:55
  And my idea is at some point, you know, maybe it'll appear in
• 1:12:57
  my video background. Some point will be like If this
• 1:13:00
  imagining like this pegboard wall, with all the bags, I've
• 1:13:04
  collected, and I'm not talking like, you know, cheap bags
• 1:13:08
  packed, these are like handcrafted unique.
• 1:13:12
  You do not like I run the mill so that, you know, the more the
• 1:13:15
  unique, the better. But I'm always looking for like
• 1:13:17
  the perfect bag to take with me ends.
• 1:13:19
  I had, you know, my wife gets a kick out of me whenever we're
• 1:13:21
  going on a trip. I will unpack repack several
• 1:13:25
  different styles of bags which is the one I want to take this
• 1:13:28
  time. And she just Yeah, Happy
• 1:13:31
  Valentine's Day holiday way to my wife but yes I you know I'm a
• 1:13:36
  bad collector. So all right.
• 1:13:38
  Well let's go ahead and leave it there for this week.
• 1:13:42
  I'm going to go ahead and put a couple show notes.
• 1:13:45
  Helen you mentioned there was one about the the book club or
• 1:13:49
  the Bic the site was it? Cyber security Canon or
• 1:13:51
  something. Yeah cyber security Canon like
• 1:13:53
  cannon, not tenancy. Inon like the camera, not like
• 1:13:58
  the artillery. Although, I guess if you could
• 1:14:02
  throw them at someone's face if you wanted to, but yes, we try
• 1:14:04
  to be nice. So I'll put a link to that in
• 1:14:06
  the show notes. I'll put a link to your, your
• 1:14:09
  website. See.
• 1:14:10
  So Helen.com which also has other links to things you done.
• 1:14:15
  Maybe we'll make the wall of fame with the different podcasts
• 1:14:17
  and things that you've been on make that on there.
• 1:14:20
  And then, of course your LinkedIn, I'm sure people will
• 1:14:22
  be happy to reach out. We always like to throw people
• 1:14:24
  into the fire and say, hey, Helen will be glad to connect
• 1:14:27
  with you, and you can tell her how But you agree or disagree
• 1:14:31
  with her and very polite, and diplomatic ways, right?
• 1:14:35
  And the same thing for Gemini, right?
• 1:14:36
  You can always reach out to us on LinkedIn again.
• 1:14:37
  We're going to be a gardener in March, we're looking to
• 1:14:40
  crowdsource very difficult challenging questions for the
• 1:14:44
  Gartner identity and access management analysts Henry came
• 1:14:47
  Becky. So if they're listening be
• 1:14:48
  prepared and hopefully we'll be able to you know, really put
• 1:14:53
  them on the hot seat so to speak and you can connect with us.
• 1:14:56
  We're on the web. Idac podcast.com we're on.
• 1:14:59
  Twitter at idac podcast. We're also on Mastodon idac,
• 1:15:04
  podcast at infosec dot exchange. Mastodon, get your stuff
• 1:15:09
  together. It's very difficult to, you
• 1:15:12
  know, get that out and make sure people on the right servers and
• 1:15:15
  all that good stuff. So, alright, and then don't
• 1:15:17
  forget to subscribe and, you know, like the podcast and leave
• 1:15:20
  us a review. Some of that, we got some really
• 1:15:21
  great reviews or last couple months.
• 1:15:22
  I've been trying to put those on Twitter as I get time to kind of
• 1:15:24
  highlight that. So it's always good stuff.
• 1:15:27
  That's a free way that you can help us continue to And great
• 1:15:30
  guests like Helen to the show, makes us be more makes us appear
• 1:15:34
  more important than we really are.
• 1:15:35
  So that's always helpful Helen, thank you so much for being with
• 1:15:39
  us and Jim, as well as thanks for your time.
• 1:15:42
  And with that, we'll go ahead and wrap it up for this week and
• 1:15:44
  talk with everyone. And you've been listening to
• 1:15:48
  Identity at the center. We hope you've enjoyed the show,
• 1:15:52
  make sure to like rate and review and we'll be back soon,
• 1:15:56
  but in the meantime, hit the website at Tea at the center.com
• 1:16:01
  and find us on Twitter at, idac podcast.
• 1:16:06
  See you next time on identity at the center Tea at the center.com
• 1:16:01
  and find us on Twitter at, idac podcast.
• 1:16:06
  See you next time on identity at the center