Latest / Identity at the Center / #386 - InfoSec World 2025 - CISO Tradecraft for IAM

Transcript

#386 - InfoSec World 2025 - CISO Tradecraft for IAM · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:14
Not so bad yourself. Hey, good man.
0:16
We're in the land of the Mouse. Yes, Mickey Mouse.
0:20
And we're at influence SEC World 2025, you see from the
0:24
background banner. Yep.
0:25
So we've got a little recording booths.
0:27
It's out on the Expo floor and I've had some great conversation
0:31
already. One thing that you can be sure
0:34
is clear is that identity is identity, and the world of
0:39
identity is on the mind of the information security
0:42
practitioner. Yeah, well, I don't think, I
0:45
don't think you can avoid that in any specific way.
0:47
And it's everywhere. You could say it's at the
0:49
center, you know, like some podcasts.
0:52
Yeah. So shout out to Shirley from
0:53
Cyber Risk Alliance for, you know, helping us out, getting
0:56
this set up. Shout out to RSM for sponsoring
0:58
or partnering. I guess just I don't the way
1:00
where it is, but you know, having us out here.
1:01
So, you know, that is our day job.
1:04
The podcast is the night and weekend stuff.
1:06
But it's very cool to come out this conference.
1:07
First time I've been to this conference.
1:09
So I'm kind of taking it in a little bit.
1:11
And I will say it's going to be very distracting for you as I'm
1:14
talking to you because as I look past you, there is a company, I
1:19
won't name them just in case people aren't into it, but
1:21
they're all wearing like witch's hats and wizard hats.
1:24
It's like a trick or treat theme.
1:27
And so I know I'm going to be looking at that as I look past
1:30
you for this episode. So if I you know.
1:33
Just think of it as your family reunion over there and then.
1:36
Yeah, right. One of the things that was very
1:39
cool as we came out here and Ross, who enters here a second,
1:43
you know, came up to me and said, Oh, I got a podcast.
1:45
I know we have a podcast too. And we just started talking and
1:47
then we realized like, Oh my gosh, like so the podcast is CSO
1:50
tradecrafts. We've got Ross and we've got
1:53
Mark G Mark the the OG Mark. I don't have an O in there.
1:58
It's that, it's that Irish. But the O is not at the
2:00
beginning. All right, so G Mark and they
2:01
have a podcast. It's called CSO, trade calf,
2:03
CITO trade calf.com. And we were started talking and
2:07
saying, Oh my gosh, like we all, we're using the same tools.
2:09
We have like very similar formats.
2:11
You guys have been going weekly for like 5 years.
2:13
Like there's a lot of parallels here.
2:15
And so why don't we just go ahead and start there.
2:18
So we're also, I'll start with you since you're in my line of
2:21
sight. So tell me a little bit about,
2:23
first of all, how did you get into information security?
2:25
And then tell us what about the podcast?
2:27
How did you, you know, get that thing going with AG Marker?
2:30
Yeah, so I'm one of those people who always wanted to be in
2:33
cybersecurity. I I used to say I want to be the
2:37
guy that when the Chinese go to sleep, they're thinking about me
2:39
at night time, right. And, you know, it's just the
2:43
coolest thing. I grew up in Las Vegas and
2:46
there's magicians there, so they're always doing magic
2:48
tricks. And when I learned how to start
2:50
doing hand hacking and pen testing, it's kind of the same
2:53
way. Like, you know the trick and so
2:55
you know how it works, but anybody else, it's just like
2:57
magic. Like, Oh my gosh, you could do
2:59
that, you know. And so that was the thing I went
3:01
and I studied computer science. I got an MBA in cybersecurity
3:05
and I did this program called Scholarship for Service where
3:08
they said, Hey, we will pay your master's and pay you go to grad
3:11
school if you just work for the government.
3:14
I said, sounds amazing because I want to go to NSA or CIA and be
3:18
a nation state actor. And that's what happened.
3:21
So I had a, a fantastic career and years later I decided to,
3:25
you know, share some of this tradecraft back and G Mark and I
3:29
started a podcast five years ago.
3:32
So what was the like? Why was it that was like, oh, we
3:34
should start a? Podcast So I was at Capital One
3:38
and I was a director and then I took a job as a CSO at
3:42
Caterpillar Financial and all my friends were like, how do I copy
3:47
paste what you just did? Right?
3:49
And so I had the same conversation over and over and
3:52
over and I was like, I need to just record this once as a
3:56
podcast and then say hit play, right?
3:58
Why do I need to have this in 45 minute?
4:01
And so G Mark, he was the SANS instructor on cybersecurity
4:05
leadership. So I said that's who I want as
4:08
my Co host. And I kind of, you know,
4:11
finagled him to come join me. Well, he had something about me
4:13
having a face for radio, so you. Definitely have a voice for it,
4:16
that's for sure. You've got great pipes as you
4:19
say in the BIV, so let's find out about your background.
4:22
He mentioned the SANS instructor, but how did you get
4:24
into INFO? In cybersecurity, my first full
4:27
time job doing cybersecurity, I'm going to date myself here
4:30
because, well, nobody else will. 1976, got hired by the state of
4:33
New York to plug all the holes in all the high school kids and
4:37
punch in their systems, of which I was probably the Finder, about
4:39
80 or 90% of them. Just saying.
4:41
But I don't want to be one of the good guys.
4:43
I always want to be the person who went ahead and made things
4:45
work, not the person who broke stuff.
4:47
And so after that went on, sold my soul for my college degree,
4:51
took a Navy ROTC scholarship to Northwestern, the degrees in
4:54
computer science and mathematics and then off to the fleet and
4:57
then about five years into my Navy career.
4:59
I mean, do for sure to her it's like, hey, I want to go to work
5:02
for a three letter agency like NSA.
5:04
So I was able to get a set of orders to NSA and then I got
5:09
this call from Washington a couple weeks later from a
5:11
detailer. The person owed your career
5:13
saying, Lieutenant, what are you trying to do that says I'm
5:16
trying to go to NSA. Well, why would you do that?
5:18
I want to do computer security. Now here's a quote for the ages.
5:23
The Navy has no need for computer security.
5:25
You're going back out to sea. It's like, but this is what I
5:28
want to do it. I got a short tour coming up.
5:30
Well, then gave the big lie. If you take this job, kiss your
5:33
career goodbye, you'll never promote pass Lieutenant.
5:35
Well, detailers make their points by putting square pegs
5:40
and square holes and round pegs and round holes.
5:42
That was definitely the wrong shaped peg for that hole.
5:44
So I was like, well, what do I do?
5:45
I love the Navy, loves cybersecurity, but I can't
5:47
apparently do both. So not being able to perceive
5:50
what was true, it was not. I left active duty, went to work
5:53
for Booz Allen Hamilton, stuck around in the reserves, and two
5:57
years, six months after I left, I started National Security
6:00
Corporation named after the job I could never get.
6:03
So here we are many years later and have continued to the
6:06
cybersecurity stuff. And as Ross and said, this is
6:09
our opportunity to go ahead and help a lot of other people with
6:11
their careers because you get to a certain point where you're
6:13
going to give back phase of your career path.
6:15
And I'm trying to see what can I do to help the next generation
6:18
of cybersecurity experts not just know the technical merit of
6:22
things, but how do they navigate their way through their
6:24
technical part of their career, through their management years,
6:27
into their leadership years, and ultimately become enough
6:30
political awareness to be successful as a sea level?
6:33
She mentioned the P word plot. Politics comes up everywhere.
6:37
And yeah. And it's something that people
6:40
have to deal with. So I got to ask that Navy person
6:43
that told you there was no career there, did you ever touch
6:46
base with that person again? No, and it's probably just as
6:49
well because there was a guy who was a year behind me who also
6:54
spent five years at sea, who also put in for orders for NSA,
6:58
but if you will, drank the kool-aid and change career
7:00
patterns to cryptography or cryptologists.
7:03
What cryptologists back then wasn't really breaking code.
