Latest / The Identity Blueprint / The Seven Phase Identity Security Blueprint

Transcript

The Seven Phase Identity Security Blueprint · The Identity Blueprint

• 0:00
  SPEAKER_00: Welcome to the Identity Blueprint, the podcast where enterprise identity and access management gets the depth it deserves.
• 0:08
  SPEAKER_00: I'm Ernie Prescott, Principal IAM Architect.
• 0:11
  SPEAKER_00: In every episode, Jose and I go deep on the frameworks, architecture decisions, and governance models that determine whether your organization's identity program actually holds up or becomes a headline.
• 0:25
  SPEAKER_00: Today we're diving into episode one, the seven-phase identity security blueprint, the complete framework for building an enterprise IAM program that actually works from the ground up.
• 0:37
  SPEAKER_00: Whether you're an IAM architect, a security leader, or an enterprise practitioner who's past the basics, you're in the right place.
• 0:45
  SPEAKER_00: Let's get into it.
• 0:47
  SPEAKER_00: In May of 2021, the largest fuel pipeline in the United States just well, it suddenly went offline.
• 0:53
  SPEAKER_00: Completely dark.
• 0:54
  SPEAKER_00: Right.
• 0:54
  SPEAKER_00: And we're talking about a system that delivers almost half of the fuel consumed on the entire East Coast.
• 0:59
  SPEAKER_00: So naturally, panic buying started instantly.
• 1:02
  SPEAKER_01: Oh, yeah.
• 1:02
  SPEAKER_01: People were filling up plastic bags with gasoline.
• 1:05
  SPEAKER_00: Exactly.
• 1:05
  SPEAKER_00: Gas stations ran completely dry, and the president actually had to declare a state of emergency.
• 1:11
  SPEAKER_00: Now, when something of that magnitude happens, your mind immediately goes to like a state-sponsored cyber warfare unit, right?
• 1:19
  SPEAKER_01: Well, for sure.
• 1:20
  SPEAKER_00: You picture some incredibly sophisticated, multi-stage, zero-day exploit engineered by a team of phantom hackers in a basement somewhere.
• 1:29
  SPEAKER_01: Yeah, I mean it's it's what we've been conditioned to expect by the movies, absolutely.
• 1:33
  SPEAKER_01: But the reality of catastrophic breaches is almost always uh much more mundane and frankly much more terrifying.
• 1:40
  SPEAKER_00: Terrifying is the right word.
• 1:41
  SPEAKER_00: Because it wasn't a zero-day exploit.
• 1:43
  SPEAKER_00: The colonial pipeline hack happened because of a single forgotten password.
• 1:47
  SPEAKER_00: Just one password, it was tied to an old virtual private network account, like a VPN profile that was no longer actively used, but somehow no one ever deactivated it.
• 1:58
  SPEAKER_00: Right.
• 1:58
  SPEAKER_00: And worse, it didn't have multi-factor authentication turned on.
• 2:02
  SPEAKER_00: So one orphaned password and the physical infrastructure of the United States basically ground to a halt.
• 2:09
  SPEAKER_01: And that right there is, well, it's the perfect encapsulation of why we are doing this deep dive today.
• 2:14
  SPEAKER_01: That wasn't just a technical glitch.
• 2:16
  SPEAKER_01: That was a systemic identity failure.
• 2:18
  SPEAKER_01: It represents a complete breakdown in an organization's understanding of who has access to the network, you know, why they have it, and critically when that access should be aggressively revoked.
• 2:29
  SPEAKER_00: Which really is the core mission of our deep dive today.
• 2:32
  SPEAKER_00: We are looking at a massive stack of sources for you.
• 2:34
  SPEAKER_00: We've got Federal Zero Trust Strategy Memos, we have National Institute of Standards and Technology or NIST guidelines, and some pretty intense industry teardowns on why security projects succeed or, well, spectacularly fail.
• 2:48
  SPEAKER_01: Aaron Powell And there's a lot of failure to look at.
• 2:50
  SPEAKER_00: Right.
• 2:50
  SPEAKER_00: But at the center of all this research is this master framework.
• 2:55
  SPEAKER_00: It's called the IAM Program Engagement Blueprint, IAM, standing for identity and access management.
• 3:03
  SPEAKER_01: And I really want to stress this to everyone listening.
• 3:05
  SPEAKER_01: It is, without a doubt, the most critical piece of architecture any modern organization will ever build.
• 3:11
  SPEAKER_01: And I do not say that lightly.
• 3:13
  SPEAKER_00: It's a bold claim.
• 3:14
  SPEAKER_01: It is, but it's true.
• 3:16
  SPEAKER_01: This blueprint is an intensive, overarching, seven-phase framework.
• 3:21
  SPEAKER_01: And it's designed to take an enterprise from absolute chaos, you know, the kind of chaos where an old VPN password can shut down a pipeline to a governed, secure, mathematically verifiable identity program.
• 3:34
  SPEAKER_00: Aaron Powell Okay, let's unpack this because I think there's a huge misconception right off the bat that we really need to clear up for you.
• 3:39
  SPEAKER_01: Oh, definitely.
• 3:39
  SPEAKER_00: When people hear identity and access management, they usually just think of IT buying a new software product.
• 3:44
  SPEAKER_00: You hear executives say, uh, oh, we're doing Active Directory cleanup, or hey, we just brought Okta, so we're rolling out a new single sign-on portal.
• 3:52
  SPEAKER_00: We're good.
• 3:52
  SPEAKER_01: Yeah, check the box, we're secure.
• 3:54
  SPEAKER_00: Right.
• 3:54
  SPEAKER_00: But looking at these sources, they are practically screaming that a product is not a program.
• 4:00
  SPEAKER_01: Aaron Powell Not even close.
• 4:01
  SPEAKER_01: I mean, those are discrete, isolated technical projects.
• 4:04
  SPEAKER_01: If you buy the most expensive identity software in the world, but you don't actually know who your users are, well, you've just bought a highly efficient engine for distributing chaos.
• 4:14
  SPEAKER_00: Distributing chaos.
• 4:15
  SPEAKER_00: I love that phrasing.
• 4:16
  SPEAKER_01: Aaron Powell It's true.
• 4:18
  SPEAKER_01: An IAM program is the connective tissue of your entire business.
• 4:22
  SPEAKER_01: It is the overarching, continuously operating system that dictates who has access to what, under what specific conditions, and exactly why they have it.
• 4:31
  SPEAKER_00: Aaron Powell So it's not just a portal you log into.
• 4:33
  SPEAKER_01: No, it ensures every single digital interaction has a North Star, right, a formal policy, a defined workflow, and an accountable human owner.
• 4:41
  SPEAKER_00: Aaron Powell And the overarching narrative in all of these documents, like the absolute golden rule we have to establish for you today, is the critical necessity of the sequence.
• 4:49
  SPEAKER_01: Yes.
• 4:50
  SPEAKER_01: The sequence is everything.
• 4:51
  SPEAKER_00: Aaron Powell The Blueprint has seven phases, and it takes roughly, what, 16 to 28 weeks just for the initial design?
• 4:58
  SPEAKER_01: Yeah, that's a canonical path for a mature enterprise.
• 5:01
  SPEAKER_01: And the dependency model here is utterly non-negotiable.
• 5:06
  SPEAKER_01: Slipping phases or, you know, trying to execute them out of order is not just a mistake.
• 5:12
  SPEAKER_01: It is a guaranteed recipe for catastrophic career-ending failure.
• 5:16
  SPEAKER_00: Wow.
• 5:17
  SPEAKER_00: Career ending.
• 5:19
  SPEAKER_01: You cannot just decide you want advanced real-time behavioral analytics if you haven't even figured out how to automatically disable an employee's account when they get fired.
• 5:29
  SPEAKER_00: Right.
• 5:29
  SPEAKER_00: It's like building a skyscraper.
• 5:31
  SPEAKER_00: Can't put the roof on or install the high-speed elevators before you actually pour the foundation.
• 5:35
  SPEAKER_01: Exactly.
• 5:36
  SPEAKER_00: But what's fascinating is how deep that foundation actually has to go.
• 5:40
  SPEAKER_00: Because the blueprint starts with phase zero.
• 5:43
  SPEAKER_00: They literally call it phase zero: pre-engagement and scoping.
• 5:46
  SPEAKER_01: The foundation of the foundation.
• 5:47
  SPEAKER_00: Right.
• 5:47
  SPEAKER_00: It's a one to two week period dedicated entirely to setting boundaries, confirming executive sponsorship, and writing a charter.
• 5:54
  SPEAKER_00: But I have to be honest, reading this part, I found myself getting a bit cynical.
• 5:58
  SPEAKER_01: Oh, really?
• 5:58
  SPEAKER_01: How so?
• 5:59
  SPEAKER_00: Well, why is this an entire dedicated phase?
• 6:02
  SPEAKER_00: I mean, if I'm an IT director and I look around and see that we have a hundred orphan contractor accounts just sitting there, I don't want to spend two weeks writing a formal charter and hunting down a C-suite executive to sign it.
