Latest / Identity at the Center / #403 - Strategic Identity Security with Simon Moffatt

Transcript

#403 - Strategic Identity Security with Simon Moffatt · Identity at the Center

0:05
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:13
Hey, Jim. Hey, Jeff, how are you?
0:15
So bad yourself. I'm great.
0:18
You know, I sent you a text message on Friday.
0:20
I think you ignored it, but it was about this idea of attack
0:24
pass, identity attack pass, which really is just blown up as
0:30
like a, you're looking at your text messages to see if I
0:33
actually said it. I did or I sent it to somebody
0:37
else who resembles you. And I said, this is a topic we
0:41
need to dive into in the podcast.
0:44
And lo and behold, we've got a guest today who's going to help
0:47
us understand attack pass, identity attack pass, whatever
0:51
you want to call them. It's a hot.
0:53
It's a hot topic. Yeah, I'd say so.
0:56
I mean, I think identity has taken on so many new forms now.
0:58
It used to be humans and then we got non humans and AKA I gentic
1:02
and a bunch of other stuff that's been going on.
1:04
So sure, why not? That's what we're supposed to be
1:07
doing, right? Identity security.
1:08
That's kind of like the point. And I don't remember this text
1:12
either, by the way. So I I ignore a lot of your
1:15
text. That one.
1:15
I specifically do you remember? Do not remember ignoring.
1:18
OK, so when you ignore them, it's an intentional thing.
1:22
Right. Yeah, that's it.
1:24
Let's see. Yeah, go ahead.
1:26
No, we've got a bunch of conferences.
1:28
Probably exactly what you were going to say is that we got a
1:30
bunch of conferences coming up and discount codes galore.
1:34
I mean, if you haven't planned for, if you haven't thought
1:37
about going to conferences this summer, I'm not sure if it's too
1:41
late. But if you haven't, if you
1:42
haven't booked anything yet, definitely jump on those
1:46
conference codes. Yeah, save some money.
1:48
Yeah, save some money. And that's on the website
1:50
idacpodcast.com. Just Scroll down.
1:52
I have the few listed there. I think we've got Ideniverse and
1:55
EIC listed. Let's see, by the time people
1:58
hear this one, I think it'll be February 23rd and I might be in
2:04
New York later that week if my dates are right.
2:06
I'm trying to think, remember the dates we have, but I'll be
2:08
in New York for the Cyber Risk Alliance, the Ideniver, not
2:13
Idiverse, but it's like a cybersecurity summit there.
2:15
I'm monitoring a panel, and then I'm in Chicago the week after
2:18
that too. So if you're interested in
2:19
attending New York or Chicago, let me know.
2:21
I can pass you along a a discount code via LinkedIn so.
2:25
Yeah. So identity security, we're
2:28
going to talk about it today. We've got our guest.
2:30
He's been with us before, Simon Moffett.
2:32
You probably already know him as the founder and analyst of the
2:35
Cyber Hut. He's also a fellow.
2:37
I am podcaster for the Analyst Brief podcasts.
2:41
And welcome back to the show, Simon.
2:44
You can hear that we're actually having a fire alarm just just as
2:48
we start the podcast, we are having a fire alarm going off.
2:51
So I don't know how whether that's real or not real, I guess
2:55
we'll see how that evolves. But it's it's great to be back
2:58
for as long as I can. I can be here for certainly.
3:03
Well, I love the fact that the alarm went off because we are
3:05
talking identity security and you know what better way to make
3:08
an intro assignment. I think you planned this.
3:10
It was literally the word security appeared there, just it
3:13
started doing the thing. So let's give it a few seconds
3:16
and hopefully it might disappear and the security situation may
3:20
have resolved, but it's great to be back and great to be talking
3:23
about something which I think is hugely important and hugely
3:27
involved as well. Yeah, so there's a lot going on
3:30
in the space. And, you know, safety is
3:32
paramount here. So if if we detect heat in your
3:36
area, feel free to drop. But we'll keep going on until
3:39
until either you're charged to a crisp or decide to vacate the
3:42
premises. Why don't we start with our last
3:44
conversation? Because you were with us back in
3:46
episode 347 and you were working on a book.
3:50
How did that book go? And for people who aren't
3:52
familiar with that conversation, go back and check it out.
3:54
But maybe give a quick plug for what the book's about and how it
3:57
went. Yeah, absolutely.
3:58
I might have one here actually looking in colour on there.
4:02
So this was this was my second book actually.
4:04
So this was IAM at 2035. So the idea was to look at
4:10
where's identity heading to 10 years from now, a decade from
4:13
now, which is a long, a long time in any technology field.
4:18
Technology is changing hugely with the advent of AI.
4:22
So a decade seems a long, long time.
4:24
And the idea of the book was to really try and not just give
4:28
some pithy predictions around what may happen, but sort of
4:32
educate not just identity practitioners, but all of the
4:36
non identity world as well. So data, cyber, business owners,
4:41
application owners, developers, all of these other stakeholders
4:44
who are now really interested in what identity is, where it's
4:49
been, what problems we have and obviously what technologies and
4:54
solutions are going to exist 10 years from now.
4:55
So that was a release. But yeah, about the sort of
4:59
early part of 2025 which was, which was actually super.
5:03
And as always, these things never a long burn.
5:06
You know, the idea of, of any book is my, my first book was
5:10
looking at consumer identity sort of five or six years ago.
5:15
And I'm thinking, oh, that's, that was ages ago.
5:17
People are interested in consumer identity.
5:19
Obviously they are, it's still a huge, huge thing.
5:22
So books tend to stick around for a long, long time.
5:26
I'm very, very grateful for people who have bought it,
5:28
people who are using it and, and getting in touch and, and
5:31
thankfully saying very nice things about it.
5:33
So it's, it is a, it's a labour of love at the time, but it's
5:37
good to see see stuff out there and people using it and people
5:41
getting in touch and commenting languages which is great.
5:44
The books are kind of like a time capsule, right?
5:46
Kind of was kind of like this podcast and I'm sure you know
5:48
the podcast you do it day, Arthur and David, they will live
5:51
forever. And you know, people are going
5:54
to look back on this time and think, wow, what Neanderthals
5:57
these people were when it came to identity Nexus management.
6:01
But this is what we're this is what we're living right now.
6:03
We can only kind of work around that.
6:04
I think writing a book is interesting and maybe you and
6:08
Jim can share some notes because Jim is working, you know, on one
6:10
as well. But do you have other books sort
6:13
of in progress or ideas like what's next?
6:16
Oh. You always have ideas.
6:19
I'm writing all obviously all the time is not list you writing
6:22
reports and articles and sort of short form content.
6:25
I haven't got any immediate plans for a third book, albeit
6:30
sort of James Bond Never Say Never Again sort of saying it's
6:35
not on the horizon right now. But it's that's not to say, you
6:38
know, it seems change. There's sort of three or four
6:41
years between book 1 and book 2. So I think you need a little bit
6:45
of, of, of time off. And as I said in books, they do
6:49
last a long time. So it's not a case of doing
6:52
well, then you forget it. You're sort of like a musician
6:55
really, sort of you do an album, then you have to then sort of
6:58
tour the album, not maybe metaphorically is a book or two,
7:01
but you're sort of talking about it and using it in constantly as
7:05
part of your sort of narrative. So it's still very much fresh in
7:08
sort of what I'm doing, I guess, day-to-day.
7:11
But as you know, maybe ask me a year of a team's time.
7:14
I've not, I've not got the I've not got the writing book just
7:17
yet to to sit and do another sort of big, a big stint book.
7:20
But you never know. There's plenty of plenty of
7:22
great topics out there to to tackle.