7:05
You're sitting there listening to the Soviet Union and then
7:10
years later that became cyber. Well, the guy who was a year
7:12
behind me was Mike Rogers and Admiral Mike Rogers retired as a
7:17
director of NSA. So they had a 12 month jump on
7:19
the guy. Not that he could have done what
7:21
he did because a lot of it has to do with politics.
7:23
You'll you'll make it to captain or Colonel on leadership skills,
7:27
you make it to Admiral or general on political skills.
7:30
And that's something that at the time I was just not good at.
7:32
I'm probably still not very good at it, but I recognize that as a
7:35
weakness. So it's kind of one of the
7:37
things we put out to our people is that if you don't like
7:39
politics, don't aspire to a job that requires it.
7:41
You'll be miserable every day. So you guys talked to a lot of
7:46
Seesos. Russell, start with you.
7:48
I do you guys have a lot of seasons on your show and what is
7:52
top of mind for those folks right now?
7:55
Yeah, we we definitely bring in a lot of seesos.
7:57
We bring in a lot of people with industry expertise.
8:01
I would say right now there's a couple of things that are top of
8:04
mind. The first thing I would say is
8:06
AI security. You know, how do I secure my
8:08
MCPS? How do I make sure my employees
8:11
aren't uploading sensitive data to ChatGPT?
8:14
How do I think about the models in my tools?
8:18
Are they corrupted? Are they good?
8:20
A lot of that is being talked about.
8:22
And the other thing I would say is identity is also a big thing.
8:27
You know, certainly if we look at the Verizon data breach
8:30
report, it's the number one most attack thing, but also the deep
8:33
fake. How do I actually know what to
8:35
trust when I see a video of my CEO with a girl?
8:40
Was it real? Was it true?
8:42
I don't know. And how do I defend that?
8:44
And things like that I think are also starting to come up more
8:47
and more. Yeah, I think it's really
8:49
interesting this the whole AI can learn to remember, we'll get
8:52
into that. But even in the identity space
8:54
you talk about there's AI for identity and then there's
8:58
identity for AI. So that makes it kind of
9:01
interesting is like two different angles.
9:04
You can't just use the term AI for everything, right?
9:07
So G Mark, do you have anything to kind of add to that in terms
9:11
of what's top of mind for Cesar's right now?
9:14
Yeah, I think there's a lot of concern that people are looking
9:16
at their careers and we hear that, oh, there's millions and
9:19
millions of cybersecurity jobs unfilled.
9:22
Yeah, good, go try to find one. But we're also finding when you
9:25
talk about AI in those careers is that there's a lot of
9:28
pressure from organizations to control costs.
9:30
There always is. But now they're saying don't
9:32
hire any junior people, just turn over to AI.
9:35
What we run the risk of is creating a vacuum in our career
9:39
pattern where there's going to be one or two or north years of
9:42
few to no people so that when you need them at year 3:00 to
9:45
5:00 to 7:00 to 9:00 and let's say I get super, super
9:48
complicated, they're not going to be there.
9:50
And the other thing is Ross was talking about, it was identity.
9:53
And you know, you talk about identity at the center and also
9:55
assert that identity is your new perimeter because you can't rely
9:58
on a firewall to say everything is behind the firewall.
10:01
It just don't get behind that because everything is
10:03
distributed and ultimately the attackers are saying, yeah, your
10:06
technology is pretty good. Zero days are pretty expensive.
10:08
But boy, if I could become you for a day and look at all the
10:11
damage I can do. And then as Ross had mentioned,
10:13
with the deep fakes and some of the really quality tool sets
10:16
that are out there, as I see. So I'm not so worried about the
10:19
technology breaking as I am my people holding the door open for
10:22
the bad guys because they didn't know any better.
10:24
And it's kind of on us to make sure that everybody realizes
10:27
just what those capacities are out there.
10:30
And I'll just share what Oh. Go ahead.
10:32
And I'll just share one more thing that I thought was really
10:35
interesting about identity. I Ann's just released a paper on
10:39
their on their blog where they showed the cost of identity
10:42
between a small and a medium and a large company.
10:45
And there were no economies of scale.
10:48
That means if you're a Fortune 100 or Fortune 500, you're
10:52
paying more per person to do identities than a small company.
10:56
So there's a lot of opportunity to innovate because it shouldn't
11:00
get more expensive, it should get cheaper.
11:02
I. Have a son who's a junior
11:06
cybersecurity major and I remember telling him like,
11:09
there's so many jobs. There's more jobs than there are
11:13
people. Is that still true?
11:15
Because I think his generation is starting to get the message
11:18
that AI is going to take all the jobs that people like you are
11:22
going to school for. You can still get a job sweeping
11:25
floors or about the thing and and I mean that kind of
11:28
flippantly, but that point is this is we take a look at what
11:31
are the skill sets that are being replaced by AI.
11:34
What is it good at? It's good at, if you will, what
11:37
we call cognitive processes, processing data and coming up
11:40
with an answer. It's good for doing mathematical
11:43
calculations that are need to be precise, but you're doing lots
11:45
and lots a lot for them. It's good for tedium where
11:48
things like that, you go right down the list of all the things
11:50
that we look at that kind of fall within the area of
11:54
cybersecurity and we go that's a little bit concerning as
11:58
compared to being a plumber or Carpenter or somebody that's out
12:00
there. Physical proximity and the
12:03
ability to interact with physical devices is going to be
12:07
one of the last frontiers for AI, OK?
12:09
You're not going to see a terminated robot out there with
12:11
a hammer and a bunch of nails working on your house anytime
12:14
soon. And so the concern therefore is,
12:16
is that if somebody is a junior and senior and then like, where
12:20
are the jobs? Of course, the first source of
12:22
retreat is dad. I want to go to grad school.
12:24
I can put off reality for another year.
12:26
So get prepared for that. Introduce them to the concept of
12:29
scholarship for service because it's a good alternative to
12:32
paying for it by mom and dad. But the other one is, is that
12:36
somebody needs to be able to own these things going forward.
12:41
There's a generational gap. We find out that.
12:43
But when you get Gray hair or your forehead becomes A5 head
12:47
and you get on in years that you're not thinking about
12:50
technology of the same way you used to when you're young, you
12:53
tend to willing to be embracing new ideas.
12:54
You're going to try more and you're willing to fail more.
12:57
You have less at risk. You can fail spectacularly at
13:00
your job at age 21 and recover at age 21 and three months, but
13:05
try doing it at 50 or 60 and lose everything.
13:08
It's a little bit harder to start over at that point.
13:10
So I think what you're going to find then is the way that you'd
13:13
portray yourself going into the job market is make the lack of
13:18
years of experience and asset. I'm not beholden to any old
13:22
ideas. Things are changing very
13:24
rapidly. Years ago I wrote G Mark's Law
13:27
as a corollary to Moore's Law, half of which you know about
13:30
cybersecurity will be obsolete in 18 months.
13:33
Anybody who had a Windows 10 machine, guess what?
13:35
Last week, and if you go back 2 cycles, 3 years, nobody was
13:39
doing prompt engineering, nobody's doing chachi.
13:42
It just wasn't there yet. And then you go another 18
13:44
months from now, another 13 months.
13:46
So it changes very, very rapidly.
13:47
So the hiring managers are going to be using an old metric saying
13:53
dollars per person is programmers per the by the
13:58
pound. You need to convince the
14:00
management that you need a different metric.
14:02
And a different metric is somebody who could think at the
14:05
speed of the evolution of the technology, can adapt to that
14:11
and is willing to go ahead and put the time and effort into
14:14
mastering new technologies. Even if it dead ends, you
14:18
haven't dead ended the career of a senior executive vice
14:21
president and this person can still dust themselves off and
14:24
said, well, I just learned a whole bunch of things that will
14:26
be very applicable someplace else.
14:27
So just never give up on yourself.
14:30
But it's tough to find a job that will let you do that,
14:32
especially as a entry level person, let's say into the
14:35
market, right. It's your your leaders who are
14:38
bringing those people in need to encourage that sort of fail
14:41
fast, learn things, etcetera. There's always the federal
14:44
agent. I mean, I, as I said, I sold my
14:46
soul for my college degree with an ROTC scholarship.