• 6:14
  SPEAKER_01: You just want to fix it.
• 6:15
  SPEAKER_00: Yeah.
• 6:16
  SPEAKER_00: Can't the security team just realize they have a massive vulnerability and start, you know, mapping things out and locking things down?
• 6:23
  SPEAKER_00: Why mandate this heavy corporate bureaucracy right at the starting line?
• 6:27
  SPEAKER_01: It's a fair question, but what's fascinating here is that the blueprint isn't actually trying to solve a technology problem in phase zero.
• 6:34
  SPEAKER_00: What is it solving then?
• 6:36
  SPEAKER_01: It's anticipating a psychological war.
• 6:38
  SPEAKER_00: A psychological war?
• 6:39
  SPEAKER_01: Yes.
• 6:40
  SPEAKER_01: Because an IAM transformation generates more internal organizational friction than almost any other IT project you will ever do.
• 6:47
  SPEAKER_00: Aaron Powell Because you're messing with people's access.
• 6:49
  SPEAKER_01: Exactly.
• 6:50
  SPEAKER_01: Identity is power, access is power.
• 6:52
  SPEAKER_01: Phase zero exists to define the unshakable why behind the project because, well, you are gonna need that leverage later.
• 7:00
  SPEAKER_01: Right.
• 7:01
  SPEAKER_01: Why are we doing this?
• 7:02
  SPEAKER_01: Is it a regulatory mandate from the federal government?
• 7:05
  SPEAKER_01: Are we responding to a massive data breach?
• 7:07
  SPEAKER_01: Or is it a tech consolidation effort?
• 7:10
  SPEAKER_00: Aaron Powell Because if the IT director just decides to lock things down on a whim.
• 7:14
  SPEAKER_01: The project is dead on arrival.
• 7:16
  SPEAKER_01: I guarantee it.
• 7:17
  SPEAKER_01: Let's play this out, right?
• 7:19
  SPEAKER_01: Say the IT director decides to implement a new rule.
• 7:22
  SPEAKER_01: They say all standing administrative access to the financial system must be revoked, and users have to request temporary access only when they need it.
• 7:32
  SPEAKER_00: Sounds like a solid security practice.
• 7:34
  SPEAKER_01: It is.
• 7:34
  SPEAKER_01: But the moment a senior vice president of finance is told they can't log into their favorite system the exact same way they have for the last 10 years, they aren't going to submit a help desk ticket.
• 7:44
  SPEAKER_00: No, they're going to lose their minds.
• 7:45
  SPEAKER_01: They are going to storm into the chief information officer's office and demand the project be stopped because it's quote blocking business.
• 8:00
  SPEAKER_01: The CIO caves, it happens every day.
• 8:02
  SPEAKER_01: The VP gets an exception.
• 8:04
  SPEAKER_00: And once one person gets an exception.
• 8:06
  SPEAKER_01: It's game over.
• 8:07
  SPEAKER_01: The director of marketing here is the VP, got an exception, so they demand one.
• 8:11
  SPEAKER_01: Before you know it, your multimillion dollar identity security project is completely hollowed out by executive exceptions.
• 8:20
  SPEAKER_00: Just Swiss cheese.
• 8:21
  SPEAKER_01: Exactly.
• 8:21
  SPEAKER_01: That is why the decision gate for phase zero is so rigid.
• 8:25
  SPEAKER_01: The sources explicitly state you do not proceed to phase one without confirmed, documented executive sponsorship.
• 8:32
  SPEAKER_01: You need a named stakeholder from IT, security, human resources, and compliance.
• 8:39
  SPEAKER_00: So all the heavy hitters.
• 8:40
  SPEAKER_01: Yes.
• 8:41
  SPEAKER_01: Because if you don't have C-suite backing, if the chief information security officer doesn't have a dedicated budget and is fighting for scraps against, I don't know, the team trying to buy new laptops, you stop.
• 8:52
  SPEAKER_01: You do not pass go.
• 8:53
  SPEAKER_00: So phase zero is basically just acquiring a bigger stick than the angriest executive in the company.
• 8:58
  SPEAKER_01: It is the only way you survive what comes next.
• 9:00
  SPEAKER_00: Okay, so let's say you win that boardroom battle.
• 9:02
  SPEAKER_00: You get the signatures, the CEO sends out a company-wide email blessing the project, and you cross the threshold into phase one.
• 9:09
  SPEAKER_01: Here we go.
• 9:09
  SPEAKER_00: Phase one discovery and current state assessment.
• 9:12
  SPEAKER_00: The sources say this takes anywhere from three to six weeks.
• 9:16
  SPEAKER_00: And the phrase the source material uses here is just incredible.
• 9:21
  SPEAKER_00: They call it a ruthless identity security autopsy.
• 9:24
  SPEAKER_01: It's the perfect terminology, really.
• 9:26
  SPEAKER_00: A ruthless autopsy.
• 9:28
  SPEAKER_01: Yeah, because the goal of phase one is to strip away all assumptions.
• 9:32
  SPEAKER_01: No more, well, I think HR handles that, or I'm pretty sure the network team deprovisions those accounts.
• 9:37
  SPEAKER_00: No more guessing.
• 9:38
  SPEAKER_01: Exactly.
• 9:39
  SPEAKER_01: The objective is to build a 40 to 60 page factual evidence-based picture of the organization's current posture.
• 9:48
  SPEAKER_01: You are opening every single digital closet and pulling out every skeleton.
• 9:52
  SPEAKER_00: And to do that, the blueprint mandates assessing eight specific interconnected domains.
• 9:57
  SPEAKER_00: And as I read through these, the breadth of what you have to uncover is just staggering.
• 10:01
  SPEAKER_01: It's exhaustive.
• 10:02
  SPEAKER_00: Let's dive deep into these because this is where the bodies are buried.
• 10:05
  SPEAKER_00: Domain one is the identity inventory.
• 10:07
  SPEAKER_01: Right.
• 10:08
  SPEAKER_01: Which seems simple on the surface, right?
• 10:09
  SPEAKER_01: Just who is on your network.
• 10:11
  SPEAKER_01: But you have to prove it mathematically.
• 10:13
  SPEAKER_00: What do you mean by mathematically?
• 10:14
  SPEAKER_01: Well, how many unique human beings actually work at your company, and how does that number compare to the total number of active user accounts across all your directories and applications?
• 10:26
  SPEAKER_00: Uh, I see.
• 10:27
  SPEAKER_00: And the red flags here are wild.
• 10:30
  SPEAKER_00: One of the case studies mentioned a company with 3,000 actual employees but 12,000 active accounts in their active directory.
• 10:37
  SPEAKER_01: Aaron Powell, which means you have 9,000 shadow identities.
• 10:39
  SPEAKER_00: Aaron Powell,000.
• 10:40
  SPEAKER_00: Where do they even come from?
• 10:42
  SPEAKER_01: Everywhere.
• 10:42
  SPEAKER_01: These are test accounts that were spun up and never deleted.
• 10:45
  SPEAKER_01: They are service accounts used by old applications that were decommissioned five years ago.
• 10:49
  SPEAKER_01: And most dangerously, they are orphaned contractor accounts.
• 10:54
  SPEAKER_00: Oh, contractors, they come and go so fast.
• 10:56
  SPEAKER_01: Right.
• 10:56
  SPEAKER_01: If IT is manually typing names into a directory to create accounts, instead of having an automated synchronization engine pulling data from an authoritative human resources system like Workday or SAP, you will inevitably have massive account bloat.
• 11:10
  SPEAKER_00: So domain one is basically just counting the ghosts in the machine.
• 11:13
  SPEAKER_00: Then you move to domain two, the authentication landscape.
• 11:17
  SPEAKER_00: Mechanically, how are these people and systems proving they are who they say they are?
• 11:22
  SPEAKER_01: And here you really have to look at the protocol level.
• 11:24
  SPEAKER_01: I mean, we all know we should be using multi-factor authentication or MFA, but domain two requires you to hunt down legacy authentication.
• 11:32
  SPEAKER_01: Are there systems on your network still using basic authentication protocols like NTLM?
• 11:38
  SPEAKER_00: Wait, let's break that down for a second because you hear terms like NTLM thrown around in security audits all the time.
• 11:43
  SPEAKER_00: Sure.
• 11:43
  SPEAKER_00: Mechanically, why is finding legacy authentication in domain two such a huge red flag?
• 11:50
  SPEAKER_01: Because legacy protocols like NTLM, which stands for New Technology Land Manager, which is ironically very old technology from the nineties, they don't understand what MFA is.
• 11:59
  SPEAKER_00: They just don't have the capability.
• 12:01
  SPEAKER_01: Right.
• 12:01
  SPEAKER_01: They physically cannot prompt a user for a push notification on their phone.
• 12:05
  SPEAKER_01: Furthermore, the way NTLM works under the hood is fundamentally flawed for modern security.
• 12:11
  SPEAKER_01: When you log in, it doesn't send your password over the network, but it sends a cryptographic representation of it, a hash.