7:25
We've referenced the podcast a couple times, the analyst brief
7:28
and like I said, you do that with our friend David Mahdi
7:30
who's who's awesome and typically see him at on a
7:32
conference tour and things like that.
7:34
Tell us a little bit about the podcast, how's it going and
7:37
anything new that we should be looking forward to?
7:39
It's no, it's great. We love it.
7:41
It's not as it's not as you know, glamorous is is identity,
7:43
the sensor. Of course, you guys have got
7:45
that got that monster. But no, we do.
7:47
We do, though. I think it's, you know, we try
7:49
and tackle there's, there's so much happening, I think in
7:52
identity and, and, and by that, you know, we're looking at
7:54
things like mergers, acquisitions may be acquired
7:58
next new topics emerging like a Gen. take.
8:01
And we literally recorded the podcasts yesterday looking at a
8:07
couple of acquisitions that happened in the identity
8:09
resilience space. That's a new area which has
8:12
emerged the last two or three years.
8:14
So we are trying to try to look at those sort of contemporary
8:17
events and acquisitions and the vendor sort of changes that are
8:21
constantly happening there. So that is that's sort of where
8:24
we say which we try and do it 2-3, four times a month.
8:28
So it's, it is, it is good for we do, we do meander in lots of
8:32
directions, mainly because there's there's so much we do
8:35
try and try and cover as much as that as we can.
8:39
Yeah. You guys are also both big
8:41
thinkers, which I think kind of contributes to it.
8:44
We could talk about one topic all day for sure, but kind of
8:48
shifting into a lot of what you're working on now.
8:51
I think of the the root level of what I see is that you're
8:55
talking about how identity is shifted from more or less a back
9:00
office function to a strategic priority.
9:03
I'd like you to kind of expand on that a little bit.
9:08
Yeah, 100%. And again, it's like one of
9:10
these sort of 15 year overnight successes.
9:14
I think there's been a perfect storm of change around identity.
9:18
I think if you go back maybe 10-15 years, you have the, the
9:22
sort of the technical change of cloud, which I think altered
9:25
entirely how identity was delivered, how it was
9:29
integrated, how it was measured and how it was really used from
9:32
that perspective. But then simultaneously we had
9:34
things like zero trust, you know, again, zero trust being
9:38
around for a long, long time, yet organisations are still
9:42
trying to to get there. So you have this on network
9:45
change and that's it's a technical change, the budget
9:49
change, how people develop and buy networks.
9:52
You don't necessarily have offices anymore and routers.
9:55
You have more of a software defined view to that endpoint.
9:59
Security's changed, data security's changed and all of
10:02
those technical pillars are hugely reliant upon identity
10:07
being successful and identity being available, identity
10:11
integrating effectively. So suddenly it's gone from being
10:14
the the elder guy in the corner. And I was, I was the elder guy
10:18
doing the valve 25 years ago and nobody cared about that stuff
10:22
really unless it was not working effectively.
10:25
And then nobody can log in. Where's the LDAP guy get this
10:29
fixed? Whereas now it's actually, well,
10:31
customer identity is, is really important and fraud and zero
10:35
trust. And then we have data security.
10:37
So there's all of these other areas which are massively
10:41
reliance on identity being effective.
10:43
So it's suddenly has changed from being tactical and
10:47
reactionary to being strategic and an enabling technology that
10:52
helps revenue, helps productivity, it helps staff
10:56
gain access to the right things, helps with supply chains.
10:59
So it just has more tentacles, I guess to it.
11:02
And I think that's surreal. That's really exciting for those
11:06
guys who all love identity. But I think it brings different
11:10
responsibilities, different budget, different different
11:13
stakeholders as well, different, different people involved in
11:16
what is this identity stuff, you know, is it working effectively?
11:20
What what can it do for me essentially?
11:21
I think I know that's where that has changed.
11:24
And but I guess to answer your question, it isn't just one
11:27
single thing. I think there's a there's a set
11:29
of forces happening which have essentially moved it to being
11:33
this big sort of Super Bowl half time singer instead of being
11:36
just the guy doing a few songs in a pub.
11:38
It's like this. It's the massive attention on
11:42
identity now which is brings brings some challenges I think.
11:47
Yeah, I think that you've said identity as an enabler, and that
11:51
to me is at the core of it being strategic.
11:56
There's also the balance of a lot of companies to stay
12:02
compliant, and in some companies it seems like that's all there
12:06
is. What do you think the mistake is
12:09
that they're making? Again, this is multi
12:13
multifaceted. I think, you know, it's again,
12:16
it's often back to the case of not really knowing what identity
12:20
is doing, I think. And that's quite, that's quite a
12:23
complicated question to try and unpick.
12:25
And, and by that I mean, if you are say a retail bank pick
12:29
something relatively benign, I suppose, how is identity helping
12:34
and hindering that bank? Is it helping the staff do their
12:38
job? Is it helping them being
12:39
productive? Is it helping them sell more
12:42
retail bank services to customers?
12:44
So you sort of work out where identity is working and not
12:48
working. And I think unless you do that,
12:51
you end up with just these reactionary technical choices
12:54
and technical investments, the same as, you know, used to buy,
12:58
I don't know, something like daily basis maybe 25 years ago,
13:03
you look for the cheapest one or the one that could store the
13:05
most or it was often quite a small technical commodity sale.
13:09
And I think if identity is sort of seen as just this
13:13
infrastructure thing that we invest upon and then every 6-8
13:17
years we'll redesign. I think that that is, is, is
13:22
that sort of legacy mindset. I think we're not really seeing
13:25
the benefits a successful identity program can, can
13:28
develop. You end up being quite
13:29
reactionary sort of constant reacting to cyber threats or
13:33
reacting to business requirements or you're not
13:36
really strategic in, in what identity trying to achieve.
13:39
And that that can be quite, quite difficult to unpick, I
13:42
think. Yeah.
13:43
This idea of strategic identity, I mean, I think it's, it makes
13:49
it really jumps off the page when you're talking about
13:52
customer identity. So you know, creating a, an
13:57
experience that is fully integrated based on the identity
14:01
and kind of just knows what the person needs to access and kind
14:06
of pulls it all together on the back end.
14:09
The company can kind of see like what is this identity's full
14:15
relationship with our organization.
14:19
I'd like to bounce it back to you.
14:20
What are some of the other things that strategic identity
14:24
stand for? That's a really good, that's a
14:26
really good concept there because you absolutely spot on
14:30
because in, in, in that customer world, we were all customers,
14:34
you see, and that's the quite interesting things.
14:35
We all have opinions around interacting in a shop, buying
14:40
something, customer service. If you like a product or a, or a
14:44
experience, you tell your friends.
14:47
If you don't like it, you also tell your friends.
14:49
So you're going to be doing the sort of the recommendation sort
14:52
of thing there. So we're all familiar with, with
14:55
customers and consumers and even government services really.
14:59
And identity in that ecosystem is quite, it's quite transparent
15:04
if it's working or not working. You know, if you're trying to
15:07
buy something online and you have that shopping cart
15:10
experience, but then you're just about to pay and it asks you all
15:14
this stuff about who you are and your favorite colour and your
15:17
dog and your cat and your dress. And it's like, whoa, whoa, I
15:19
just want to buy a pair of shoes or something.
15:22
So identity in that instance is, is really transparent and it's
15:26
really obvious if it's working or not working, you know, to the
15:29
end user at least. And I think some of those ideas
15:32
of transparency, I think, have now been placed into other parts
15:36
of the sort of tech ecosystem. So you then think it is an
15:40
employee, OK, what's helping and hindering me from a technical
15:45
perspective to log into my laptop, gain access to the
15:48
systems I need, work with my colleagues, complete my job.