14:48
Now when you go in the Navy, it was my choice.
14:51
All of a sudden you find yourself.
14:52
I remember an old recruiting poster, it said be on the board
14:55
of directors at 22 and it showed a destroyer wardroom of about
14:59
the fourteen officers sitting around the table and merely a
15:01
couple of junior officers there. I didn't have any college debt
15:05
coming out of my undergraduate because the Navy had paid for
15:07
that. I had a guaranteed job and
15:09
people who, for example, do scholarship for service.
15:11
I've spent nine years working on the Advisory Board for National
15:16
Cyberwatch, and what we did is we aligned the curriculum from 2
15:19
year schools to four year schools so that you could go to
15:22
a Community College for two years, then go on to a four year
15:24
school like Hopkins, have 100% of those credits transfer to go
15:29
over to Hopkins without having to retake courses.
15:32
And oh by the way, if you scholarship for service to pay
15:34
for the latter 2 years, you then have a guaranteed job of the
15:37
federal government. You're going to probably now, at
15:39
the end of that cycle, have an associate's degree, a bachelor's
15:42
degree, two years of job experience, most likely one or
15:45
two certs of the security world and 0 debt.
15:49
And that, I think is the master recipe for being able to move
15:52
forward and not worrying about it because there will always be
15:55
requirements for expertise in the military and in civil
15:59
service as you get closer to the top.
16:02
The pay isn't all that great, but when you're 22 years old and
16:05
you can live in a dorm room, what's the difference whether
16:08
you're making X or 1.3 X? It's still your life and you'll
16:12
be fine. You've got punt.
16:13
Grab that experience and go with it.
16:15
It's very fungible later on. So let's take it back to the
16:19
CSO. Where does identity fit from a
16:23
ranking perspective with CSO's? You know, Ross, like when you're
16:26
talking with folks, is identity the first word that comes out of
16:29
the mouth? Is it the second, third?
16:31
Does it not come out of certain mouths?
16:33
Like help me gauge where CSO's are at today when it comes to
16:36
identity? So it's not as high as as you
16:40
think AI or product security is. But at the same time, I've also
16:45
seen a shift over the last five years where identity may have
16:49
belonged to the network or the help desk team now squarely
16:54
falls under the sea. So it's one of the pillars along
16:57
with GRC and product security in the sock.
17:00
So I think there's going to be a lot of discussions of how do we
17:04
MFA all of the things, how do we protect against stolen
17:08
identities and customer fraud. But I would probably put it as
17:13
like 1/8 priority on the list of priorities for Cesos today
17:19
occur. Identity you looking for yes or
17:25
no and there or maybe yeah, all these equivocate, right.
17:31
But I was talking to one of the vendors over here a little bit
17:33
earlier and they had their little authentication card.
17:37
Oh, great little car. All the certs said how many
17:39
certs does it store 30. I said if I go to my Microsoft
17:43
Authenticator, I have more than 30.
17:45
And this is the BAT phone and my regular phone here I've got
17:48
another 20 some odds. So between these two I've got 50
17:51
different identities that I have to manage and those are just the
17:54
ones that I've been able to enable MFA for.
17:56
And so our identity becomes extraordinarily important is any
18:01
system that is critical. And I would say any system
18:03
period that you're going to touch, you ought to have some
18:05
sort of MFA involved. Why is that important?
18:09
Because passwords can be socially engineered.
18:13
Somebody goes ahead and can create an artificial identity
18:17
that looks like the CEO or looks like the help desk or whatever,
18:20
and people cough things up. Phishing campaigns, vision
18:23
campaigns, mission campaigns and the like.
18:26
All those combined to do what? Single factor authentication,
18:29
saying my identity consists of an ID and a password doesn't
18:34
work anymore. And we have something, you know,
18:38
something you are, there are something you have, but we have
18:42
a fourth identity factor has to do with those little GPS things
18:47
up there someplace you are. And now I can go ahead and say,
18:50
wait a minute, you're trying to log in from Romania, but 5
18:54
minutes ago you were in Orlando. That's sort of impossible
18:56
travel. And that's on a factor that I
18:58
should consider. So I think we're extending our
19:00
concept of what identity is to include a number of factors that
19:04
have to be thought about because attackers are going to try to
19:07
get around the controls. They've realized their technical
19:09
controls are getting pretty good.
19:11
You're not going to go ahead and find a dozen 0 days anytime
19:14
soon, but boy, can you go ahead and convince the user to hold
19:16
the door open for you digitally. You win.
19:18
So I think that identity is a big target for attackers and it
19:22
has to be one of the things we defend the most.
19:26
Having heard that, do you want to jump back in?
19:28
Because I was thinking as you were saying, your answer is, I
19:30
think you said like 8th, right? It's kind of on the list.
19:33
Is that also maybe because the seeso might be thinking that
19:37
they're good enough at it from an identity standpoint where
19:40
they do need to focus on other things?
19:42
I think there's things that are top of mind for a seeso like how
19:46
do I get my budget approved? What do I do for AI security and
19:51
and those are right now top of mind for where I would put
19:54
things. Now, where there's some novel
19:57
space is is, I would say, agents.
20:01
How do we trust an agent and what level of capabilities do we
20:05
give that person? Is it going to be the same as a
20:08
human or are we going to really limit that agent and not give it
20:13
the full permission? So that may be something that's
20:15
that's kind of up there. The other thing that I would say
20:18
is is kind of a nightmare is not the human identity.
20:21
I think, you know, the Pam systems do that pretty well.
20:25
It's the non human identities and when you look at the
20:28
numbers, there's something like 40 non human identities, laptop
20:32
servers, AP is all of those things that require permissions
20:36
and it is very much the wild Wild West.
20:39
You go to a Fortune 500 company, say tell me how many non human
20:43
identities you have. Show me how that's being
20:45
governed and I think you will just it, it, it's perfect for
20:50
Halloween. I, I think that's just maybe
20:52
what we should dress up as, right?
20:54
Trick or treat, here's the, you know, bazillion machine and non
20:57
human identities in your organization.
20:59
Good luck. Well, fully you've got workforce
21:02
identity, customer identity, you've got the non human
21:06
identity. It's like this space keeps
21:09
getting bigger and bigger and more and more complicated.
21:11
I mean, I feel sometimes like we're identity practitioners,
21:15
we've devoted our careers to understanding this space.
21:19
And sometimes it's like overwhelming to me.
21:23
I'm wondering like, how is it for Caesars?
21:25
Are they overwhelmed by it? Do they do they have their arms
21:28
around it? And then I kind of tangential to
21:32
that, I feel like a lot of sees a lot more Caesars are coming
21:36
from identity backgrounds into Seeso ship.
21:40
Are you seeing that as a as a real trend?
21:43
I, I haven't seen it as much because identity and having a
21:46
deputy CSO and identity is, is still pretty new, probably five
21:51
years or less. So we just haven't seen that,
21:53
that those folks come in. Now certainly if you're going to
21:56
go to a network company, let's say you're going to be the head
21:59
of a Cisco as the CSO there. I absolutely think something
22:03
like that would be extremely important.
22:05
Historically, we've seen more CSO's come from the GRC side
22:09
because you're a highly regulated bank and you need
22:12
someone who understands all that compliance or you have someone
22:16
who grew up in the SoC and it's a post breach scenario.
22:20
Hey, our company just had a bad issue.
22:22
We need to bring someone in who can fix this and don't let it
22:25
happen again. Now.
22:27
Now behind the scenes identity may be the most important thing
22:30
to implement, but historically they brought, you know, the head
22:33
of a SoC who understands that clean up and and that may be
22:37
something that changes in the future.
22:40
You too Mark, do you think that Csos have a comfort level with
22:44
identity or they come more and more from an identity
22:46
background? I think at the end of the day,
22:50
most Csos make decisions based on what's in the best interest
22:54
for themselves and their own careers.
22:56
Now you're not trying to be saying it's self-centered, but
22:58
let's think about it. You're not going to go ahead and
23:01
do something very risky without a very good reason because
23:05
otherwise, like, all right, sorry you lost your job.