• 12:16
  SPEAKER_00: Aaron Powell Okay, so if a hacker is listening on the network, they grab the hash.
• 12:20
  SPEAKER_00: But isn't the hash encrypted?
• 12:22
  SPEAKER_01: Well, yes, but because of the way NTLM is built, a hacker doesn't even need to crack that hash to find out what your actual password is.
• 12:29
  SPEAKER_00: Wait, really?
• 12:30
  SPEAKER_01: Really.
• 12:31
  SPEAKER_01: They can just perform what's called a pass the hash attack.
• 12:34
  SPEAKER_01: They literally hand the captured hash back to the server and say, hey, here's my cryptographic proof, let me in, and the server just accepts it.
• 12:40
  SPEAKER_00: That is wild.
• 12:41
  SPEAKER_01: It is.
• 12:42
  SPEAKER_01: So in phase one, you are hunting down every single server or application that still accepts these easily exploitable protocols.
• 12:50
  SPEAKER_01: Modern authentication, like OIDC or SAML, uses short-lived, mathematically signed tokens that can't just be intercepted and replayed infinitely like that.
• 13:00
  SPEAKER_00: Aaron Powell That makes perfect sense.
• 13:01
  SPEAKER_00: So you figure out who exists in domain one and how they log in during domain two.
• 13:04
  SPEAKER_00: That brings us to domain three.
• 13:06
  SPEAKER_00: Authorization and the access model.
• 13:08
  SPEAKER_01: Right.
• 13:09
  SPEAKER_00: So once you've proven who you are and you're inside the network, what are you actually allowed to do?
• 13:13
  SPEAKER_01: Aaron Powell And this is where we usually find a sprawling, unmanageable mess.
• 13:18
  SPEAKER_01: Are access roles formally defined based on job functions, or is everyone just granted permissions on an ad hoc basis?
• 13:25
  SPEAKER_00: Aaron Powell And the sources use a terrifying phrase here.
• 13:28
  SPEAKER_00: The dark matter of nested group sprawl.
• 13:30
  SPEAKER_01: Oh, nested groups, the bane of IAM.
• 13:34
  SPEAKER_00: Aaron Powell I was trying to visualize this when reading the materials.
• 13:37
  SPEAKER_00: Kind of like a set of Russian nesting dolls, right?
• 13:39
  SPEAKER_01: Aaron Ross Powell That is exactly what it is.
• 13:41
  SPEAKER_01: Let's say you have a folder containing highly sensitive financial data, and only the senior finance group has access to it.
• 13:47
  SPEAKER_00: Aaron Powell Makes sense.
• 13:48
  SPEAKER_01: Right.
• 13:48
  SPEAKER_01: But let's say five years ago, an IT admin was trying to fix some weird software bug, and to make it work, they took the all-marketing employees group and just dropped it inside the senior finance group.
• 13:59
  SPEAKER_00: Aaron Powell Putting the marketing doll inside the finance doll.
• 14:02
  SPEAKER_01: Yes.
• 14:02
  SPEAKER_01: And because it's nested, nobody looking at the marketing group directly sees that they have finance access.
• 14:08
  SPEAKER_01: It's hidden in the layers.
• 14:09
  SPEAKER_01: So you hire a 22-year-old marketing intern, you add them to the marketing group, and boom, through the transitive property of nested groups, that intern implicitly has access to the most sensitive financial data in the entire company.
• 14:22
  SPEAKER_00: And nobody knows.
• 14:23
  SPEAKER_01: Nobody knows.
• 14:24
  SPEAKER_01: Domain three is about unwinding those nesting dolls and mapping the true blast radius of every single user.
• 14:31
  SPEAKER_00: Aaron Powell Which flows perfectly into domain four.
• 14:34
  SPEAKER_00: Because if you don't know what access people have, you definitely can't manage how that access changes over time.
• 14:39
  SPEAKER_01: Right.
• 14:40
  SPEAKER_00: So domain four is the identity lifecycle, the joiner, mover, lever processes or JML.
• 14:47
  SPEAKER_01: This is really the operational beating heart of IAM.
• 14:50
  SPEAKER_00: And here's where it gets really interesting because looking at the failure rates in the data, this is where most organizations completely fall apart.
• 14:57
  SPEAKER_01: Oh, entirely.
• 14:58
  SPEAKER_00: Let's start with the lever process.
• 14:59
  SPEAKER_00: When someone exits the company, the blueprint identifies this as the absolute highest risk area in the entire life cycle, bar none.
• 15:07
  SPEAKER_01: We call it the deprovisioning gap.
• 15:08
  SPEAKER_01: In phase one, you have to measure the latency, the exact time delay down to the minute between the moment human resources officially timestamps an employee's termination in their database and the absolute revocation of that user's network access across every single system, cloud app, and VPN.
• 15:27
  SPEAKER_00: And the context of how they leave changes the risk profile drastically, doesn't it?
• 15:32
  SPEAKER_01: Completely.
• 15:33
  SPEAKER_01: Let's say Bob is retiring gracefully after 30 years.
• 15:36
  SPEAKER_01: HR enters his termination date, and it takes IT, say, 24 hours to finally disable his email and network access.
• 15:45
  SPEAKER_01: I mean that's a compliance ding.
• 15:46
  SPEAKER_01: An auditor won't like it.
• 15:48
  SPEAKER_01: But the actual security risk is relatively low.
• 15:50
  SPEAKER_01: Bob is probably on a golf course.
• 15:52
  SPEAKER_00: Right.
• 15:52
  SPEAKER_00: But what if Bob isn't retiring?
• 15:54
  SPEAKER_00: What if Bob is a senior systems engineer who is just fired for corporate espionage or extreme misconduct?
• 16:00
  SPEAKER_01: Then that 24-hour deprovisioning gap is a catastrophic vulnerability.
• 16:03
  SPEAKER_00: Because he's angry.
• 16:04
  SPEAKER_01: Exactly.
• 16:05
  SPEAKER_01: If it's a hostile, involuntary termination, and Bob walks out of the HR office, pulls out a smartphone, and realizes he still has access to the corporate cloud infrastructure, he could do anything.
• 16:15
  SPEAKER_01: He can exfiltrate customer databases, he can delete backups, he can plant logic bombs that will wipe servers three months from now, that latency is the exact window for an insider threat disaster.
• 16:28
  SPEAKER_01: Domain four measures exactly how wide that window is currently sitting open.
• 16:32
  SPEAKER_00: Yeah.
• 16:32
  SPEAKER_00: So joiner and lever are pretty obvious, right?
• 16:34
  SPEAKER_00: You get hired, you get access, you get fired, you lose it.
• 16:38
  SPEAKER_00: But I really struggled with the mover problem in reading this.
• 16:41
  SPEAKER_01: It's sneaky.
• 16:42
  SPEAKER_00: Yeah.
• 16:42
  SPEAKER_00: Why is an employee changing department such a massive blind spot?
• 16:46
  SPEAKER_01: Think about the mechanics of how IT usually operates without a mature IAM program.
• 16:51
  SPEAKER_01: Let's say Alice works in customer support.
• 16:54
  SPEAKER_01: She has access to the ticketing system and the customer database.
• 16:57
  SPEAKER_01: She does a great job and gets promoted to a financial analyst role.
• 17:01
  SPEAKER_00: Good for Alice.
• 17:02
  SPEAKER_01: Yes, but terrible for security.
• 17:04
  SPEAKER_01: Because when Alice moves to finance, her new manager immediately submits an urgent IT ticket saying Alice needs access to the accounting software and the payroll folders today.
• 17:13
  SPEAKER_00: And IT wants to be helpful.
• 17:14
  SPEAKER_01: Right.
• 17:14
  SPEAKER_01: IT quickly grants her all the new finance access.
• 17:17
  SPEAKER_00: Aaron Powell But nobody submits a ticket to take away her old customer support access.
• 17:22
  SPEAKER_01: Exactly.
• 17:22
  SPEAKER_01: Why would they?
• 17:23
  SPEAKER_01: Her new manager doesn't know what her old access was, and her old manager doesn't care anymore because she's not on their team.
• 17:29
  SPEAKER_00: Out of sight, out of mind.
• 17:30
  SPEAKER_01: This creates what we call privilege creep or access accumulation.
• 17:35
  SPEAKER_01: Alice moves departments two or three more times over a five-year career, and suddenly Alice, a mid-level manager, has accumulated the digital keys to support, finance, HR, and operations.
• 17:48
  SPEAKER_00: Just collecting keys?
• 17:49
  SPEAKER_01: Yeah.
• 17:49
  SPEAKER_01: And if a threat actor fishes Alice's password, they don't just compromise one department, they compromise half the company.
• 17:55
  SPEAKER_00: That is terrifying because from a behavioral standpoint, there is absolutely no trigger to remove access.
• 18:01
  SPEAKER_00: It just inherently stacks up over time.
• 18:03
  SPEAKER_01: Aaron Powell, which is why domain four has to map out exactly how or if the organization handles that automated stripping of old access during a role change.