15:53
And suddenly again, you sort of look for that, that
15:55
transparency. Where's identity helping or
15:59
hindering? Is it Oh God, you know, I've got
16:01
10 different passwords because I don't have single sign on.
16:05
Or maybe you are using passwords, which is terrible.
16:07
You should be using pass keys or whatever MFA.
16:10
So you suddenly you start to see that that transparency where
16:14
identity is either frictionless and in the background or it's
16:17
suddenly I've got to do a big access request form because I
16:20
can't get access to this whatever SharePoint site.
16:23
Chinese do my job and I think the customer world is it is it
16:29
is allowing identity to sort of periphery to the top.
16:33
And I think some of those ideas are now applicable in the sort
16:37
of beta we and sort of supply chain area as well.
16:39
And that I think again it amplifies and places greater
16:44
attention on those identity journeys and what they are.
16:48
Are they helping? Are they hindering?
16:49
Yeah, just it puts more light on to what identity can achieve, I
16:53
think. So we hear this term out thrown
16:56
a lot identity security and I'm curious how you define it.
17:01
Is it identities? Is it access, is it behaviour
17:04
like what is it specifically that we are, you know, securing
17:07
when you hear identity security? All, all of that, all of that,
17:10
I'm more, I'm more, I think this it's a really good question.
17:13
I think, I think we, we side who we talk about, I think it's
17:17
about 80 plus vendors who we all talk about identity security in
17:23
some in some part of their description or narrative or
17:25
whatever. An interesting part being not
17:28
all of those vendors are competitive.
17:31
So that's, that's quite interesting.
17:32
So it means that I mean, the definition is too broad or
17:35
there's some pretty odd marketing stuff going on around
17:38
what it is and what it's not. And I guess my, my position
17:41
would be if you think about the sort of core pillars, A
17:45
specifically B to E workforce identity, but so 5 or 6 big
17:49
building blocks that we have is like identity verification,
17:54
identity provider and sort of strong authentication, IGA
17:58
governance and administration, Pam privileged access, probably
18:01
some sort of storage directory saying probably some sort of
18:05
access control authorization aspect in there as well.
18:08
You have these sort of 5 or 6 core pillars and some of those
18:12
are more mature than others, but they're often historically quite
18:16
siloed, quite independent, quite isolated, different vendors,
18:20
different standards, maybe a lack of standards in some.
18:23
And organizations often invest in all of these technologies,
18:27
yet they still get breached. And I think there's probably
18:30
maybe 456 years ago there was this trend of, well, we've done
18:34
MFA and we've we've got privileged access management
18:38
pick on the vendors who deliver all this stuff isn't necessarily
18:41
the vendors fault. And it's like, well, we still
18:43
got breached and we've had a data breach, we've had insider
18:46
threats or we've had some sort of automated cyber cry or a
18:49
nation state attack. And when you unpick what those
18:53
attacks look like, somewhere in there was identity a credential
18:57
breach. Sessions had been tampered with,
19:01
access control hadn't been enforced correctly, access
19:03
permissions, ghost accounts, privileged abuse.
19:06
So all of the, I guess attack methodology was centring on
19:10
identity. And it became quite clear that
19:11
even if you have these core pillars in place, you you need
19:16
more, need extra. And I think the identity
19:19
security thing is it's a bit like zero trust in the sense
19:23
it's not a product. It's again, it's a concept in a
19:25
process. And looking at that end to end
19:29
view of all of your identity flaws, your journeys, customers,
19:33
employees, NHI Agentic, all of the different identity types we
19:37
have are looking at the identity data side, the runtime and
19:42
behaviour side. And just looking at that
19:44
holistically across your IGA cross authorization, across Pam.
19:48
Because all of these sort of pillars like you have and just
19:52
essentially making sure there are no cracks in between them,
19:55
which I think is ultimately often the problem.
19:58
And I think identity security is going to say it's a bit of a
20:02
change in thinking, definitely changing in investment in extra
20:06
products, different products, but joining together I think
20:09
some of those what have historically been quite isolated
20:13
product stocks. So I think it brings up an
20:16
interesting point here around products and but having the the
20:19
mere presence of a product for identity security does not
20:23
provide you a divine shield that absolves you from the risk
20:28
that's out there. It's things will get through and
20:31
just having a product isn't the solution, right?
20:34
You have to have people, process and technology and you have to
20:37
have layers. And even if you have everything
20:40
in place, there is still a chance, maybe reduced, but there
20:44
is still a chance that someone will get through.
20:46
Is that fair? 100% fair.
20:49
It's a process, it's a concept. I think absolute products help
20:53
and you will need to invest in in products that can look at
20:57
runtime behaviour monitoring or can look at improving
21:01
verification services. Account takeover absolutely will
21:03
need software, no question. But I think as well it's
21:06
understanding the importance of identity and thinking about
21:10
identity more of an end to end information flow.
21:14
And again they do. The way to think about this is
21:17
how how would an attacker think about this?
21:19
You know, they don't care that you've invested in a really top
21:22
notch privileged access management system or a nice
21:26
governance system. You highly compliant.
21:28
They just care. Well, I want to go from here to
21:30
there. I don't really care which
21:32
identities and accounts I use. I don't care whether there are,
21:36
you know, whether it belongs to Simon, Jim, Jeff, the admin.
21:38
I just need to get that data and I'm going to get to that data
21:41
irregardless. And I think that those sort of a
21:45
more flexible information flow ways of thinking like an
21:49
attacker is not something identity has been familiar with.
21:53
You know, the join and move a legal process.
21:56
It wasn't built for security, It was built for productivity.
21:59
It was built for automation, built to improve staff, getting
22:03
access to downstream systems. So it wasn't built with that
22:07
security mindset in play. And I think now because identity
22:10
has become more important, more of this enabling tech, it's just
22:16
absolutely natural evolution that the bad guys are just going
22:19
to target identity because it's the effort reward ratio is
22:23
massive. You know why?
22:24
Why target a single database when I can target the directory
22:28
in the directory contains whatever 50,000 identities and
22:31
stuff like this. So I think as identity has
22:34
become more important by design, it's going to attract
22:38
adversarial activity, both insider and external adversarial
22:41
activity. And I think that's where you
22:42
suddenly start to need those different approaches.
22:44
And one final thing allowed is, you know, it's we do have to
22:49
explain what it is and how it works.
22:50
But I think if you look back in time, but things like networks,
22:55
you then have network security. If you look at endpoint
22:58
management, you then have endpoint security.
23:01
You look at data and data storage.
23:03
You then had a huge multi $1,000,000 industry for securing
23:07
Oracle databases and other. So it was all that tiered
23:09
database security on top. I think it's this evolution now
23:13
that we have this identity stuff which was infrastructure
23:16
originally. So you need to protect it and
23:18
now you have an identity security problem we need to need
23:21
to deal with. So a lot of people, well, people
23:24
may or may not know, Jim, that you and I actually do consulting
23:27
during the day. And a lot of stuff that we focus
23:29
on has been like strategy and sort of assessment.
23:32
And I'm curious, Simon, what you know, what is a clear signal
23:36
that you see that makes you question an organization's
23:41
identity posture? Because I certainly have
23:42
thoughts on this. And Jim, I'm sure you do too as
23:44
well. But it's like, OK, what's
23:45
something that like jumps out like, oh, OK, we definitely have
23:48
concerns here. Is there a few, I think there's
23:52
a few, a few sort of meta ones if you zoom out a little bit and
23:54
one's just back to that reactionary angle around
23:58
identity management. Not not necessarily IEM, but the
24:02
management of the identity infrastructure if it ends up
24:04
being quite, quite short term tactical, it's not necessarily
24:09
in line with an In Sync with what the business is trying to
24:12
achieve. I think is 1 quite big red flag
24:15
because it shows that identity isn't seen either as being
24:19
valuable or important or it's not being measured effectively.