23:07
Now I think one of the other talk presenters is talking about
23:10
how when the Fortune 500, the Sisos are playing musical
23:13
chairs. You move here, then two years
23:15
later you're there. And two years later, I got a
23:16
buddy of mine has been a Siso 8 different times.
23:19
Anything like, wow, I can't hold down a job.
23:21
Well, he's actually adding value every place he goes.
23:23
So why am I bringing that up? Because when you look at things
23:25
such as identity, if it's something you understand, it's
23:28
something that you know, you're something you're comfortable, if
23:30
you'll make decisions accordingly and you'll feel that
23:32
this is going to go ahead and preserve where I am.
23:35
And of course, career wise, it helps out.
23:37
But if you don't understand something, then you either look
23:41
for an expert to help you or you try to gain the knowledge
23:44
yourself or you ignore it. Well, number 2 is difficult
23:48
because as a see so you got way too many things to be doing.
23:51
And so you go back to #1 or #3 as Ross was saying, the concept
23:54
of having a deputy see. So for identity, fairly new and
23:57
not fairly prevalent. And the last part is like, well
24:01
do I just ignore it and hope it goes away?
24:03
And and what I would say is a proxy for who's going to be the
24:07
next CSO usually is head count. So if the identity team is 10
24:12
people, but the sock is 50 people, that deputy CSO over the
24:16
sock much more likely to get promoted into that CSO role than
24:21
the smaller team. That's a that's that's a really
24:25
interesting look at I you're absolutely right.
24:27
I don't know why I didn't think about it that before, but yeah,
24:29
that's that's the way it works. So let's stay with that track of
24:32
money. So Seesos, they're a constant
24:36
being pitched projects by either themselves, the rest of the
24:40
organization or parts of their information security, you know,
24:42
organization. What are some tips that, you
24:44
know, people listening to this are probably an identity, just
24:48
probably, right? We're not on Netflix, so I'm
24:50
assuming they're identity perfection, you know,
24:51
practitioners. Hey, come over to the dark side
24:53
with identity. We've got cookies.
24:55
That's right. So how do those people make
24:58
those pitches to see So's or maybe other parts of the
25:03
organization that control funding?
25:05
I want to invest in this program or project or technology to
25:10
solve for this issue. How do they make that that
25:12
investments up? Why do I make any investment?
25:16
Because it's either is going to improve my return on investment,
25:21
that's what the NBA's want, or it's going to reduce my risk,
25:24
which indirectly improves my return on investment.
25:27
The hard part and return on security investment or ROSI,
25:30
it's like return on seat belt investment.
25:33
Hey, I put my seat belt on every single time I drive a car.
25:36
Been doing that for many, many years.
25:38
It's never saved my life. Why do I keep doing it?
25:42
Because in the event of some low probability, high impact event,
25:46
it's going to save my life. It's not the click it or ticket
25:48
marketing that's doing that. I'm not.
25:50
Worried about the plate? Yeah.
25:51
On the other hand, yeah. You're worried about the officer
25:52
friendly pulling you over there. And hey, Sir, if I gave you one
25:55
of my beer models, we call it even.
25:58
But what we take a look at then is if I can't educate the CSO
26:02
because he's too busy, can we then do it incrementally?
26:07
And what do I mean by that? One of the things that Ross and
26:09
I have built with the Cecil Tradecraft podcast, which as you
26:11
said, we're done with five years, 256 episodes, is we've
26:15
created bite sized chunks of knowledge that are what we
26:19
consider high nutritional value. There's no marketing flop in
26:22
there. We don't keep talking, just that
26:23
we still got another 37 minutes to go to fill out the podcast.
26:26
We're done, We're done. But the idea there is that we're
26:28
trying to create a place, a watering hole if you will, for
26:31
CSO's to not in the negative sense of watering hole where you
26:33
go ahead to mail her, but you get smart and you're a little
26:36
bit smarter every day. So for somebody trying to get
26:38
their CSO or the executives to understand why they should fund
26:41
identity, help them get smart a little bit at a time.
26:44
It doesn't mean you can't sit them down and make them listen
26:46
to an 8 hour seminar, but 3 minutes here, 5 minutes here, a
26:50
little discussion there, and make it around how it provides a
26:54
better return for the business and an alternative investment.
26:59
What would happen if somebody like the CFO believed that the
27:04
CEO told her to transfer $8 million for a special private
27:08
acquisition that nobody's supposed to know about?
27:10
And here's the data for this bank over here in Asia.
27:15
Well, that could be very expensive if it goes sideways.
27:17
And now you can demonstrate that with some of the deep fake
27:20
technology to say, watch this. Would you believe it?
27:24
Well, there's even the story of Esther, I think it was Malaysia,
27:26
right, with the bank that got hit by 25,000,000 because now
27:29
this was in my mind very clearly targeted because it was, you
27:33
know, this poor person joins a call, teams call with the board
27:36
or something. And every single person on that
27:38
call was not a real person. Clearly that's targeted, but
27:42
that just shows like it's getting easier to pull that off.
27:44
It's. Getting harder and harder to
27:46
detect that. So it used to be he said, hey,
27:47
if you're a fake, put your hand up in front of your face.
27:49
Well, now the deep fakes can do that.
27:51
So Lavis when I started said, hey, draw it.
27:53
If you're doing like an interview, for example, you want
27:55
to make sure this person's not from DPRK, draw a smiley on a
27:58
piece of paper and hold it up. Well, AI hasn't quite figured
28:01
that out, but it will. So you ideally what it comes
28:04
down to is to have either unpublished knowledge, this
28:12
shared mutually or what to call like a code word.
28:14
What do we mean by that? Hey, what do we have for dinner
28:17
last night, Ross? I'm not.
28:18
Well, I yeah, maybe you're not, Ross, but if we said yeah, we
28:24
just grazed the buffet and we starved a whole bunch of free
28:27
food from the vendors, Yeah, that's what we did.
28:29
But another reason why nobody wants pictures of their food on
28:31
Instagram, because now you can social engineer and say, OK,
28:34
well, now I know what Ross had for dinner last night.
28:36
I'm not saying you do that, but. Might be an interesting point.
28:38
So what we find then is that the sources of where these dangers
28:41
are coming from are ourselves, as you had indicated.
28:45
Hey, yeah, here's my dinner, here's on the Facebook, here's
28:47
what I'm doing, here's my whole life story up here.
28:50
Here's my home address and things such as that.
28:52
And then we'll be fine then. And put yourself up on LinkedIn
28:55
or on Facebook or one of the other identity sharing pages.
28:59
And I'll use that term specifically is that it makes it
29:02
easier for adversaries as well to salt your data, throw a
29:06
little bit of fake stuff out there so you know that a person
29:09
who knows you would not use assaulted data, but somebody who
29:12
doesn't know you would like. Oh, yeah.
29:14
Well, we went out for such and such, OK.
29:17
I'm 6 feet 2. Salted right there, child.
29:20
Named Rudolph the Reindeer. Ross, let me ask you a question
29:23
around that, that idea of getting funding.
29:26
If I am, let's say starting out and I've been brought in to kind
29:32
of kick start the I am program for an organization, what are
29:35
some of the questions that I should be asking myself to be
29:38
able to make that case to a cease service?
29:39
OK, it's risk related or it is return on investment, I don't
29:44
know yet. How do I figure that out?
29:46
So I think there's only two real reasons you get something
29:49
funded. 1 is risk reduction and the other is compliance.
29:54
And I'll just give you the example of compliance.
29:57
First, there are standards like if you're a bank, you have to
30:00
meet the New York Department of Financial Services, which is
30:03
going to require MFA for all sorts of things.
30:08
I don't really get a choice. I don't want to wear an orange
30:10
jumpsuit. So I'm going to do compliance to
30:12
make sure that law is satisfied, especially when I'm the CSO
30:16
signing my name off on that. So if somebody says we have to
30:19
do it, that's that's Tier 1 of what gets funded.
30:23
The second thing is risk reduction.
30:25
So I would always go and look at things like the Verizon data
30:29
breach report and say, what are the most common attacks that we
30:33
see? Because chances are we're going
30:36
to get a little bit more of last year.