• 18:12
  SPEAKER_01: Aaron Powell Okay.
• 18:12
  SPEAKER_00: Continuing through the autopsy.
• 18:14
  SPEAKER_00: Domain five is governance and compliance posture.
• 18:17
  SPEAKER_00: Basically, are there actual formal IAM policies written down somewhere, or is it just tribal knowledge in the heads of three senior IT guys?
• 18:24
  SPEAKER_01: Yeah.
• 18:24
  SPEAKER_01: Usually it's the latter.
• 18:25
  SPEAKER_00: Aaron Powell Right.
• 18:25
  SPEAKER_00: Then domain six is the technology sac.
• 18:28
  SPEAKER_01: Yeah.
• 18:28
  SPEAKER_00: Mechanically mapping out Active Directory, Azure AD, Okta, whatever disparate systems are strung together.
• 18:34
  SPEAKER_01: Aaron Powell And domain seven is organizational readiness.
• 18:37
  SPEAKER_01: This is crucial because technology does not implement itself.
• 18:40
  SPEAKER_00: You need the people.
• 18:41
  SPEAKER_01: You do.
• 18:42
  SPEAKER_01: Do you actually have engineering staff who understand modern identity protocols like OAuth and SAML?
• 18:48
  SPEAKER_01: Or is all your internal expertise concentrated entirely in legacy on-premise active directory administration?
• 18:55
  SPEAKER_01: If your team doesn't understand cloud identity, the blueprint will fail in the execution phase.
• 19:00
  SPEAKER_00: Aaron Powell And finally, domain eight, the threat and risk landscape.
• 19:04
  SPEAKER_00: What previous identity incidents have happened?
• 19:06
  SPEAKER_00: Have you had credential compromise events in the past year?
• 19:09
  SPEAKER_00: What is your actual exposure surface to the Internet?
• 19:12
  SPEAKER_01: Aaron Powell And as you are compiling this massive amount of data across all eight of these domains, the blueprint requires you to hold it up against federal standards.
• 19:20
  SPEAKER_01: Specifically, it heavily references the NIST SP 8633 framework.
• 19:26
  SPEAKER_01: Trevor Burrus, Jr.
• 19:26
  SPEAKER_00: Right, the digital identity guidelines, the gold standard.
• 19:29
  SPEAKER_00: But this is where the terminology gets really dense in the sources.
• 19:32
  SPEAKER_00: It does.
• 19:32
  SPEAKER_00: The blueprint says that during discovery, you must evaluate identity assurance levels, or IAL, and it mentions IAL 3 specifically.
• 19:41
  SPEAKER_00: What does it actually mean to mathematically evaluate an identity?
• 19:46
  SPEAKER_01: It's a great question because it cuts to the core of what modern security actually is.
• 19:51
  SPEAKER_01: Let's say you are an organization handling incredibly sensitive data, maybe federal tax records or classified defense designs.
• 19:59
  SPEAKER_00: High stakes stuff.
• 20:00
  SPEAKER_01: Very high stakes.
• 20:01
  SPEAKER_01: NIST says you can't just take an employee's word for who they are when you issue them an account.
• 20:05
  SPEAKER_01: You need IL3, which is the highest level of rigorous identity proofing.
• 20:09
  SPEAKER_00: So it's not just HR saying, yeah, this is John.
• 20:11
  SPEAKER_01: No, absolutely not.
• 20:12
  SPEAKER_01: Mathematically evaluating an identity means looking at the specific cryptographic and physical evidence collected during onboarding.
• 20:19
  SPEAKER_01: To hit IL3, you must have in-person or highly supervised remote identity proofing.
• 20:25
  SPEAKER_00: Like looking them in the eye.
• 20:26
  SPEAKER_01: Exactly, or collecting superior biometric data, like high-resolution fingerprints or facial geometry.
• 20:33
  SPEAKER_01: You have to cryptographically verify their government-issued ID against an authoritative issuing database.
• 20:40
  SPEAKER_01: You are literally calculating the entropy and the statistical probability that this human being is an imposter.
• 20:46
  SPEAKER_01: Wow.
• 20:46
  SPEAKER_01: Yeah.
• 20:47
  SPEAKER_01: If your current onboarding process is just having someone email a photocopy of their driver's license to an HR rep, well, your identity assurance level is functionally zero.
• 20:57
  SPEAKER_00: So you spend six weeks doing this ruthless autopsy across all these domains.
• 21:01
  SPEAKER_00: You've uncovered the Russian nesting dolls of privilege creep, the 9,000 shadow identities, the legacy and TLM protocols transmitting vulnerable hashes, and the fact that your identity proofing is completely inadequate.
• 21:12
  SPEAKER_01: It's a lot of bad news.
• 21:13
  SPEAKER_00: It is.
• 21:14
  SPEAKER_00: You document all of this.
• 21:15
  SPEAKER_00: And the ultimate deliverable for phase one is something called the IAM risk register.
• 21:20
  SPEAKER_01: And this document is an absolute masterstroke of the blueprint.
• 21:23
  SPEAKER_00: Why is that?
• 21:24
  SPEAKER_01: Because an executive doesn't care about NTLM hashes or OIDC tokens.
• 21:29
  SPEAKER_01: Their eyes will glaze over.
• 21:31
  SPEAKER_01: The risk register translates deeply technical jargon into pure, unadulterated business risk.
• 21:37
  SPEAKER_00: So it's a translation engine.
• 21:39
  SPEAKER_01: Exactly.
• 21:39
  SPEAKER_01: It strips away of finding like we have improper LDAP simple binds on legacy servers and translates it for the board of directors as we currently have a critical vulnerability that allows attackers to easily steal passwords in plain text.
• 21:54
  SPEAKER_01: Based on our industry, this exposes us to a high probability of a ransomware event that could cost the company an estimated.
• 22:00
  SPEAKER_01: $4 million in downtime and regulatory fines.
• 22:03
  SPEAKER_00: Oh, that gets their attention.
• 22:04
  SPEAKER_01: Immediately.
• 22:05
  SPEAKER_01: Which brings us to the phase one decision gate.
• 22:07
  SPEAKER_01: And the sources are completely unyielding here.
• 22:09
  SPEAKER_00: Unyielding how?
• 22:11
  SPEAKER_01: You cannot move to phase two.
• 22:12
  SPEAKER_01: You cannot start designing a solution until the executive sponsors review, acknowledge, and formally accept these factual findings in the risk register.
• 22:19
  SPEAKER_01: Trevor Burrus, Jr.
• 22:20
  SPEAKER_00: Meaning they have to sign their name to the bad news.
• 22:21
  SPEAKER_01: Aaron Powell Yes.
• 22:22
  SPEAKER_01: And this is where the emotional intelligence of an IAM architect is truly tested.
• 22:27
  SPEAKER_01: Because when executives see a document explicitly stating their company is a digital sieve, their instinct is often denial.
• 22:35
  SPEAKER_01: Trevor Burrus, Jr.
• 22:35
  SPEAKER_00: Right.
• 22:35
  SPEAKER_00: Ego gets in the way.
• 22:36
  SPEAKER_00: Trevor Burrus, Jr.
• 22:36
  SPEAKER_01: Exactly.
• 22:37
  SPEAKER_01: The IT director might defensively claim, well, the manual offboarding process for contractors is fine.
• 22:42
  SPEAKER_01: My guys handle it.
• 22:43
  SPEAKER_01: Even though your data just proved 50 terminated contractors still have VPN access.
• 22:48
  SPEAKER_00: Aaron Powell So what do you do in that situation?
• 22:50
  SPEAKER_00: Do you just say, okay, we'll agree to disagree and move to the next phase just to keep the project moving?
• 22:55
  SPEAKER_01: Aaron Powell Absolutely not.
• 22:56
  SPEAKER_01: If stakeholders dispute the facts now, you have to halt the engagement and resolve that disagreement immediately.
• 23:03
  SPEAKER_00: Aaron Powell You stop the whole project.
• 23:04
  SPEAKER_01: Yes.
• 23:05
  SPEAKER_01: You go back to the logs, you pull the data, and you force them to look at the undeniable truth.
• 23:09
  SPEAKER_01: Because if you paper over a disagreement about how broken a process is in phase one, those disagreements compound exponentially.
• 23:16
  SPEAKER_01: Absolutely.
• 23:17
  SPEAKER_01: Well, when you get to phase four and try to automate that contractor offboarding process, the automation will fail because the underlying process you agreed upon is a lie.
• 23:26
  SPEAKER_01: The executives must swallow their pride and accept the grim reality.
• 23:30
  SPEAKER_00: Okay, so let's say they do.
• 23:31
  SPEAKER_00: The executives have looked at the risk register, they've grimaced, they've accepted the autopsy results, they know they have a massive problem.
• 23:38
  SPEAKER_00: Now what?
• 23:39
  SPEAKER_01: Now you transition to phase two.
• 23:40
  SPEAKER_00: Phase two strategy and target state design.
• 23:44
  SPEAKER_00: The organization finally gets to decide where it's going, but more importantly, they have to figure out how to pay for it.