24:22
So people don't really know what identity is doing.
24:25
And I think that those two are quite, sort of metal, quite
24:28
quite high level and not necessarily security centric.
24:31
But if, if the business doesn't know what identity does, it's
24:34
probably quite unlikely it's going to have the correct levels
24:38
of protection against it. And then if you then sort of
24:41
look at the day-to-day management of the identity
24:43
world, if it is being quite reactionary and quite, you know,
24:47
it is responding to to things in that short term basis, I think
24:51
that that is equally quite a, quite a big, a big giveaway.
24:55
But you know, you want to be looking really at the end to end
24:58
flow of identity where, where do identities start, where they've
25:02
been stored? How are they being used?
25:05
What systems do they access? What systems have been
25:08
integrated to the identity world?
25:10
So it's a lot of a lot of sort of mind mapping.
25:12
You feel like I'm planning out what the identity landscape
25:16
looks like, which is it is going to be infrastructural
25:18
components, but also the systems involved on where identity is is
25:23
working and not working. I think being able to just have
25:26
those types of discussions, they're really good indicators
25:29
around how identity is seen within the organization and how
25:34
how it's working effectively. And is there a sort of strategic
25:37
view around protecting it and making it, making it have a
25:41
level of security it needs? You know, you brought up attack
25:46
paths and the attack life cycle, but you're not going to pull me
25:50
away because I do want to ask a question about identity
25:53
security, which is I think we're starting to design as
25:59
practitioners our strategic plan, our investments around
26:05
identity security tools, and we need a way to show the metrics
26:10
that is actually making things better.
26:12
So my question to you is, you know, what should that be and
26:17
are there often overlooked areas where we're not showing that
26:21
ROI? Yes, unfortunately I think so.
26:26
We built something at the side about two years ago I guess
26:30
called the identity security scorecard.
26:33
And it's, it's about 50-60 different sort of data points
26:36
where we sort of go through and it's part of its
26:38
self-assessment. So the organization or whoever
26:41
the admin can go through and they can fill in some some
26:43
responses that are around basically how well do they
26:46
understand their identity security posture.
26:49
And this is looking at things around visibility, you know, do
26:52
you understand where your identities are located?
26:55
Can you tell me your high risk identities as well?
26:59
First of all, what's a high risk identity?
27:01
And so there's lots of little nuance in there around
27:03
visibility, understanding the where identities located, how
27:07
they've been used, what systems are being interacted with.
27:10
Then there's areas around protection, you know, how do you
27:13
protect your core identity world and that's looking at all the
27:17
standard sort of best practices that so we guys know around
27:20
strong MFA, these privilege, removal of ghost accounts, all
27:24
the stuff which is sort of good, good practice there.
27:26
But then you start looking at detection.
27:28
You can, you detect malicious behaviour, whether it's end
27:32
users doing bad stuff, whether it's administration
27:35
misconfiguration. So you don't want to try and
27:37
detect things. Then there's a whole set of
27:39
areas looking at response. If you do find something which
27:43
looks unusual. Maybe it's a misaligned policy,
27:46
maybe it's Simon who's authenticated correctly, but I'm
27:50
certainly doing something strange at 10:00 at night on
27:53
Salesforce or whatever. Can you, if can you detect it?
27:55
And if you can, what can you do about it?
27:57
Can you change my access? Can you flag and raise a ticket?
28:01
Can you flag my account? Can you direct me to a honeypot
28:05
and, you know, feed me fake information?
28:07
So there's all of that nuance around being able to protect
28:10
stuff. Can you detect anomalies?
28:13
If you can, can you respond? And then you have this, then the
28:17
feedback loop around, OK, you found some bad stuff.
28:21
Can you change policy? Can you update your security
28:24
policies and procedures and controls to make sure that those
28:28
and identity vulnerabilities are not going to get exposed again
28:31
in the future? So I think to answer your
28:33
question is, again, it's that broad sort of set of areas to
28:38
look at. You're looking at that level of
28:41
both technical and process understanding.
28:44
And I think with metrics, it is always good to not use them in a
28:49
scary way, but use them to identify where risk is in the
28:52
business. Is it risk in technology?
28:54
Is it risk around a lack of coverage in visibility?
28:58
Is it lack of coverage with multi factor authentication?
29:02
Is it you have a poor understanding of your non human
29:06
identities? So it's it's not trying to
29:07
understand what you don't know. I think is is is actually quite
29:11
an important part of that and that there's no shame in that.
29:15
I think that's part of that risk risk analysis process and it's
29:17
it's part of that. OK, this is what we know.
29:21
This is stuff we don't know. That to me is a risk.
29:23
And then you can obviously go and sort of manage that and do
29:26
something I. Feel like it's important that we
29:29
don't end up with this FUD factor right there.
29:33
I've heard this in the boardroom where it's like other they're
29:37
afraid of that you're just throwing FUD at them.
29:40
Like you talk about things like we're going to talk about in a
29:43
minute the attack life cycle and potential negative outputs that
29:48
come along with that. How do you avoid it being looked
29:53
at as just fun? As far look, you have to realize
29:58
that that any, any technology is going to be competing with other
30:03
technologies around spend and budget And and you know, the
30:07
data security world and the Network World and the identity
30:11
world. They're all trying to, I guess,
30:13
take a take a slice of the AI world, which is now emerging
30:16
around how we can protect that and the data team to say, oh, we
30:19
can protect that. So there's always that
30:21
competition for budget and attention in the strategic
30:26
technological narrative in there.
30:27
So you actually spawn about foot around the fear factor around,
30:31
you know, authentication is the biggest problem, or maybe it's
30:35
post quantum cryptos, the biggest problem or not clouds
30:37
the problem. So there's always going to be
30:39
that that competition. But I think when it comes to
30:42
identity, I always sort of bring it back into a couple of things
30:45
is, you know what, what, what can identity not allow the
30:49
business to do today? No.
30:51
Where's it stopping the business from doing stuff?
30:53
And it could be supply chain, it could be staff gaining access to
30:57
the right systems, being able to share data with the correct
31:00
people. It could be digital teams being
31:03
unable to launch mobile applications fast enough, so
31:06
they're losing competitive positioning in the market.
31:10
So where's identity not doing the right stuff?
31:12
And then if you have a strategic change and say, well, if we do
31:16
zero trust and we do this identity security stuff and we
31:19
do a bit of B to C external identity, what will that allow
31:24
the business to achieve? And that's back to that enabling
31:27
technology. So you start to have like this
31:30
is what we're stuck with here. This is what we're limited.
31:32
But actually, if we do this cool stuff that allows the business
31:35
to go on this sort of time progress adoption curve and do
31:41
different things, maybe we can sell more, maybe we can keep our
31:44
staff happier, maybe we can make our staff more productive, maybe
31:47
we can make our supply chain more efficient.
31:51
So I think it's really important to try and again, always get it
31:55
back to where's identity working, where's it a
31:58
bottleneck? What can we do in the future if
32:01
if it's working effectively. And I think if you get on to
32:03
that sort of vision, you can then you sort of become self
32:08
sort of self fulfilling because you can then enable and tell the
32:10
business and they go, wow, we can do that.
32:12
You know, we can, we can sell more, do more, We can remove all
32:15
of these inefficiencies and then suddenly that opens a lot of
32:19
doors, I think. I started out talking about
32:23
identity attack path. You call it identity attack life
32:29
cycle. I think they're one of the same.
32:31
Tell me if they're different or tell me you know what they are.
32:34
And then also you talk about the importance of stopping an attack
32:39
in his tracks, right? So maybe just continue on a
32:43
little bit with that. Yeah, yeah, for sure.