30:39
Yeah, there's going to be something new next year where an
30:41
AI agent happens to go rogue. But I guarantee if phishing and
30:46
stolen session credentials and those things are bad last year,
30:50
we're probably still going to see a huge overlap this year.
30:54
So then I have to say, well, what am I going to do when my
30:57
employee goes to a random web page, gives up their username,
31:01
gives up their password, gives up their MFA challenge code?
31:05
How did I still keep the company safe?
31:08
Do I have Microsoft conditional access policies?
31:11
Do I have, you know, really good allow listing on the firewalls
31:15
that that come say, oh, this wasn't from the corporate VPN?
31:18
What is it I put as these layers of defense because one human got
31:23
tricked? My whole company can't go down
31:26
because one person fell victim to fraud.
31:30
And that's how they usually start, right?
31:32
So shifting gears a little bit, what are you hearing from your
31:36
guests in terms of how they feel AI is going to impact
31:41
cybersecurity in the years to come?
31:44
Ultimately in cybersecurity, the desirable outcomes is to do
31:49
things cheaper, faster and better than last year.
31:52
So we know the bad actors are going to do things like use AI
31:56
to write crafty phishing emails, use AI to auto exploit publish
32:01
Cbes. We're going to have to use AI to
32:04
safeguard our companies. That means, you know, start vibe
32:08
coding to fix vulnerabilities. I know that sounds scary, but
32:12
but imagine this. If you have 200 vulnerabilities
32:14
and it takes you 30 minutes for each phone to fix it, that means
32:18
you have to spend 100 hours. What developer can give up just
32:22
over 2 weeks to go fix it? Probably nobody's has that
32:25
luxury. But if AI vibe coding fixes that
32:28
in 10 minutes, now I have the ability to go and start fixing
32:32
things and, and I think that's the change.
32:35
And we're going to also look at that on the sock.
32:38
Hey, how do I automate the sock? Because if the bad guys can
32:41
automate their scripts and I take a 15 minute coffee break or
32:44
bathroom break, I'm not fast enough.
32:47
I need to identify the sock operator.
32:49
Every little thing is going to happen like that.
32:52
And specifically to identity, if the business units is we're
32:56
going to shift to just in time identity approvals, well, it
33:00
better be just in time approved because I don't really feel like
33:04
waiting, you know, a week for two people to approve my my
33:08
ticket and sale points. So now I can actually get the
33:11
access. So, so those types of automation
33:14
tasks I think are really also going to be super important.
33:17
Yeah, I'd make sure. She Mark, what did the Earth
33:19
bill find for new gas? I think Ross has covered a lot
33:23
of it. We see what we find out is AI is
33:25
inspiring an arms race and the attackers can do more because
33:30
we've democratized the specialized skills it takes to
33:34
write really nefarious code. And now it doesn't take anything
33:39
more than a free license and a little bit of prompt engineering
33:43
to go ahead and get something that works.
33:45
So Ross mentions vibe coding. OK, great, that sounds scary,
33:49
but do it. If it gets you 90% of the way
33:51
there, that's 90% better than what you had before, and you go
33:54
back and then you can clean up the boundaries.
33:56
And it's also prioritization as well.
33:59
There's an awful lot of vulnerabilities out there that
34:01
really aren't critical path for what's critical in our
34:03
organization. I don't care if somebody steals
34:06
the trash. I don't care if somebody reads
34:09
all the garbage as long as it's not from the sensitive bucket.
34:12
I'm glad you put that caveat in there because I was about to get
34:14
it out. I know you're going to lie after
34:15
that. I can see you squirting in.
34:16
Your sage is ready to jump all over your your gas, right?
34:19
And things like that coming over the top of the table.
34:22
But ultimately what comes down to is understanding what is a
34:26
business imperative. And the business imperative is
34:28
to protect revenue, to protect the revenue, the processes that
34:32
generate revenue. And therefore, we protect those
34:35
processes that generate revenue by ensuring that these new AI
34:40
tool sets, which can operate faster and perhaps more
34:44
convincingly, are not going to be as effective.
34:47
Because we've inoculated our users, we understand a little
34:50
bit more about what's out there for the capability.
34:53
We've automated some of our responses.
34:55
So there's not time necessarily for a human in the loop.
34:58
You don't need it. Take the first two or three
34:59
steps, something that would least hold them at the Norway
35:03
and said like, I think I got 1 and your dog's like, let it go,
35:06
OK, fine, and it comes or throw it out.
35:09
But if you just had nothing there, you're asking for
35:12
trouble. So AI is here, and it's going to
35:15
continue to progress. It's going to go at a very, very
35:17
rapid rate, whatever we define AI to be.
35:20
But think of it as a way to take deliberate processes, make them
35:26
move a lot faster. Take things that normally
35:29
require some cognitive process and make them available to
35:33
people who don't think as smart as that and things like that.
35:37
And then allow the nefarious people who are out there who
35:40
could then distribute this out there to multiple places.
35:43
If we're aware of what that threatened environment is, we
35:46
can go ahead and better defend. Ross, you guys both brought up
35:49
the vibe coding. What is your sense for how
35:53
prevalent that is today? Is it like all coding is going
35:57
through kind of a vibe guarding process now or is this somewhere
36:01
in between, you know, 50% a hundred?
36:04
What's your sense for how prevalent that that approach is
36:09
being used? If we look at the GitHub state
36:13
of the the developer report, what you're going to see is high
36:17
80s to 90% of all developers are using AI assisted coding tools.
36:24
And that number is only going to go up because it's all about
36:28
effectiveness. If I can prompt query instead of
36:32
write code from scratch and searching, I can write way more
36:37
code faster. Now it's going to have pros and
36:39
cons. It's going to write crap code
36:42
and it's going to write good code and I have to be able to
36:44
distinguish it. But the problem is the more I
36:47
start to rely on it, the less I'm actually going to be able to
36:50
code. I'm just going to say it doesn't
36:52
look good. And when I look at that user
36:54
interface, and if it does, hey, that's good enough for me,
36:58
submit. If it doesn't, then you know,
37:01
I'll just re prompt. So we're going to become Dumber
37:05
in our ability to develop even though we write more code
37:09
faster. So I think it's a totally
37:11
different skill set it and now what we're going to have to do
37:14
in cyber is we're going to have to ship the trust from the
37:17
developers to trusting in the supply chain scanning of code as
37:22
it goes through the CICD tools. How do I scan code for
37:26
regulation adherence? Does this code meet the EEI app?
37:30
Does that meet CCPA or HIPAA? And that's things we haven't
37:34
really looked for in code. I I think that'll be the next
37:37
generation of where code scanning and vulnerabilities.
37:40
Go So does that leave a gap then, which I think is what you
37:44
were maybe getting at earlier is you've got you're, you're
37:47
missing sort of that middle career almost right where the
37:50
people who came in, they spent maybe a couple years, five
37:52
years, even 10 years, right, building up their skill set.
37:55
And then now maybe they're in a leadership position if there's
37:58
nobody in that funnel. And that was a problem we had in
38:01
the military in 1990190293 fall of the Soviet Union.
38:07
All of a sudden, like our pure competitor is gone.
38:10
Like I remember seeing a joke ad that put in a, you know, in the
38:13
ad it says wanted pure competitor who can go ahead and
38:16
feel the Navy. You know, I'll apply at the
38:18
Pentagon. It was like a help wanted ad.
38:22
But as I recall, going to the Naval Academy that year and said
38:26
we don't need this many new junior officers.
38:29
If you've got your four year degree and you don't want to put
38:31
on a uniform, just go in peace. They're like, really?
38:34
I can leave. Yep, free education.
38:36
Yep, out of here. And so it didn't go to 0 because
38:40
then people said, no, this is what I really want to do.
38:42
But we do that planning as senior leaders, we have to plan
38:46
10 to 15 to 20 years in advance on the flow of what we do.
38:50
And maybe we let a little bit more in than we need because
38:53
we're going to have a requirement through natural
38:55
attrition. Everybody who starts out at the
38:58
beginning, by the time you get down to the point where you're
39:01
like in the Navy or a captain, you've lost six or seven out of
39:04
eight and you want to make one star, you're going to lose 199
39:07
out of 200. So it gets very, very narrow at
39:09
the top and you have to have that to select from.