• 23:49
  SPEAKER_01: Yes.
• 23:50
  SPEAKER_01: Phase two typically takes three to four weeks, and its entire purpose is building the CFO-proof business case.
• 23:57
  SPEAKER_00: The chief financial officer, the person holding the purse strings.
• 24:00
  SPEAKER_01: Exactly.
• 24:00
  SPEAKER_01: You have this massive list of terrifying risks from phase one.
• 24:04
  SPEAKER_01: But fear alone doesn't secure a multi-year, multimillion dollar budget.
• 24:09
  SPEAKER_01: Over phase two, you have to translate that business context into an identity strategy that the executive team can mathematically justify funding.
• 24:17
  SPEAKER_00: And the blueprint breaks this business case down into four specific value levers, four pillars of financial logic to convince the CFO to open the checkbook.
• 24:28
  SPEAKER_00: Let's unpack these, because this is how you actually sell security.
• 24:30
  SPEAKER_01: Right.
• 24:30
  SPEAKER_00: Lever one is risk reduction.
• 24:32
  SPEAKER_01: This is the most direct lever.
• 24:34
  SPEAKER_01: It's about quantifying the exact cost of credential compromise and insider threats.
• 24:40
  SPEAKER_01: We know from industry data like the IBM cost of a data breach report that stolen or compromised credentials are the primary attack vector in nearly a third of all massive data breaches.
• 24:50
  SPEAKER_00: Aaron Powell The third?
• 24:51
  SPEAKER_00: That's huge.
• 24:52
  SPEAKER_01: And the average global cost of a data breach is hovering around$4.5 million.
• 24:56
  SPEAKER_01: If you are in healthcare or finance, it's double that.
• 24:59
  SPEAKER_00: Plus the cyber insurance premiums, right?
• 25:01
  SPEAKER_01: Oh, absolutely.
• 25:02
  SPEAKER_01: Cyberinsurance providers are now demanding mature IAM programs before they even issue a policy.
• 25:07
  SPEAKER_01: So you map your new proposed capabilities directly to reducing that specific financial exposure.
• 25:13
  SPEAKER_01: You say, by implementing this architecture, we reduce our likelihood of a successful ransomware attack by X percent, saving us an estimated Y million dollars in potential damages and insurance costs.
• 25:23
  SPEAKER_00: It's hard math.
• 25:24
  SPEAKER_00: Okay, lever two is operational efficiency.
• 25:29
  SPEAKER_00: This is fascinating because it's not about hackers at all.
• 25:33
  SPEAKER_00: It's about calculating the hidden costs of doing things poorly every single day.
• 25:38
  SPEAKER_01: It's the silent bleed of IT resources.
• 25:40
  SPEAKER_01: Let's look at password resets.
• 25:42
  SPEAKER_00: Oh, everyone hates those.
• 25:43
  SPEAKER_01: Right.
• 25:43
  SPEAKER_01: If you have 10,000 employees and a third of them forget their password every month and they have to call a help desk, and each help desk ticket costs the company roughly$25 in labor and lost time.
• 25:55
  SPEAKER_00: You are literally burning tens of thousands of dollars a month just helping people remember their passwords.
• 26:00
  SPEAKER_01: Exactly.
• 26:00
  SPEAKER_01: Or look at the labor cost of manual provisioning.
• 26:03
  SPEAKER_01: When a new employee starts, if an IT admin has to spend three hours manually clicking through different consoles to create their email, their Slack account, their CRM access, that is incredibly expensive manual labor.
• 26:15
  SPEAKER_00: And prone to errors.
• 26:16
  SPEAKER_01: Highly prone.
• 26:17
  SPEAKER_01: In phase two, you calculate that exact bleed and compare it against the massive financial savings of deploying automated lifecycle management.
• 26:24
  SPEAKER_00: Which leads right into lever three, compliance cost avoidance, because audits are incredibly expensive.
• 26:29
  SPEAKER_01: Think about what it takes to pass a Sarbanes Oxley or SOX audit for a publicly traded company.
• 26:36
  SPEAKER_00: It's a nightmare from what I hear.
• 26:37
  SPEAKER_01: Aaron Powell It is.
• 26:38
  SPEAKER_01: Without an automated IAM program, a team of security analysts has to spend three to four weeks every single quarter manually extracting lists of users from dozens of applications.
• 26:49
  SPEAKER_01: They drop them into massive Excel spreadsheets, and email managers asking, does Bob still need this access?
• 26:56
  SPEAKER_00: And the managers just reply, yes, without even looking at it.
• 26:58
  SPEAKER_01: Every single time.
• 26:59
  SPEAKER_01: It's security theater and it's incredibly labor intensive.
• 27:03
  SPEAKER_01: What is the manual labor cost of those analysts?
• 27:05
  SPEAKER_01: What is the cost of the inevitable fines when the auditors find out the spreadsheets are wrong?
• 27:10
  SPEAKER_01: A govern IAM program automates that entire compliance evidence collection process, saving thousands of man hours.
• 27:17
  SPEAKER_00: And the final lever, which I think technical teams completely overlook when they pitch these projects, lever four is business enablement.
• 27:23
  SPEAKER_00: It's about quantifying the actual revenue or productivity impact of going faster.
• 27:28
  SPEAKER_01: Time to value.
• 27:29
  SPEAKER_01: If you hire a senior software developer at a salary of$200,000 a year, and on day one, they are sitting at their desk waiting for IT to grant them access to the code repository, and they wait a week.
• 27:41
  SPEAKER_00: Which happens all the time.
• 27:43
  SPEAKER_01: All the time.
• 27:43
  SPEAKER_01: That is nearly$4,000 of burned salary where that developer produced zero code.
• 27:49
  SPEAKER_00: Not to mention the sheer frustration of the employee.
• 27:51
  SPEAKER_01: Right.
• 27:51
  SPEAKER_01: They feel like they joined a dinosaur company.
• 27:53
  SPEAKER_01: And what about partner collaboration?
• 27:55
  SPEAKER_01: If it takes you a month to manually provision access for a new vendor to your supply chain portal, you're slowing down the actual business.
• 28:04
  SPEAKER_01: Seamless, automated identity access is frictionless.
• 28:08
  SPEAKER_01: It means faster onboarding, faster partnerships, and that translates directly to top-line revenue.
• 28:14
  SPEAKER_00: But here is where we hit the most critical funding gate of the entire blueprint.
• 28:18
  SPEAKER_00: Because inevitably, some hotshot IT architect is going to push back.
• 28:22
  SPEAKER_01: Oh, they always do.
• 28:23
  SPEAKER_00: They are going to look at the consultants and say, look, we already did the discovery.
• 28:26
  SPEAKER_00: We know our AD is a mess.
• 28:28
  SPEAKER_00: We know we want to buy a specific identity governance platform.
• 28:31
  SPEAKER_00: Why are we spending a month writing a strategy document and doing accounting math?
• 28:35
  SPEAKER_00: Let's just buy the software.
• 28:37
  SPEAKER_01: And if we connect this to the bigger picture, phase two dictates the absolute financial reality of your entire program.
• 28:44
  SPEAKER_01: The strategy defines the budget, and the budget strictly defines your architectural ceiling.
• 28:48
  SPEAKER_00: Right.
• 28:49
  SPEAKER_01: If your business case fails CFO scrutiny, all the downstream phases have to be drastically rescoped.
• 28:56
  SPEAKER_00: Give me a concrete example of that friction.
• 28:58
  SPEAKER_01: Okay.
• 28:58
  SPEAKER_01: Let's say your IT architect wants to implement advanced zero trust architecture.
• 29:03
  SPEAKER_01: Specifically something called continuous access evaluation or CAE.
• 29:08
  SPEAKER_00: Mechanically, what is that?
• 29:09
  SPEAKER_00: For those who don't know.
• 29:10
  SPEAKER_01: Sure.
• 29:11
  SPEAKER_01: Traditionally, when you log in, the identity provider gives you a token, let's say an OIDC JSON web token that is valid for an hour.
• 29:19
  SPEAKER_01: For that entire hour, you have access, even if your laptop gets stolen while it's open.
• 29:24
  SPEAKER_01: But with continuous access evaluation, the identity provider is constantly consuming real-time telemetry from your device.
• 29:31
  SPEAKER_01: If it registers a sudden impossible geographic IP address change or the endpoint protection software detects malware, a shared signals framework sends an immediate alert to the identity provider.
• 29:44
  SPEAKER_00: And it snipes the token mid-stride.
• 29:46
  SPEAKER_01: Exactly.
• 29:46
  SPEAKER_01: It revokes the token instantly, terminating your session in milliseconds long before the hour is up.
• 29:53
  SPEAKER_01: Now that is a beautiful, highly secure architecture.
• 29:56
  SPEAKER_00: It sounds like magic.
• 29:57
  SPEAKER_01: It is magic.
• 29:58
  SPEAKER_01: But it requires top-tier licensing for your identity provider.
• 30:01
  SPEAKER_01: It requires advanced endpoint detection software.