32:45
So yeah, I don't need to attack life cycles.
32:47
It's interesting stuff. So I think you're back to what
32:50
was saying earlier around as the importance of identity is
32:53
increased, the bad guys know that so that they they home in
32:56
on that by the effort versus award ratio is the highest.
32:59
And the the attack you've got to think of the attack coming from
33:03
both internal staff. Unfortunately that does happen
33:06
inside a threat fraud so on as also the external adversary.
33:11
And that could be anything from the automated sort of script
33:14
kiddy stuff, right the way through to nation state 0, to
33:17
exploits and advanced persistent threats and the like.
33:20
So soon as identity becomes this target, you need to think about
33:24
what does that really mean? And if you look at things like
33:27
MITRE attack, which is the sort of general cyber way of thinking
33:30
about that cyber attack life circle, you apply that to the
33:33
identity world. It's exactly very similar sort
33:37
of concept. It's going to have a start.
33:39
There's going to be a dwell time.
33:40
There's going to be some sort of privilege abuse or privilege
33:43
escalation, multiple different credential thefts or stealings
33:48
within that particular flow. Then there's going to be some
33:51
sort of data exfiltration or some sort of execution of
33:55
something would be a ransomware or the stealing of data.
33:58
And obviously, hopefully the bad guys are caught and found and
34:01
they disappear. Now, historically that life
34:03
cycle has often been focused upon logs.
34:07
Now, the reason I say that is that people, you know, but once
34:10
it's in the logs, ultimately the stuff has already happened.
34:14
The bad guys have done that bad stuff.
34:15
It's in, it's in Splunk or whatever your logging system,
34:18
syslog, all this carry on. If it's in the logs, stuff
34:21
already happened. And I think we're sort of
34:23
conditioned to think about stuff post event.
34:27
Retrospective attacks happened, ransomware has happened, we've
34:30
had a daily breach, customer records have been stolen.
34:33
You're looking at forensics, you're looking at retrospective
34:36
analysis. So stuff's happened.
34:38
How can we find out what happened and maybe change it for
34:42
next time? Well, we can't.
34:44
We can't live like that all the time.
34:46
We can't, we can't wait till this stuff's happened and then,
34:48
you know, try and fix it for next time.
34:51
Attacks are happening all the time continually.
34:53
And I think the idea of the as a life cycle is in OK, but where
34:57
can identity help here? Maybe it's through identity
35:01
hygiene, best practice of, of cleaning up permissions
35:05
policies, ghost accounts, orphaned accounts, all of this
35:08
sort of carry on, which is quite preventative is trying to
35:11
prevent something from happening.
35:13
But obviously that isn't enough. Something's going to get through
35:17
the through the net there. So then we start needs looking
35:19
at runtime and behaviours and the intent of identity or the
35:24
account itself. And I guess the idea with the
35:26
attack life cycle is trying to say, look, let's try and
35:29
identify the bad stuff before it gets to the end, before it gets
35:32
into the logs. And can we do something just
35:35
before it completes really, and trying to say look with our
35:38
detection engineering, with our ability to look at runtime, can
35:42
we find suspicious activity, malicious things, use composite
35:46
risk scoring and try and find that actually that looks dodgy.
35:50
So let's do something about it. Let's remove the session
35:54
entirely. I'll reduce the session
35:55
lifetime. Maybe if I had read and write
35:58
access would just give me read access because whatever may be
36:01
on a strange network or a strange device or something.
36:04
So it is just trying to find those little small that triggers
36:08
it of information and then being able to do something about just
36:11
before I've sort of run off with the bag of digital swag and
36:15
disappeared into the sunset. So I think we're getting there.
36:18
And by this I mean we have we have so much information now
36:22
from a digital perspective around networks, devices,
36:25
behaviours, identities, what I'm trying to access, what I've done
36:29
in the past, comparing myself to to other colleagues and peers
36:33
and all this sort of stuff. So I think we're we are building
36:37
this mindset of, of being able to try and prevent stuff.
36:41
That's brilliant. But if we do need to look at the
36:43
runtime, having the weaponry to say actually there's something
36:47
strange happening, let's respond and hopefully respond before the
36:50
attack happens. So I think that's, I think
36:52
that's maturing I think for sure.
36:56
What I'm hearing like we are building the mindset.
36:58
Totally agree with that. It feels like it there are some,
37:05
like we probably have the data questions.
37:07
Do we have the tools that can interpret the data to take
37:11
action to prevent an attack in his tracks or stop an attack in
37:17
his tracks? In your view, what are some of
37:21
the promising tools? I mean, we've talked a lot about
37:24
like continuous identity, shared signals, framework, things like
37:28
that on the show. I think there's a lot of promise
37:31
there. It seems like it's more than
37:33
just one tool to kind of solve this problem holistically when
37:38
the approach has got to be that it's multi pronged.
37:41
You're looking not only at authentication logs, but you're
37:43
looking at other things as well for your thoughts.
37:47
Yes, but on yeah, no, I couldn't agree more that I think the cap
37:49
and this signaling is a really, really important part of this.
37:53
I think that's a really good example of saying first of all
37:56
we need non identity data signals here.
37:59
It isn't just about the identity world as important as it is
38:03
obviously, but we we need to introduce other factors or the
38:07
other data points to this. It could be configuration
38:10
management systems to give you visibility of your application
38:14
world. It could be ServiceNow or Jira
38:17
or ticketing systems to give you information about what what are
38:20
people requesting and why and how and what context does that
38:23
have, Endpoint management systems, threat intelligence
38:27
systems. And there's lots of different
38:29
non identity parts. And I think to me it's a little
38:33
bit like this sort of asymmetric information problem around
38:36
trying to navigate through a maze in the dark and you're not
38:40
quite sure which, which of those rooms are good rooms, bad rooms.
38:43
You've got a small torch and you're sort of just trying to
38:46
build a picture of what's happening.
38:48
And the more information you have, the more Intel you have,
38:52
just the more informed you become.
38:54
So I think, I think that the cap thing is a good example, but
38:56
you're absolutely right in the sense that's just one aspect to
38:59
it. So apply that concept to your
39:02
identity data world and start saying, well, OK, I understand
39:06
about ghost accounts and access permissions, but, and honestly,
39:10
those aren't new concepts. That's stuff that's been around
39:12
25 years yet organizations still haven't fixed the problem.
39:16
So how can you help fixing the problem?
39:19
How can how can you identify excessive permissions or
39:23
accounts that aren't being used or mis correlated accounts?
39:26
What other data might you need? So again, thinking, OK, how can
39:29
I expand my sort of data net and look at instead of looking at
39:33
permissions that's been assigned, look at maybe the
39:36
permissions that have been used or look at HR information
39:40
coupled with ticketing information coupled with laptop
39:44
usage information. So you just start to cover it
39:46
and pull in different information points.
39:47
So I think it's just important to broaden those data signals at
39:53
all parts of that identity life cycle from identity
39:56
verification, authentication, authorization, governance, and
40:00
obviously that runtime sort of stuff as well.
40:02
And it's just spreading that that concept of saying we need
40:06
more information to help us become better informed.
40:10
Yeah. And it also feels like
40:12
organizationally speaking, I am in the past have been treated
40:16
more like, you know, an efficiency driver.
40:20
I mean, yes, there was a security angle to it all along,
40:24
but it was kind of an administrative feature on, you
40:27
know, back end administration who gets access to what single
40:31
sign on more or less was treated as like just that single sign
40:34
on, not defense against being attacked.
40:38
And that's what identity security is all about is you're
40:41
being attacked and how do you use identity?
40:45
So now it becomes a 24 by 7 operations activity.