39:12
So short sighted HR and manpower policies that say let's replace
39:18
people with AI, it's going to bite those companies, going to
39:21
bite them hard. Now I'm going to have to go turn
39:22
to somebody else as a source. So what that's going to be is
39:25
that if you manage to get in now in three to five years, when
39:29
everybody else realizes there's a huge vacuum and there's nobody
39:32
out there, you can write your own ticket, but you got to talk
39:35
your way in today. So maybe go to a company that
39:37
doesn't understand, but then how to use AI and then you get in
39:41
the pipeline and then make that your hobby because all of us do
39:44
something in addition to our day jobs.
39:46
Well, that's the whole point of being a subject matter expert.
39:48
Now is how do you know that the AI isn't hallucinating, right?
39:51
Making up facts. If you don't have that
39:54
background, that skill set, that expertise, how are you going to
39:57
make that determination? Well, it's interesting.
39:59
You look at the hallucinations that I've found.
40:02
The more precise, the more accurately you build your Proms.
40:07
The less likely you are to get a hallucination.
40:10
And if you understand how these large language models work,
40:13
where they're just a mathematical correlation between
40:15
tokens, tokens in this case usually being English words.
40:19
So you feed it a few petabytes of the English language.
40:21
You let it do unsupervised learning and it says, hmm, the
40:24
word the often appears before cat, but it very rat rarely
40:28
appears after cat. And this we appeared that that,
40:32
that. And after a while you start
40:34
getting these probability ladies.
40:35
And then after a while you can say I can predict things.
40:38
So what do you mean you can predict things if I say the word
40:41
peanut, Peanut butter? It's a little bit like looking
40:45
at the old Terminator. Bean Ming Ming Ming BB Be.
40:48
Picked that out to peanut butter and peanut butter and Jelly,
40:51
peanut butter and Jelly sandwich.
40:53
And then we go, wow, it's writing something.
40:55
But if we say try the next most probable thing, it could be
40:57
peanut allergies are a problem for children and you pick
41:01
another one and you get like peanut, the squirrel was killed
41:04
by the New York State Department of Aggregate or whatever.
41:06
And if we go far enough down these probability chains, you'll
41:10
find change of thought that humans would have rejected
41:13
immediately. I'm a little chess player and
41:15
you got to know that by the time you get 20 moves into a game of
41:17
chess, the number is spectacularly huge of the
41:20
possible things. And yet you can play really well
41:22
because you know how to trim that tree.
41:24
You get rid of 99 point some number of nines, percentage of
41:27
the things that don't make sense.
41:29
AI doesn't do that. It ingests all of them.
41:32
And So what we call a hallucination might be a 0.001%
41:36
probability, but that's the highest thing that's left
41:40
because it has no way of answering your question with
41:44
those three magic words. I don't know.
41:48
And if you have an AI model, unless you can prompt it to say
41:53
any confidence factor below this number, I want you to always say
41:56
I don't know. Never give me an answer below
41:59
this. Well, you might get rid of a lot
42:01
of hallucinations that way and you'll get some.
42:04
I don't knows which should be better.
42:06
And I do that when I go to Lake Lowe's and I'm looking for
42:07
something, I say like, do you know where such and such it is?
42:10
And I tell the guy and honest, I don't know.
42:11
It's better than the wrong answer can.
42:13
I can tell he's puzzled. He's like, yeah, I'm not sure.
42:15
I says thank you for telling me you're not sure.
42:17
Like people feel comfortable with not knowing and AI is not
42:20
comfortable with not knowing. It's got to know the answer.
42:22
Well, it's got to be a great product, right?
42:24
And a great product doesn't say I don't know, at least in the
42:27
minds of consumers. So we even think they're
42:29
thinking about that. Should it be a tunable item,
42:31
though, within these large diagonal models, whether it's
42:33
Open AI or Enthropic or Google or Meta, whoever's building
42:36
these things, should there be a setting somewhere that says only
42:41
tell me if you're X percent sure?
42:44
You might be able to prompt that in because what you have with
42:47
the. Should I have to crop it in?
42:49
Should I have? With the, with the AILM, here's
42:51
the thing here, because if you take a really low probability
42:54
thing, you might say, hey, this thing you just invented a new
42:56
drug or it's discovered a way to fold the protein that nobody
42:58
would have thought of before. It's because it's a .00001.
43:02
It just happened to be right. It's like winning the lottery.
43:04
Statistically, someone's going to win the lottery.
43:07
Statistically, I will never live in the lottery.
43:09
OK, I'm OK. You won by being on the identity
43:11
I'm. Comfortable with both of those
43:13
things. So when we look there at the
43:15
LLMS and setting that threshold or whatever and saying can a
43:18
user pick that? What you have is a problem
43:21
called in band signaling. Now in band signaling is a
43:24
problem, goes all the way back to John Draper AKA Captain
43:28
Crunch and the old s s fives were being able to blow a
43:31
whistle at 2600 Hertz and reset the connection.
43:35
Because in band signaling means you inserted data into your data
43:38
channel and it becomes executable as code.
43:41
Thank you von Neumann for your model.
43:43
In any case, what happens now is an AI you have in band
43:47
signaling. That's what we call escapes.
43:51
You can go ahead. Instead of it giving the data
43:53
that it needs to come up with an answer, we're inserting commands
43:57
because of the way it's designed to do in band signalling, and we
44:00
have not yet perfected the way to separate the signal that's
44:04
valid from the signal that's malicious.
44:06
And that's really where the research needs to be done.
44:09
And I guess they're trying, but I don't think the current models
44:12
support that just because the way they're architected.
44:15
So should it come with a minimum threshold?
44:17
It does. It's zero.
44:18
Should you be able to set it higher?
44:20
I try it, I haven't tried it yet.
44:23
Just go back to ChatGPT and any answer below .0001% or whatever,
44:27
don't tell me. And then ask it some stupid
44:29
question and keep doing that until you get a threshold where
44:31
you get and I don't know, and then maybe you feel comfortable
44:33
with. It Ross you've been looking on,
44:36
do you have thoughts on this? Say the question one more time
44:39
and then I'll. Keep.
44:42
The second thing that goes with old age is your memory.
44:45
I forget the 1st. Well, I guess, I guess my
44:48
question is, is should the consumer, whoever the consumer
44:54
is of AAI product that is using a large language model to make a
45:01
statement, right or question answer a question?
45:03
Or maybe should the consumer have the ability to tune it to
45:10
say OK, if you're not sure to X percent, don't give me the
45:15
answer because I have not seen that as a out-of-the-box
45:19
configurable setting. Now can you prompt it?
45:21
Maybe I haven't tried it, I will.
45:24
I think you're. Right.
45:26
I think you're right. I haven't seen that feature, but
45:28
I'll give you a different view. If you were to ask ChatGPT tell
45:32
me about X, it'll give you a text response.
45:36
But if you ask something like perplexity to give you a thing,
45:40
it will be like a college essay where it sites all of those
45:43
things. I think that is going to become
45:46
the new norm. You know, where I should be able
45:49
to have a pedigree and lineage on everything and then I can
45:53
actually go and verify. Now sure there may be a
45:56
hallucination problem where it invents this thing, but if
45:59
somebody does the due diligence and looks it up then you should
46:02
be able to say wow this is from a trusted resource right?
46:06
Yeah, that explainability, I remember the the early part of
46:09
AI was, oh, here's just an answer, right.
46:11
And then I don't know who started at first.
46:13
I want to say Bing actually started to yeah.
46:17
But at least in the AI world was like, oh, now you start to see
46:19
these little numbers and asterisks and like, OK, it's
46:22
starting to that. And now I'm seeing it almost all
46:24
the AI products. I pull in the string shield
46:26
back. I know that and it's getting
46:28
better all the time, but I remember trying some girly stuff
46:30
with some of the open AI products and it gave me a bunch
46:32
of references and every last one of them was a four O 4.
46:36
So it was hallucinating the references.