• 30:08
  SPEAKER_00: And if you skip the business case.
• 30:55
  SPEAKER_01: And this is exactly where the blueprint throws up a massive non-negotiable stop sign.
• 31:00
  SPEAKER_00: Welcome to phase three and phase four.
• 31:02
  SPEAKER_00: The blueprint insists you must establish the laws before you build the engine.
• 31:07
  SPEAKER_01: Let's start with phase three, the policy and governance framework.
• 31:10
  SPEAKER_01: This takes three to four weeks.
• 31:12
  SPEAKER_01: And the core principle driving this phase is simple.
• 31:14
  SPEAKER_01: Technology without governance is just a highly efficient way to make an unmanageable mess.
• 31:19
  SPEAKER_00: The blueprint outlines a strict policy hierarchy.
• 31:22
  SPEAKER_00: It's like a structured pyramid of rules, right?
• 31:24
  SPEAKER_01: Yeah.
• 31:25
  SPEAKER_00: At the very top, you have the enterprise IAM policy.
• 31:28
  SPEAKER_01: These are the organizational laws set by the chief information security officer.
• 31:32
  SPEAKER_01: They are broad foundational edicts.
• 31:35
  SPEAKER_01: Things like every single human or machine identity must have an accountable owner, or all access to sensitive data must be justified, approved, and periodically reviewed.
• 31:45
  SPEAKER_00: It doesn't specify how to do it.
• 31:47
  SPEAKER_01: Exactly.
• 31:47
  SPEAKER_01: It doesn't specify the tool, just that it must be done.
• 31:50
  SPEAKER_00: Then you step down a level to domain standards.
• 31:52
  SPEAKER_00: And honestly, reading the difference between a policy and a standard took me a minute to grasp.
• 31:57
  SPEAKER_01: Think of standards as the technological translation of the policy.
• 32:00
  SPEAKER_01: The policy says access must be secure.
• 32:03
  SPEAKER_01: The authentication standard says all external access must utilize fish-resistant multi-factor authentication, specifically Phyto II hardware keys, and passwords must be at least 16 characters.
• 32:16
  SPEAKER_00: Ah, so it sets the strict technical boundary.
• 32:19
  SPEAKER_01: Yes.
• 32:19
  SPEAKER_01: Or the privileged access standard, which dictates that no human user can have standing administrative rights for more than four hours.
• 32:26
  SPEAKER_00: Got it.
• 32:27
  SPEAKER_00: And below that you have regional or business unit addenda.
• 32:30
  SPEAKER_00: Because a global company can't always have one set of rules.
• 32:33
  SPEAKER_01: Exactly.
• 32:34
  SPEAKER_01: You might have an office in Germany, and German labor laws or EU data residency requirements like GDPR might explicitly prohibit you from logging certain types of employee behavior or dictate where that identity data must be stored.
• 32:48
  SPEAKER_01: Right.
• 32:49
  SPEAKER_01: You might have a healthcare division that requires strict hyper addenda regarding who can access patient records.
• 32:54
  SPEAKER_00: And finally, at the bottom of the pyramid, operational procedures, the actual step-by-step implementation manuals for the IT team, like click this button, run this script.
• 33:03
  SPEAKER_00: Yep.
• 33:04
  SPEAKER_00: But here's the reality check I saw in the sources.
• 33:07
  SPEAKER_00: Policies are just pieces of paper on a corporate internet site if nobody actually enforces them.
• 33:13
  SPEAKER_00: So phase three also mandates the creation of a formal governance model.
• 33:17
  SPEAKER_01: Aaron Powell This is arguably more important than the policy itself.
• 33:20
  SPEAKER_01: You have to build the human oversight structure.
• 33:22
  SPEAKER_01: The blueprint demands three tiers.
• 33:24
  SPEAKER_01: First, an IAM steering committee.
• 33:26
  SPEAKER_00: Who sits on that?
• 33:27
  SPEAKER_01: Executives.
• 33:28
  SPEAKER_01: The CISO, the head of HR, the head of legal.
• 33:31
  SPEAKER_01: They meet quarterly, and their sole purpose is to resolve cross-functional political conflicts and ensure the budget hasn't been cut.
• 33:38
  SPEAKER_00: Okay.
• 33:38
  SPEAKER_00: So the big bosses.
• 33:39
  SPEAKER_01: Aaron Powell Right.
• 33:40
  SPEAKER_01: Below them, you create an IAM working group.
• 33:43
  SPEAKER_01: These are the IAM architects, the network engineers, the application owners.
• 33:46
  SPEAKER_01: They meet bi-weekly to manage the actual execution of the project and deal with technical roadblocks.
• 33:52
  SPEAKER_00: Aaron Powell And then there's the policy review board, which I assume exists because there will always, inevitably, be exceptions to the rules.
• 34:00
  SPEAKER_01: Aaron Powell Always.
• 34:00
  SPEAKER_01: You will write a brilliant standard that mandates MFA for everything, and then the manufacturing division will raise their hand and say, uh we have a multimillion dollar robotic assembly line running on software from 2004, and it physically cannot support MFA.
• 34:16
  SPEAKER_01: If you force this, the factory stops.
• 34:19
  SPEAKER_00: Aaron Powell So the policy review board evaluates that.
• 34:21
  SPEAKER_01: Yes.
• 34:22
  SPEAKER_01: They look at the business need versus the security risk and they formally document an exception.
• 34:26
  SPEAKER_01: Maybe they say, okay, the robot doesn't need MFA, but we are going to isolate it on its own segmented network VLAN, and you have to review this exception in 12 months.
• 34:36
  SPEAKER_00: And if you don't have this formal governance model in place, what happens?
• 34:39
  SPEAKER_01: IT just quietly does whatever the loudest manager asks them to do.
• 34:43
  SPEAKER_00: Yeah, that makes sense.
• 34:44
  SPEAKER_01: The technical implementation starts drifting immediately.
• 34:47
  SPEAKER_01: Someone in marketing complains that logging in is too hard.
• 34:50
  SPEAKER_01: An IT admin quietly grants them a permanent exception to bypass MFA, the configuration fragments across the network, and eventually the whole system fails its next audit and gets breached.
• 34:59
  SPEAKER_01: Governance holds the line.
• 35:01
  SPEAKER_00: So we have established the laws, we have the committees in place, now we move to phase four process and lifecycle design.
• 35:08
  SPEAKER_00: Yeah.
• 35:09
  SPEAKER_00: This is a massive undertaking.
• 35:10
  SPEAKER_00: The blueprint suggests four to six weeks here.
• 35:13
  SPEAKER_00: So what does this all actually mean in practice?
• 35:16
  SPEAKER_01: It means we are operationalizing the policies from phase three.
• 35:20
  SPEAKER_01: We know the rules.
• 35:22
  SPEAKER_01: Now we are designing the end-to-end workflows before we ever touch a piece of software configuration.
• 35:28
  SPEAKER_01: Every single process must be mapped meticulously on a whiteboard or in a flowchart.
• 35:32
  SPEAKER_00: What processes specifically?
• 35:34
  SPEAKER_01: All of them.
• 35:34
  SPEAKER_01: The joiner process, the mover process, the lever process, the access request workflows, the privileged access elevation workflows.
• 35:41
  SPEAKER_00: The blueprint says every process must have a trigger, a sequence of steps, decision points, service level agreements, and an accountable owner.
• 35:49
  SPEAKER_00: Let's make this real for the listener.
• 35:51
  SPEAKER_00: Let's walk through the joiner process.
• 35:53
  SPEAKER_00: Let's say I'm mapping it out, and I realize our current process is well, HR sends an email to the IT help desk saying, hey, Sarah's starting on Monday in accounting.
• 36:01
  SPEAKER_00: Give her what she needs.
• 36:02
  SPEAKER_00: And then an IT guy looks at another accountant's profile and just copies their permissions.
• 36:07
  SPEAKER_01: Which is how 90% of companies operate, and it is a complete disaster.
• 36:12
  SPEAKER_01: What is the trigger there?
• 36:13
  SPEAKER_01: An unstructured email.
• 36:14
  SPEAKER_01: What are the decision points?
• 36:16
  SPEAKER_01: None.
• 36:16
  SPEAKER_01: The IT admin is just guessing based on a clone.
• 36:19
  SPEAKER_00: This brings us to perhaps the most important insight, like the biggest light bulb moment of this entire deep dive.
• 36:26
  SPEAKER_00: The sources hammer this home.
• 36:28
  SPEAKER_00: You cannot automate a broken process.
• 36:30
  SPEAKER_01: You really can't.
• 36:31
  SPEAKER_01: If you take that unstructured guesswork email process and you feed it into a multimillion dollar identity governance tool without fixing the logic first.
• 36:40
  SPEAKER_00: You just create a highly efficient disaster at scale.
• 36:43
  SPEAKER_01: That is precisely it.
• 36:44
  SPEAKER_01: You are automating the provisioning of bad data and flawed workflows.
• 36:48
  SPEAKER_01: The software will faithfully execute your terrible process at the speed of light.