40:51
Can you talk a little bit about how you see that manifesting and
40:54
does that mean there are additional stakeholders in the
40:58
identity world? Yeah, yes, in short, absolutely
41:03
spot on. It does become, it does become
41:05
more omnipresent constantly on and and not just from the
41:09
security side as well, constantly on because it's going
41:12
to be constantly changing. So administrative functions need
41:15
to be constantly on. And by this I mean not just
41:19
24/7, but being able to make changes from a, a whole host of
41:23
different sources, you know, API command line, you know,
41:27
policies, code, infrastructures, code, all of that sort of
41:30
automation needs to be always on as well.
41:33
I think the security blanket absolutely.
41:36
And and this brings some interesting challenges, I think
41:39
because, you know, spot on, the identity wasn't seen as as
41:43
security enabling. It was it was 9 till 5 join,
41:47
move a lever productivity. But now it has to take on the
41:51
some of the constructs of the security world, namely, you
41:55
know, can you discover and have visibility of all of your
41:57
identity stuff. And you sort of, it's quite
42:00
interesting when you sort of often speak to see.
42:02
So as they go working, I just press the discovery button on
42:05
the identity thing. You just tell me where all your
42:06
identities are and it will. Yeah, not really because we've
42:10
got directories everywhere. They're not connected.
42:12
You have different identity providers not connected.
42:15
You probably have accounts and identities embedded within core
42:19
systems that are just not even managed entirely.
42:22
So you know, it's inherent to things like network technology
42:26
that you have discovery and that's how networks work.
42:28
You know, reading protocols, open shorts, path first, all
42:31
this sort of stuff. It's all discovery.
42:32
LED identity is not like that. It was process and structure and
42:36
waterfall and it's a different, different sort of mindset.
42:40
So you're absolutely right. It is 24/7 and I think it does
42:43
introduce security operations. It looks at not only responding
42:48
to security incidents and how you can fix identity as part of
42:52
that. But obviously as I was saying
42:54
earlier, what can we do during the attack, you know who's going
42:57
to be involved in that? It is going to be that security
43:00
focused layer and again, security architecture, how can
43:04
identity help with the confidentiality, integrity
43:07
availability? So I'll try out as well.
43:09
So different stakeholders, they're all going to have
43:11
slightly different needs. I think that's positive.
43:13
I think it helps identity become more much fit if you like more
43:17
much fit for the modern world and be more adaptive and
43:20
responsive and integratable and things like this.
43:24
OK, so let's pivot to the AI at thecenter.com question.
43:29
We joke awful lot about AI and yes, that's a real URL.
43:32
And yes, it will point you to this podcast where it's I guess
43:37
with agentic AI, right? This has been sort of the the
43:40
hot button thing for probably for a while, but I think really
43:44
sort of in the consciousness of identity for probably the sick
43:48
last six months or so. What does that mean for identity
43:54
strategy, identity security and and other similar terms?
44:00
Yeah, it's, it's a great one. It's just like this huge nuclear
44:02
explosion if if stuff like that's come along and just sort
44:05
of detonated upon all of our ways of, of working, our ways of
44:10
thinking about tech and and certainly security for sure.
44:12
I think it's the the best way I think I could describe it is we,
44:17
we haven't fixed the human stuff really from from an identity
44:20
point of view. And by that I mean, we, we're
44:22
still plagued with some of the core problems of, I don't know,
44:26
our back ghost accounts, excess permissions, nobody does MFA
44:30
properly and all these sorts of things.
44:32
And then three or four years ago, we had the the more bit of
44:36
a more focus on machine identity service accounts, looking at
44:39
sort of APIs and workloads and a bit of privileged access stuff
44:43
in there as well. And machine to machine cons.
44:45
That wasn't let me fix that either because that's got this
44:48
big hockey stick curve of numbers and huge issues with the
44:52
credential rotation and there's there's no HR system for
44:56
workloads and non human identities.
44:58
So we've got these two problems which we haven't solved.
45:00
And then you've got cloud to deal with and then suddenly
45:02
someone drops this agentic EI sort of Megatron on everything
45:06
else. It's like, wow, OK, it's the
45:08
worst of both worlds. And by this I mean there's a
45:11
huge scale problem in the sense of agentic EI.
45:14
The adoptions can be huge, 50-60 hundred times the number of
45:17
human identities, for example. But then it also has issues
45:21
around it isn't deterministic like workloads and basic API to
45:26
API cons, the nice Jason payload and it's this big and it works
45:29
between 9:00 to 5:00 and it has a job that used to authenticate.
45:33
It's quite predictable in what it does, whereas the agentic
45:36
world is actually non terministic.
45:39
It's very, it's geared towards optimization.
45:41
So what it does, it's actually going to be quite unusual and
45:44
how it behaves. And often that's quite
45:47
legitimate because it's there to optimize and improve and learn
45:50
and everything else. So it's generating requirements
45:54
that we haven't even solved for, for human and non human.
45:58
And then certainly we've got a deeper agentic.
45:59
So there's a whole host of different ways to to to deal
46:03
with that. I think absolutely it's, it
46:06
looks like it's going to get characterized as a, as a
46:08
different identity type. So it's neither human nor non
46:12
human. First of all, I think that's a
46:13
nice, quite a nice concept to consider.
46:16
And also the sort of paradigm that's emerging is to treat it
46:19
like a digital employee. Now that that is subtly quite
46:23
interesting because you wouldn't, well, maybe you would
46:26
trust your colleagues with your passkey and your credentials and
46:29
your Active Directory logins I've posted, you probably
46:31
wouldn't. But suddenly when this mindset
46:34
of we're having to sort of trust and give all of our credentials
46:38
and permissioning and everything else to these agents who perhaps
46:40
don't have accountability, you don't have behaviour monitoring,
46:44
aren't necessarily using strong authentication and just in time
46:47
permissions and and all this sort of carry on.
46:49
So it's it's a hugely interesting space.
46:52
I think one final sort of comment, there will be the
46:56
innovation adoption of AI and the genetic AI is absolutely off
47:00
the scale, whereas the adoption and innovation of identity and
47:04
security is, is quite flat still.
47:06
So we're ending up with this sort of gap between this hockey
47:09
stick curve adoption of AI and security and identity sort of
47:12
plowing along. And yeah, it's doing some good
47:14
stuff and it's improving all the time.
47:16
But there's this big massive gap, security gap around, well,
47:19
how do we do just in time permissioning for agents?
47:21
How we do, do we do strong off? How do we do process at the
47:25
station? How do we do compensation
47:27
computing with these agents who are operating as ephemeral
47:31
things which come and go within a few seconds.
47:33
So it generates some huge non non functional functional
47:39
challenges really which we're not not quite there yet.
47:42
I think we think end to end it needs a whole host of data
47:46
security, identity security and governance to to get that stuff
47:50
right, I think. So I think I heard you describe
47:53
that there might be this 3rd type of identity, right, agentic
47:56
versus human versus machine. And I don't know.
48:00
I mean, I think a lot of the problems you described that,
48:03
I'll call it that identity chaos that happens, right?
48:07
Yes, you're right, right. API to API, it's a very
48:09
predictable transmission and you know what it's doing.
48:12
But humans don't do that. Humans today are interacting
48:15
with accounts in any variety of number of ways, standard and non
48:19
standard. That's why we have things like
48:21
conditional access, right? And rules and things like that.
48:24
Now I understand the scalability is the big challenge right, when
48:28
it comes to agentic identity, but the behaviors of an identic
48:32
identity are much more similar to a human identity than they
48:35
are to a machine identity. So do we really need a third
48:38
classification to, to further muddy the waters, which I think
48:42
is what I am is really good at, is creating new acronyms for
48:46
things. If it's truly needed, great, but
48:49
I'm not sure yet if it really is like a subset of something, or
48:54
if it really is strong enough to stand on its own as a type.