46:38
So that's. Or worse, it's vibe coding its
46:41
own answers, and all of a sudden it's a web page that looks real.
46:44
Maybe the trick is we asked one AI to validate the other AIS
46:50
output because that because they're, you know, then they
46:54
have to be a syndicate if you really want to get past us.
46:56
But you know, if Claude validates chat sheet PT and
46:59
says, no, this is all hallucinated, that's probably a
47:02
strong indicator. And you didn't have to do all
47:04
that research, right? Or maybe you asked three AIS to
47:07
say, do the first AI make something up.
47:10
And if all three give you a thumbs up, now you've you've
47:12
kind of given a level of trust, right?
47:15
Well, it's almost crowdsourcing open source.
47:17
What do I mean by that? If I want to get a whole copy of
47:20
something like Truecrypt, well, first of all, what version do I
47:24
get? And then if I go ahead and I
47:27
look around for this code, which is in different places, I find 5
47:30
of them. I download 5 copies.
47:32
Well, what do I do? We do a shot 256 on it and four
47:35
of the five match and one doesn't match, which is the
47:37
likely the good one. Statistically, the good one to
47:39
be the four that match and the one that's not matching is going
47:42
to be your malware because you've got them from all over
47:45
the place. That's a pretty imprecise
47:46
science. I don't know if I want to base
47:48
this excuse. I don't know if I base this like
47:50
beat the correct one and it's a possibility and you assign
47:52
probabilities to that. But you know, if you have no
47:55
authoritative source, which is what we're talking about with
47:58
AI, because if you had the authoritative source, you knew
48:00
the answer, you go look it up yourself unless you're stupid
48:02
lazy and then you don't deserve your job.
48:04
But that's the subway thing. Podcast if you're here.
48:09
Yeah, the podcasts are the stupid, lazy, the
48:12
Procrastinators podcast show. We start next week and.
48:15
Listen whenever. Yeah, maybe.
48:17
Yeah, we've been starting next week for the last several years.
48:20
But back to the idea of being able to know the fidelity and
48:24
being able the provenance of data and really it ties back to
48:27
identity. It's a provenance of the
48:29
identity of the information. We think of identity as being
48:33
human identity, human actors, non human actors.
48:36
But what if your information is assigned an identity?
48:40
That's a little bit different mile, but what would you run
48:43
with that? Don't dismiss it out of hand.
48:45
Sit around, think about it, discuss it a little bit and say
48:50
if information had identity, how would that be manifested?
48:55
Would it be a label and would it be inherent in it?
48:57
Would it be embedded in the information?
48:59
Would be a containerized? How would it interact with other
49:02
identity providers? Would we have an identity
49:05
provider for information? How would they validate that?
49:08
And this is a whole, you know, maybe you guys have covered this
49:12
up, but if I were to say, hey, go sit in the corner with a
49:14
bunch of smart people and invent something, then identity, that's
49:18
what I would start with. And maybe one of your listeners
49:20
going to be on Shark Tank in a few on saying hello sharks.
49:24
I got an idea for you. What if, Well, I think there's a
49:27
lot of companies right now that have settled on sort of this
49:29
matrix or graph based a, you know, identity thing.
49:32
That's like, all right, how do you do a one to many or many to
49:34
one relationship? That's just what we have now,
49:38
right? Somebody will figure out a
49:39
better way to do things. I do want to be respectful of
49:43
time. We're here at the conference.
49:44
We didn't really get to talk so much about CSO tradecraft itself
49:47
though, so I want to do the hot wing style.
49:50
OK, now tell the people what you got going on, where it's like,
49:53
tell us about the podcast itself.
49:55
Give us like the elevator pitch because I think the people
49:57
listening to this are generally identity people, but we are part
50:00
of information security. If they weren't on any people,
50:03
they still would not be listening after this much time.
50:05
OK, right. Yeah, the both of you people are
50:07
still listening. So where do I get the podcast?
50:09
What is it about? How often do you put out
50:12
episodes? That's just kind of tell me a
50:13
little bit more about that. Yeah.
50:14
So the podcast can easily be found on all your favorite
50:17
podcasts and platforms, Apple, Spotify, Pandora, any of those
50:21
things. YouTube, we have videos or you
50:24
can go to see so tradecraft.com. And the focus of our show is how
50:29
do we train the next generation of cybersecurity leaders.
50:33
So think of a lot of people can teach you more technical things
50:36
like here's how to go configure D mark on an e-mail.
50:39
We don't do that. What we do focus on is how do
50:43
you lead an identity access management program?
50:45
How do you build an application security program?
50:48
What metrics would use to gamify vulnerability management?
50:52
And then what do you do when you take those budgets to the chief
50:55
financial officer? How do you actually socialize
50:58
and get adoption from 10,000 developers in your organization?
51:02
That level of leadership and stewardship is what we try to
51:06
build with our tradecraft. Yeah, and it's funny, a bunch of
51:10
D Mark really had to fix AD Mark record over the weekend.
51:13
By the way, if you use comcast.com or Yahoo and your D
51:17
Mark record says none, but in terms of what you do with things
51:21
that didn't pass, it's going to reject your messages and delete
51:24
them and you can get non delivery problems.
51:26
That's something I just figured out this past weekend when I got
51:28
a panic message. When we get that we can't get
51:30
the emails through to Comcast and like pull the string, it's
51:33
like, oh, how about that? It's a config change, so.
51:36
G mark with the D mark. Yeah, there we go.
51:39
I thank you very much. In any case, the idea with the
51:43
podcast is to be able to provide a body of knowledge for
51:46
cybersecurity professionals who want to aspire to or stay in the
51:50
executive suite. There's a whole bunch of
51:53
information that is not technical that's required to be
51:56
effective. The best see So's are not
51:58
technical experts. A we've had a discussion Cecil
52:02
versus VC SO and AVC. So sometimes you don't have a
52:05
lot of depth in your IT's team and you might have to roll up
52:08
your sleeves and climb under a desk.
52:09
You tend not to do that as a fortune and see so, but
52:13
nonetheless, whether you have a background in GRC, whether it's
52:16
in technology, whether it's in government, whatever happens to
52:19
be identity, those are the tools that you bring to the job.
52:24
Our goal is to ensure that you remain aware of what is required
52:28
to be successful in your job and your career.
52:30
If you still have a ways to go in your career, how to get to
52:32
the next level, what are the things going to work for you and
52:35
how to stay at the top. This is not really for newbies.
52:38
The newbie doesn't care about how do you brief a board of
52:40
directors. They newbie doesn't care about
52:43
reading a corporate financial statement, but it's a see.
52:45
So you need to know these skills.
52:47
So what we've done then is you kind of also the genesis of it
52:50
is that I've been, I used to exhibited trade shows for years
52:53
and years. We're talking about, I think he
52:54
said. This is your first.
52:55
In first one. First for this one, yeah.
52:57
I've been having almost 30 years.
52:59
I spoke here in 199798 and 2000. I had the best attend and talk.
53:04
It was called PK. I don't think so and the next it
53:09
is about the name. I got to the keynote and the
53:11
three keynotes here the last year did the keynote.
53:13
The next year they had William Shatner is a keynote.
53:15
Let me know it was 2006 Bill Shatner keynote of this thing.
53:17
I think he got paid better than I did.
53:19
But the point was is that because of our audience, there
53:24
is strength in terms of the peer group.
53:26
And so for our subscribers and our followers our sees a trade
53:29
craft. We put episodes on every single
53:32
week, comment on them, provide a big string on LinkedIn so that
53:37
we get good, smart people talking to each other, and then
53:41
build your network based upon the core that we've created.
53:43
So we're really trying to create a community of both practice as
53:48
well as thought for chief information security officers.
53:52
I see goes the switch to great chemistry, different
53:55
personalities. It makes for an interesting
53:58
episode I'm sure. I always find it like crazy that
54:03
people always say, how do you guys keep coming up with topics?
54:07
To me it's like, how do you keep, how do you narrow down the
54:10
topics? And seriously, there's so much
54:12
to talk about that once a week is barely enough to address
54:16
everything. Well, you're right, I didn't.