• 36:52
  SPEAKER_00: Speed of light chaos.
• 36:53
  SPEAKER_01: Exactly.
• 36:54
  SPEAKER_01: It will automatically give the wrong people the wrong access instantly.
• 36:58
  SPEAKER_01: That is why phase four forces you to Mac the processes perfectly on paper first.
• 37:03
  SPEAKER_00: So a fixed process would look like what?
• 37:05
  SPEAKER_01: Well, the trigger is no longer an email.
• 37:07
  SPEAKER_01: The trigger is a secure API call from workday directly into the identity governance tool, carrying a structured payload with Sarah's exact title, cost center, and manager ID.
• 37:17
  SPEAKER_00: Nice and clean.
• 37:18
  SPEAKER_01: Right.
• 37:19
  SPEAKER_01: And the decision point is an automated logic tree.
• 37:21
  SPEAKER_01: If department equals accounting automatically provision-based active directory access and basic email, then a routed workflow sends an alert to Sarah's specific manager to approve access to the sensitive financial ledger.
• 37:34
  SPEAKER_00: Yeah, and if the manager's on vacation.
• 37:36
  SPEAKER_01: Then the SLA kicks in.
• 37:38
  SPEAKER_01: If the manager doesn't approve within the service level agreement of four hours, the request automatically escalates to the department head.
• 37:44
  SPEAKER_01: It is deterministic, logical, and fully auditable.
• 37:48
  SPEAKER_00: Okay.
• 37:48
  SPEAKER_00: So we have poured the foundation in phase zero and one.
• 37:52
  SPEAKER_00: We have drawn the strategic blueprints in phase two.
• 37:54
  SPEAKER_00: We have established the laws in phase three, and we have meticulously mapped the workflows in phase four.
• 37:59
  SPEAKER_01: It's a lot of prep work.
• 38:01
  SPEAKER_00: It is.
• 38:01
  SPEAKER_00: But finally, we reach phase five.
• 38:04
  SPEAKER_00: The architecture and the fatal flaw of ignoring dependencies.
• 38:09
  SPEAKER_01: This is the moment the engineers have been waiting for.
• 38:11
  SPEAKER_01: Phase five is where we actually design the target state technology stack.
• 38:16
  SPEAKER_01: This is three to four weeks of mapping out the functional layers.
• 38:19
  SPEAKER_00: This is where you are actually looking at the tools, right?
• 38:22
  SPEAKER_00: The directory, the identity provider, the identity governance tool, privileged access management.
• 38:27
  SPEAKER_00: You're deciding between Entra ID, Okta, Salepoint, CyberErc, all the big names.
• 38:32
  SPEAKER_01: Exactly.
• 38:33
  SPEAKER_00: But the sources provide this incredible, sobering list of the seven most common IAM implementation mistakes that happen right at this architectural stage.
• 38:43
  SPEAKER_00: Let's run through them because they are fascinating.
• 38:45
  SPEAKER_00: Let's do it.
• 38:46
  SPEAKER_00: Mistake number one.
• 38:47
  SPEAKER_01: Buying more platform than the organization can implement or operate.
• 38:50
  SPEAKER_01: This is classic over-engineering.
• 38:52
  SPEAKER_00: Like buying a spaceship to go to the grocery store.
• 38:54
  SPEAKER_01: Pretty much.
• 38:55
  SPEAKER_01: You have a company that barely has the staff to keep their basic Windows Active Directory servers running, and they go out and buy a massively complex, enterprise-grade identity governance tool that requires a team of dedicated Python developers to configure the custom connectors.
• 39:10
  SPEAKER_00: And what happens?
• 39:11
  SPEAKER_01: The software just sits on a virtual shelf, half deployed, because they don't have the internal maturity to run a Ferrari.
• 39:18
  SPEAKER_00: Ouch.
• 39:19
  SPEAKER_00: Okay.
• 39:20
  SPEAKER_00: Mistake number two is a classic sequencing failure, starting with governance like access reviews before authentication is even working properly.
• 39:28
  SPEAKER_01: Aaron Powell Right.
• 39:29
  SPEAKER_01: Imagine trying to roll out a complex process where managers have to review and certify their employees' access every quarter, but the underlying directory is so messy that half the accounts don't have a manager listed, and the users are still logging in with easily stolen NTLM passwords.
• 39:45
  SPEAKER_00: You're just spinning your wheels.
• 39:46
  SPEAKER_01: You're putting a band-aid on a gaping wound.
• 39:48
  SPEAKER_01: You must secure the base authentication layer first.
• 39:51
  SPEAKER_00: Mistake number three, failing to account for privileged accounts and service accounts separately from standard human users.
• 39:58
  SPEAKER_01: An admin account is not a standard human.
• 40:00
  SPEAKER_01: A service account running an API is not a standard human.
• 40:03
  SPEAKER_01: Right.
• 40:04
  SPEAKER_01: If you try to force a machine identity to use a process designed for a human, like asking a server to check a text message for an MFA code, the architecture breaks.
• 40:14
  SPEAKER_01: You must have distinct architectural layers for privileged and non-human identities.
• 40:19
  SPEAKER_00: Mistake number four is huge, and we've touched on it a bit.
• 40:22
  SPEAKER_00: Not integrating IAM with human resources systems.
• 40:26
  SPEAKER_00: If you buy Okta, but you still rely on HR manually emailing IT to tell them someone is hired or fired, your provisioning and deprovisioning are still entirely manual, defeating the whole purpose of the investment.
• 40:38
  SPEAKER_01: Exactly.
• 40:39
  SPEAKER_01: The HR system must be the single source of truth.
• 40:42
  SPEAKER_01: Always.
• 40:42
  SPEAKER_00: Mistake number five: neglecting non-human identities entirely.
• 40:46
  SPEAKER_00: Now we will get to that at the very end because it's a massive topic.
• 40:49
  SPEAKER_01: It's the future.
• 40:50
  SPEAKER_00: Yeah.
• 40:50
  SPEAKER_00: Mistake number six, treating access certifications as a one-time compliance exercise rather than a continuous process.
• 40:58
  SPEAKER_01: Ah, the annual audit sprint, where everyone works weekends for a month to satisfy the auditors and then ignores governance for the next 11 months, the architecture must support continuous, event-driven reviews.
• 41:11
  SPEAKER_00: And finally, mistake number seven.
• 41:14
  SPEAKER_00: Underestimating the total cost of ownership, especially the ongoing administration costs after the expense of consultants leave.
• 41:21
  SPEAKER_01: Software requires feeding and watering.
• 41:24
  SPEAKER_01: If you don't budget for the internal engineering talent required to maintain the integrations, the system just decays.
• 41:30
  SPEAKER_00: So to avoid these mistakes, the blueprint uses what it calls a horizon roadmap model.
• 41:35
  SPEAKER_00: It's a three-year sequencing timeline.
• 41:37
  SPEAKER_00: The message here is basically you don't try to boil the ocean on day one.
• 41:42
  SPEAKER_01: Phased execution is survival.
• 41:43
  SPEAKER_01: The roadmap is typically broken into three horizons.
• 41:46
  SPEAKER_01: Horizon one is the first 12 months.
• 41:48
  SPEAKER_01: The goal is to secure the base.
• 41:50
  SPEAKER_00: Not the bleeding.
• 41:51
  SPEAKER_01: Exactly.
• 41:51
  SPEAKER_01: Enforce MFA everywhere.
• 41:53
  SPEAKER_01: Shut down legacy authentication protocols like NTLM.
• 41:56
  SPEAKER_01: Automate the core joiner, mover, lever lifecycle by integrating HR data.
• 42:00
  SPEAKER_01: Centralize your applications behind a single identity provider.
• 42:03
  SPEAKER_01: You don't do anything fancy, you just build a solid, reliable floor.
• 42:07
  SPEAKER_00: Then you move to Horizon 2, which is months 12 to 24.
• 42:12
  SPEAKER_00: This is where you mature the governance.
• 42:14
  SPEAKER_01: Now that the base is secure, you can roll out automated access reviews at scale.
• 42:18
  SPEAKER_01: You can start managing fine-greened entitlements.
• 42:21
  SPEAKER_01: Not just does Bob have access to Salesforce, but what specific records in Salesforce can Bob edit?
• 42:27
  SPEAKER_01: You start governing workload and cloud infrastructure identities.
• 42:30
  SPEAKER_00: And Horizon 3, months 24 to 36, is transform.
• 42:35
  SPEAKER_00: This is where you get to the cool stuff.
• 42:37
  SPEAKER_01: This is where you implement passwordless authentication at scale using biometric hardware keys.
• 42:42
  SPEAKER_01: This is where you achieve true zero trust network access utilizing that continuous access evaluation we talked about earlier.
• 42:49
  SPEAKER_01: You sequence it carefully over three years.
• 42:51
  SPEAKER_00: Because if you don't map your platform data and process dependencies, you fail.
• 42:56
  SPEAKER_00: It's like trying to install a seat-of-the-art smart home security system before the house even has electricity wired.