48:59
I guess, I guess the counterpoint is we're still
49:01
struggling with solving those human problems, aren't we?
49:04
I think, I think if we'd solved them and we had a really good
49:08
sort of a mature way of saying actually, yeah, it is just a
49:11
subset of what we do and it's fine, I think because that isn't
49:14
the case. It's almost like a cascading
49:16
problem. So you have a a ghost account in
49:19
the human world multiplied by a long lived credential in the NHI
49:23
rule that cascades into a much bigger thing.
49:26
And I think the agentic, the big agentic question mark at the
49:30
minute is all about accountability and traceability
49:33
and and directing that back to a some sort of carbon life form.
49:37
And I think because we haven't been great at solving these
49:40
problems for other areas, it's like, do you know what, I think
49:43
we need to have a really grown up conversation.
49:45
How do we do manage this? Because you're going to need
49:47
different tools. You're going to need different
49:49
architectural patterns because the architectural patterns we've
49:51
had in the past, even the sort of PDPPEP just in time, serious
49:56
time and privileges. We're not, we're not quite there
49:58
yet because if we were, a lot of these issues in that tack life
50:02
cycle stuff would would probably disappear.
50:05
And I'm an advocate for saying we should.
50:07
I'm just based on observations around, you know, how, how this
50:10
sort of industry is heading there.
50:11
And I think we need some real conversations around who who
50:15
needs to be involved in protecting AI.
50:17
And it's isn't just tech, It's going to be governance, it's
50:20
going to be ethics, it's going to be legal data security and
50:23
data, the data science people that have a really good point to
50:27
make in there as well. And I just think there's,
50:29
there's a, there's a lot of unanswered questions currently
50:32
around what protection angle looks like.
50:34
And yeah, there's, there's a newest different startups trying
50:37
to provide some guidance there. So it's, I think it's, it is
50:41
moving very fast. It's early days though, I think.
50:47
What needs to change from an identity standpoint to address
50:51
the explosion of agentic identity?
50:53
Because I feel like, you know, we've we've spent decades trying
50:57
to solve for humans, but now the problem is that scale, right?
51:00
For everyone human, there are 10101 thousand, 1,000,000 gentic
51:05
identities that are spawning and they're spawning their own
51:09
agents, right to do things. So what is it that you see over
51:12
the next maybe like three to five years where it's like, OK,
51:15
we really need to think about the way we are addressing
51:18
identity and access management as a whole to counter that?
51:24
There are some positives though. I sort of painted a big gloomy
51:26
picture. I think it was some huge
51:27
positives. I think the first, the first one
51:29
is, is actually use AI to fix some of those human problems
51:34
I've been describing. So using AI in a much more
51:37
focused and condensed way to say actually, you know what our
51:40
identity and access management world is good.
51:43
It's growing, it's incrementally improving, but we could use AI
51:47
to actually fix a lot of the governance issues, fix a lot of
51:50
the broken groups in active direction, don't have
51:54
descriptions, fix all of the access requests, access review
51:59
compliance issues we've had for decades and decades because
52:02
nobody does that properly and it's ineffective.
52:04
And use use AI to sort of let me fix and tighten up that human
52:08
centric stuff, make that match fit.
52:10
I think by doing that, that actually frees us up as industry
52:15
experts to say actually, you know, what conceptually we can
52:17
then start to apply some of this stuff to to how we do strong
52:21
authentication just in time, you know, runtime policy enforcement
52:26
for agents. So I think I think the concepts
52:28
are there. I think there's, there's
52:29
definitely a bit of issue around technically what that looks
52:32
like, which I think it honestly is, it's probably quite an easy
52:35
thing to fix. But I think currently the big
52:38
issue is that the discovery visibility, ownership thing, you
52:41
know what's happening with AI in my organization, where's it
52:44
being used, why is it being used?
52:46
What's the value? And then look at the doing that
52:49
sort of security on that. And hopefully you mentioned
52:52
three or five years, think maybe hopefully five years from now.
52:54
It's a much more proactive thing.
52:56
And it isn't just a case of sort of wrapping security on stuff
53:00
afterwards. It's more about adding in those
53:02
core concepts every time you build an agent or deploy an
53:06
agent. And it has struggled.
53:07
Process attestation trusted work environment doesn't have access
53:11
permissions or you can identify when it does.
53:14
So I think the concepts we we all know, I think the concepts
53:18
exist. I think it's just applying them
53:19
in a in a slightly different different sort of environment I
53:22
think. I mean, I've when you've
53:26
released your book, I am in 2035, I just was like, this
53:31
guy's got guts, he's got guts. So I've always kind of had the
53:38
the base premise that identity follows the technology.
53:44
And I'll give you another premise that I think I've I'm
53:48
coming to, which is that we're constantly head faked by what
53:53
can AI do today? And then there's some assumption
53:55
that it's going to be a while before us.
53:58
But yeah, that's not what we've experienced.
54:01
We had the ChatGPT moment, right?
54:03
And look at where we are now, where it's like it's blowing it
54:06
away already. And if the real futurist, of
54:11
which I don't consider myself one, are right, we reach kind of
54:16
the singularity moment in the near future, Singularity for
54:20
people who don't listen to this garbage all the time.
54:23
It's when the AIS are as smart as the people, right?
54:29
Generally speaking, that's the term.
54:32
And, and Jeff's nodding no, so he can correct me.
54:35
But that was my understanding anyway.
54:38
What I'm getting through with this is, you know, I, it feels
54:43
like it shakes the core of what enterprise IT might be 3 to five
54:49
years from now. In fact, it might shake the core
54:51
of what an enterprise is 3 to five years from now, right.
54:54
We have this assumption that all these thousands of people are
54:58
going to come to work for a company when the futurists are
55:03
saying 50% of the white collar workforce is going to be
55:06
eliminated. And when you think about a lot
55:09
of enterprise IT applications, let's just call them SAS.
55:14
You know, I'm thinking I'm oversimplifying.
55:16
Doesn't really matter what the delivery model is.
55:19
They're mostly built around people doing a job, right?
55:23
And if you're talking about agents doing a job, do they need
55:26
these tools? Do they need an HR system?
55:29
Do they need ACRM system external to the large language
55:35
model itself? To a pick that Jim Mccrakey, I
55:40
think nobody knows where it's heading.
55:43
I do think that's a little bit scary as well.
55:46
I think, I'm not necessarily saying it's all, all doom and
55:49
gloom, but I think the potential is unknown.
55:52
And I think that itself is quite, quite scary thing.
55:55
I think it, I think it will transform lots and lots of lots
56:00
and lots of jobs will, will change and alter, absolutely.
56:02
But I do think there's also that that more fundamental change and
56:07
shift around how we do business, how we work, how we interact
56:11
with people, how we do things. I'm not quite sure anybody knows
56:15
what that quite looks like yet, but I think a lot of it is going
56:19
to be based on trust. Can you trust this thing,
56:22
whatever it may be to, you know, be a friend, do something, act
56:25
on your behalf. Maybe you're interacting with it
56:28
on with this whatever combined set of agents and then trust is
56:33
a huge part of that. And to get trust to work, you
56:36
need to have identity in there, both physical and digital
56:38
identity for that to work. So I think identity has a real
56:42
fundamental part to play, irregardless of what that looks
56:45
like. I don't think it's going to look
56:47
like the identity of right now with the stuff we have.
56:51
But I think the concepts, the physical concepts that we have
56:55
as people, how we interact with each other, how we trust each
56:58
other, how we respect and listen and interact, somehow you'd have
57:03
to try and translate that to the digital world.