54:20
Think we'd be going this far, but the input queue just keeps
54:23
getting bigger and bigger. And it's also partially because
54:26
G marks law. Remember, half of what you know
54:28
is obsolete in 18 months, so you go back 18 months, and half of
54:32
those episodes before that probably have been overcome by
54:34
events. It's a time capsule, right?
54:36
This is what was happening at that point in time and this is
54:39
what people are thinking about. Your RSA 128 bit teams and yeah,
54:43
maybe we should upgrade this section, that's why.
54:46
But more to the point, it does provide a historical reference.
54:51
And because what we do on our GitHub page, if you go to see so
54:54
tradecraft.com and click on the GitHub, you'll see it broken out
54:57
into 10 different domains. So you see, I really want to go
55:00
ahead and focus on this area of my see so skill set rather than
55:04
that, do so and then move. These are the 15 episodes that
55:07
are on that subject. So it really helps people go
55:09
ahead and pick through the library.
55:11
We don't have a Dewey Decimal system for it, but something
55:13
similar. We just we just go straight
55:15
numbers and then, you know, keyword and find it that way.
55:18
Like we're going to try to find it.
55:20
Well, I'm really glad we met. We're going to wrap up.
55:23
We always do on a lighter note, that's just kind of our style.
55:26
And since we're all, you know, podcasters, what better question
55:29
than say if you were going to start a podcast, but it's not
55:32
infosec, it's not security, it's something else.
55:36
What podcast would you start? What would it be about?
55:39
Ross, you get to go first. So I thought about this and it
55:43
and I may do it. I don't know if I will, but me
55:46
and my kids play this Roblox game called blocks for it's a
55:51
One Piece themed game. So if you like Japanese anime
55:54
and you're like I need to watch more than the cartoon, I got to
55:57
play the video game on Roblox. I would do a channel to teach
56:00
dads how to connect with their kids because I've been playing
56:03
with my four kids video games. And I think there's a lot of
56:07
dads who could, you know, connect with their kids or maybe
56:10
moms connect with their kids playing video games, but they
56:13
haven't the foggiest idea of how do I get into this world of
56:16
video gaming with my kids. And, and I think that'd be a
56:19
really interesting adventure. Yeah, it's super cool.
56:21
You're hitting on something that's like in the zeitgeist,
56:23
right, too. So I hate to say it, but the
56:25
total addressable market for that podcast might be way
56:27
better. Anything in the world we're
56:29
doing right now. What about you, G Mark?
56:32
I think it's a little addressable, but I could be a
56:34
lot smarter because I, as I said, I mean the give the give
56:37
back phase, we're trying to help you get to the next stage.
56:39
So we do say create a podcast. It would be a podcast biotically
56:43
about self referential. Why?
56:45
Because a lot of people out there with great ideas who have
56:47
good networks who are not quite sure how to get going.
56:49
They don't know, hey, how about this microphone equipment?
56:54
How about that hairstyle? Whatever happens to me that is
56:57
going to make you more successful.
56:58
So that might not be a 256 episode podcasts, but it would
57:03
be helping people get that information out.
57:06
And pretty what we're doing is so that the people who want to
57:10
listen to the message that you have, you'll be able to reach it
57:15
and they'll be able to talk month after their lives.
57:18
So that's the thing. That's why you do a podcast.
57:20
It's not to listen to yourself talk.
57:21
There's a lot better races can be done.
57:23
But if we do is you're trying to help other people, some live.
57:26
Where is this reward? And I'd love to be.
57:31
Absolutely subscribe to that because I subscribe to podcast
57:34
or Youtubers today that are all about audio visual, right?
57:38
What are the right cameras, lighting, audio editing, right?
57:42
All that stuff. And you know, if you listen to
57:45
episode 1 of this podcast. Before going to teams.
57:49
It was, yeah. I think it was probably a Zoom,
57:52
a condenser microphone in a very echoey basement with seemed to
57:56
be made of nothing but echoes. Yeah.
58:00
And to listen to that episode and then to listen to something,
58:04
you know, more recent, that's all stuff that I learned doing
58:07
that stuff. And I totally relied on that
58:09
concept of people who are willing to take the time.
58:12
Yes. You know they're Youtubers.
58:13
Well, good. Maybe they need to be first
58:14
games. Yeah, I I'll, I'll be.
58:16
Happy to do it. How about you, Jim?
58:17
What's the back at you? So in July, I moved to the Black
58:20
Hills of South Dakota. I want to tell everybody that I
58:24
always get a similar reaction, which is John Strand.
58:26
Wow. But no, it's like, wow, that's
58:28
really cool. And why did you move there?
58:30
And I think there's just so much that people don't know about
58:34
that area, but people are interested.
58:36
Maybe they know that Mount Rushmore is there, or the
58:40
Sturgis Pike Rally, or the Black or Badlands.
58:45
So I just feel like that has endless topics and I'm still
58:48
exploring and learning about it. So I get to learn as I was
58:52
building the podcast. I think it'd be a fun topic.
58:55
How about you? Feel like I Black Mountains
58:58
influencer of some sort. Yes.
59:00
Black Hills. Black Hills.
59:01
Yeah, Yeah, I've been to the Black Hills.
59:03
It's very, very cool, especially at night where there's like, no
59:06
light pollution. You actually see, you know, the
59:08
stars in the Galaxy. So the reason why they call it
59:10
the Black Hills, by the way, is that there are these pine trees
59:13
that are on the hills. There's there's hills.
59:16
They're not quite mountains, but they're somewhere in between.
59:20
And when you see them from a distance, they look black and it
59:24
makes the hills look black. And it was actually the native
59:27
populations that named them Black Hills and, you know, in
59:32
their local language. I don't know what I would do.
59:37
I think I am at the phase of my life where I just like to talk
59:40
with people and find out what they're thinking about different
59:43
things. So people who don't know what
59:45
they wanted to do. So something along those lines,
59:48
like, yeah, it's just, you know, a standard talk show, right?
59:52
Where it's like, oh, OK, tell me about yourself.
59:55
What's that like? You, you have this position on
59:59
something. What's that like comment on that
1:00:01
I mean? I, I think I've probably
1:00:02
mentioned this show, I'm a big fan of the Bennington show on XM
1:00:05
or I, Sirius now it's just kind of a radio show about anything
1:00:08
and everything. It's part comedy, it's part
1:00:11
news, it's part sports, kind of over everything.
1:00:14
It reminds me of going and back and sitting on the couch with my
1:00:16
friends when I was, you know, in my early years and just talking
1:00:21
about the world, know what's going on and trying to
1:00:23
understand different viewpoints. And so I think, I think there's
1:00:28
a market for that and I, I hope at some point, but if it's, it's
1:00:32
just, hey, Ron, you came up man. And you're like, now we're doing
1:00:36
a podcast, what, 3 hours later? Like that's the kind of thing I
1:00:39
think is super cool on having that connection and being able.
1:00:42
To do this podcast, that's your. Yeah.
1:00:44
We don't know when it will happen.
1:00:46
It will happen at some point and yeah, that kind of thing.
1:00:48
So. Chapman, Jim, thanks for having
1:00:50
us own process. I appreciate that.
1:00:51
Yeah, yeah. Thank you so much for being part
1:00:53
of this. And Ross, again, thanks for
1:00:55
coming up. What encourage people to go out?
1:00:57
Visit cisocherrycraftf.com. I'll have links in our show
1:01:02
notes for people to click that out.
1:01:04
Again, shout out to Shirley and Cyber Risk Alliance and RSM for,
1:01:08
you know, helping us out here. And yeah, we'll go ahead.
1:01:11
We'll be there for this week. Find us on the web,
1:01:13
idacpodcast.com. Like, subscribe, do all that
1:01:16
cool stuff, and we'll talk with everyone the next time.
1:01:21
You've been listening to Identity at the Center.
1:01:25
We hope you've enjoyed the show. Make sure to like, rate and
1:01:29
review, and we'll be back soon. But in the meantime, hit the
1:01:33
website at identity@thecenter.com.
1:01:37
See you next time on Identity at the Center.