57:05
And I have no idea what that looks like.
57:08
I mean, it sounds a little bit scary, but I think it is coming
57:11
very rapidly. I think that's probably the only
57:14
thing we can predict that it's coming quickly, too quickly, and
57:18
we probably won't be fully prepared and we'll have to do
57:20
what humans always do and that's adapt and figure it out.
57:24
Yeah, I mean, I'm, I'm, I'm always an eternal optimist.
57:28
I, I hope, I don't think it'll ends up in, in sort of robot
57:31
wars, but one thing I will add actually is that maybe AI is the
57:35
only thing that can secure AI. If you think about where that
57:38
singularity goes to and the way you design and define systems
57:43
and maybe isn't a human that has to be able to do that.
57:45
It may be an AI system is the only thing which can operate on
57:49
the same frequency. I guess to to be able to protect
57:53
that. So that that'd be my not my
57:55
prediction If I was going to ever write another book.
57:57
I didn't see a 2055. If we're all here, then who
57:59
knows? Well, it worked for the Matrix,
58:02
so I'm trying to work, you know, for real life.
58:04
So we're good with that. I always learned so much, Simon,
58:07
when when we talk. And, you know, I want to wrap up
58:10
this conversation with maybe learning a little bit more on
58:13
the conference side of things because Jim and I are headed to
58:16
EIC in Berlin in May. And then we've got another
58:19
conference in Las Vegas with Ideniverse.
58:21
And you know, last year was my first time going to Berlin and
58:25
really enjoyed it. And I hit Amsterdam after that,
58:27
really enjoyed that as well. And I'm curious if you have any
58:31
tips for Jim and I, our second time going to Berlin and maybe
58:37
parts unknown throughout EU. What should we be thinking about
58:42
as we head out this summer? Enjoy it.
58:45
Europe is fabulous. Europe is it's, it's, it's very
58:49
small in some respects. And by that I mean within sort
58:51
of two hours, you can, you can have a multitude of different
58:54
cultural experiences, languages, drinking and other.
58:58
And it's, I think that is this the absolute beauty of of being
59:03
living in Europe and in the UK obviously, but Europe is, is a
59:05
real big part of of my view and vision of the world and it's
59:09
multiple, multiple things. I would take every opportunity
59:12
that you counted and sample all of that culture because it is
59:15
fabulous, fabulous history of Europe and it's it's good in
59:19
Germany, Berlin, yeah, there's some great, great bars in
59:21
Berlin. You know, there's some, there's
59:23
some good, good bars in Berlin. I'm sure we can do that offline.
59:25
But yeah, it's embrace it all. It's brilliant.
59:29
Well, give me something specific, like what's a hidden
59:31
gem that you want to promote or let people be aware of?
59:36
Like, hey, this place is great. And, you know, maybe not a lot
59:39
of people know about it. I mean, we have people all over
59:40
the world who listen and, you know, maybe maybe they're
59:42
familiar with it or maybe they're getting ideas like, oh,
59:44
next time I'm in that area, Simon said.
59:46
We got to go here. If I'm I'm not going to be AICI
59:49
hasten to have this year. So I guess my if it is in Berlin
59:52
this year, is it? It's in Berlin.
59:56
A German Keller beer or a wheat beer is, is will be my, my gun
1:00:00
gun hunt out a really good vice beer in a, in a German cellar
1:00:05
bar. So it's got to be an underground
1:00:06
bar. It's got it can't be on on paper
1:00:09
level underground. I'm not going to give a
1:00:12
particular name, but there are, there are some some that exist
1:00:15
with and they'll have little candles on the tables and
1:00:17
they'll be very small and they'll be open from about 5:00
1:00:21
PM onwards in the afternoon and. They're the best places.
1:00:24
They're the best ones. German, German vice beer in
1:00:27
underground bar with a bit of that's not old fashioned techno
1:00:31
music going on on the speakers that that to me will be you'll
1:00:35
probably find me somewhere in one of the somewhere share your
1:00:38
little bar like and that'll be my end of conference day.
1:00:42
I think that'd be like not be like tip.
1:00:44
Sounds a little bit similar to a place that I went.
1:00:46
So shout out to John and Matthias who I went out with and
1:00:49
it was a bar, you know, pub type place underneath the train
1:00:54
tracks. And you know, we had wheat fears
1:01:00
twice is typically what if I'm going to drink a beer?
1:01:02
Typically this could be like a vice, stuff like that.
1:01:05
And then pretzel and sausages and just kind of sat in this pub
1:01:10
and just hung out and relaxed. And it was.
1:01:12
Was it an underground pub? It wasn't.
1:01:14
It wasn't underground, but it was directly underneath the
1:01:16
train tracks in Alexander Plots kind of area.
1:01:19
I don't remember the name of it, but it was it was a similar type
1:01:23
vibe. Not directly underground
1:01:24
obviously, but. I'm but that's good.
1:01:27
It is close. That's a good.
1:01:28
That's a good starting point. That's a good starting point,
1:01:30
yeah. OK, so that's like the newbie
1:01:31
version of that. To progress to the underground
1:01:34
and then you would have ticked all of the, all of.
1:01:37
The I think if you drink too much you might progress too far
1:01:39
underground and then you got a different problem.
1:01:42
That's tomorrow's problem, though.
1:01:45
Jim, you want anything to weigh on here?
1:01:47
I mean, I would just say that, you know, I'm thinking about our
1:01:51
trip to Europe and I'm thinking the culture and the lifestyle.
1:01:55
I mean, they've got it in spades.
1:01:57
I think our trip to Vegas is going to be very different.
1:02:02
Vegas and the Berlin scene are very different, but I enjoy them
1:02:07
both. I find Vegas relaxing and I
1:02:10
don't know if that's because I'm weird or something else.
1:02:15
I like the people watching. I've given up a lot of the vices
1:02:20
that make Vegas a problem for most people.
1:02:23
Don't gamble and but it is a good time.
1:02:28
But it's super expensive there. Yeah, I'm, I'm probably going to
1:02:31
try to make it this sphere again.
1:02:33
They've got Wizard of Oz playing, which might sound a
1:02:37
little bit nerdy, but I'm looking forward to it.
1:02:41
At the sphere, I mean, you can see anything.
1:02:43
You can watch paint dry at the sphere and I'm sure it'll be
1:02:45
interesting. Would make it, yeah.
1:02:49
All right, let's go ahead and wrap it up there for this
1:02:50
episode. Simon, thank you so much for
1:02:52
joining us as always, it's a pleasure.
1:02:54
We'll have links in our show notes for people to check out.
1:02:56
So we'll have a link to you in LinkedIn so people can reach out
1:03:00
with either recommendations for underground bars or, you know,
1:03:03
AI tomfoolery or whatever it may be how we want to work for that.
1:03:08
I'll have a link to the Analyst Brief podcast as well in our
1:03:10
show notes, be able to check that out that so that you and
1:03:12
David continue to do a great job with that one.
1:03:14
And yeah, we'll have links to us.
1:03:16
Well, so reach out to Jim and I. We're always looking for ideas
1:03:19
for shows and questions, comments, concerns and all that
1:03:23
good stuff. So IDAC, podcast.com, don't
1:03:26
forget our discount codes. And yeah, that's it.
1:03:29
So leave it there. Thanks everyone for watching and
1:03:32
or listening and we'll talk with you all on the next one.
1:03:35
Guys, thank you. Talk to you soon.
1:03:39
You've been listening to Identity at the Center.
1:03:42
We hope you've enjoyed the show. Make sure to like, rate and
1:03:46
review, and we'll be back soon. But in the meantime, hit the
1:03:50
website at identity@thecenter.com.
1:03:54
See you next time on Identity at the Center.