• 43:01
  SPEAKER_00: You can go buy the fanciest, most expensive Wi-Fi cameras on the market.
• 43:05
  SPEAKER_00: But if there's no power in the walls to plug them into, and the front door doesn't even have a physical lock on it yet, the cameras are useless.
• 43:13
  SPEAKER_00: You have to respect the mechanical dependencies of the house.
• 43:15
  SPEAKER_01: That is a perfect analogy.
• 43:17
  SPEAKER_01: You cannot leapfrog infrastructure.
• 43:19
  SPEAKER_00: Which brings us to a phase that, according to the sources, often catches technical teams completely off guard.
• 43:26
  SPEAKER_01: Oh, big time.
• 43:27
  SPEAKER_00: They built the architecture, they love their roadmap, and then they hit phase six.
• 43:32
  SPEAKER_00: Implementation planning and change management.
• 43:35
  SPEAKER_01: This is a two to three week period dedicated heavily, almost exclusively, to the human element of the deployment.
• 43:42
  SPEAKER_00: And I know for a fact that a lot of hardcore engineers might push back here.
• 43:46
  SPEAKER_00: They look at change management as fluffy HR stuff.
• 43:48
  SPEAKER_00: They'll say, it's just software.
• 43:50
  SPEAKER_00: We're just changing the screen they see when they log in.
• 43:53
  SPEAKER_00: Why is change management listed in these federal documents as the single most common cause of project failure?
• 44:00
  SPEAKER_00: Second only to technical dependencies.
• 44:02
  SPEAKER_01: Because they fail to understand the psychology of access, people absolutely hate losing access.
• 44:07
  SPEAKER_00: They do.
• 44:08
  SPEAKER_01: It triggers a profound, almost primitive territorial response.
• 44:13
  SPEAKER_01: When you implement a true, governed identity transformation, you are not just updating software.
• 44:19
  SPEAKER_01: You are generating massive, highly disruptive cultural shifts.
• 44:23
  SPEAKER_01: You are taking power away from people.
• 44:25
  SPEAKER_00: Aaron Powell Let's do a role play because the sources give some visceral examples of this friction.
• 44:29
  SPEAKER_00: Let's look at privileged access management.
• 44:31
  SPEAKER_00: I want you to be the I am architect.
• 44:33
  SPEAKER_01: Okay, I'm the architect.
• 44:34
  SPEAKER_00: And I am going to be a stubborn, highly valuable lead developer.
• 44:37
  SPEAKER_00: I've been in the company for five years.
• 44:39
  SPEAKER_00: For five years, my account has had global admin rights across the entire cloud infrastructure.
• 44:44
  SPEAKER_00: I can spin up servers, delete databases, whatever I want, whenever I want.
• 44:48
  SPEAKER_00: It makes my job fast.
• 44:49
  SPEAKER_00: And you, the architect, come to me and say, you're stripping that standing access away.
• 44:54
  SPEAKER_01: Right.
• 44:54
  SPEAKER_01: I would come to you and say, your standing global admin rights are a massive security risk.
• 44:59
  SPEAKER_01: From now on, your daily account will have standard user privileges.
• 45:03
  SPEAKER_01: When you need to perform an administrative task, you will log into the vault, request just-in-time elevation, provide a ticket number for justification, and that administrative access will automatically expire and revoke after two hours.
• 45:16
  SPEAKER_00: And as the lead developer, I am going to absolutely scream.
• 45:20
  SPEAKER_00: I'm ready.
• 45:21
  SPEAKER_00: I'm going to say, you are burying me in bureaucracy.
• 45:23
  SPEAKER_00: If a server goes down at 2 a.m., I don't have time to fill out a justification ticket and wait for an elevation workflow, the site will crash.
• 45:31
  SPEAKER_00: You are stopping me from doing my job.
• 45:33
  SPEAKER_00: I'm going to escalate this to the VP of engineering right now and tell them security is breaking production.
• 45:40
  SPEAKER_01: And that is exactly what happens in the real world every single time.
• 45:43
  SPEAKER_00: Or imagine the friction of forcing 10,000 employees to suddenly abandon their familiar passwords and switch to FIDO2 hardware keys that they have to physically plug into their laptops.
• 45:53
  SPEAKER_00: I left my key at home, I can't work today.
• 45:55
  SPEAKER_00: The complaints will flood the help desk.
• 45:57
  SPEAKER_01: Exactly.
• 45:58
  SPEAKER_01: And if the organization lacks a dedicated executive-backed change management function to absorb that intense internal pushback, the users will win.
• 46:08
  SPEAKER_00: Security always loses to convenience.
• 46:10
  SPEAKER_01: It does.
• 46:11
  SPEAKER_01: CIO will get tired of the complaints, the executives will cave, exceptions will be granted, and the resistance will derail the entire strategic roadmap.
• 46:20
  SPEAKER_00: So what does phase six actually do to prevent that from happening?
• 46:23
  SPEAKER_01: It builds the communication plans, the specialized training tracks, and the rigid exception handling processes before you clip the switch.
• 46:30
  SPEAKER_01: You identify the power users like that lead developer and you bring them into the process early.
• 46:36
  SPEAKER_00: Make them part of the solution.
• 46:37
  SPEAKER_01: Yes.
• 46:37
  SPEAKER_01: You explain the risk, you show them how the just-in-time elevation actually takes only 10 seconds to approve, and you get their buy-in.
• 46:44
  SPEAKER_01: You manage the human friction proactively.
• 46:46
  SPEAKER_00: Okay.
• 46:47
  SPEAKER_00: We've managed the friction, we've rolled out the tech, the blueprint is alive.
• 46:51
  SPEAKER_00: And finally, we reach phase seven: operationalization and metrics.
• 46:56
  SPEAKER_00: This is the moment the project officially transitions into a permanent, steady state program.
• 47:01
  SPEAKER_01: This phase is ongoing.
• 47:02
  SPEAKER_01: It is the rest of time.
• 47:03
  SPEAKER_01: It's the daily reality of running the identity engine you just built.
• 47:07
  SPEAKER_01: And the blueprint clearly defines how this must be structured using a tiered operating model.
• 47:12
  SPEAKER_00: Let's break down those tiers.
• 47:14
  SPEAKER_01: Tier one is your standard service desk.
• 47:16
  SPEAKER_01: These are the frontline workers handling basic access requests that couldn't be automated, or helping users who lost their MFA hardware keys.
• 47:24
  SPEAKER_01: Tier two is IAM operations.
• 47:27
  SPEAKER_01: They handle provisioning exceptions, managing complex group structures, and troubleshooting synchronization errors between HR and the directory.
• 47:35
  SPEAKER_00: Tier three is IAM engineering.
• 47:37
  SPEAKER_01: Right.
• 47:37
  SPEAKER_01: These are the developers maintaining the platforms, writing new API integrations as the company buys new software, and ensuring the infrastructure is healthy.
• 47:46
  SPEAKER_01: And T4 is IAM architecture.
• 47:49
  SPEAKER_01: This is the strategic oversight, ensuring that as the business evolves, the identity roadmap adapts with it.
• 47:54
  SPEAKER_00: And you must have key performance indicators or KPIs.
• 47:58
  SPEAKER_00: The sources emphasize that you have to measure what actually matters to the business, not just vanity metrics.
• 48:02
  SPEAKER_01: Exactly.
• 48:03
  SPEAKER_01: A vanity metric is saying we have 15,000 active users.
• 48:06
  SPEAKER_01: That tells the CFO nothing.
• 48:08
  SPEAKER_00: It's just a number.
• 48:09
  SPEAKER_01: Right.
• 48:10
  SPEAKER_01: A real KPI is what percentage of our joiner mover lever access is fully automated?
• 48:16
  SPEAKER_01: Or what is our mean time to revoke access upon an HR termination?
• 48:21
  SPEAKER_01: If that mean time drifts from five minutes to five hours, the alarms should go off.
• 48:26
  SPEAKER_00: But the real danger here, the existential threat that phase seven is specifically designed to fight, is decay.
• 48:32
  SPEAKER_01: Entropy is the natural state of any IT environment.
• 48:36
  SPEAKER_01: Without a continuous improvement cycle, monthly operational reviews analyzing the KPIs, quarterly steering committee check-ins to resolve new political battles, annual strategy refreshes the program will slowly, inevitably decay back to ad hoc manual operations.
• 48:52
  SPEAKER_00: People will just revert to their old habits.
• 48:54
  SPEAKER_01: Always.
• 48:54
  SPEAKER_01: People will find workarounds.
• 48:56
  SPEAKER_01: They will start sharing passwords again to bypass a cumbersome process.
• 48:59
  SPEAKER_00: Which is why true governance requires continuous compliance.
• 49:02
  SPEAKER_00: We touched on this earlier, but passing a point-in-time audit does not mathematically equate to a secure architecture.
• 49:08
  SPEAKER_00: Trevor Burrus, Jr.
• 49:08
  SPEAKER_01: Not at all.
• 49:08
  SPEAKER_01: It just proves you were clean on the one day the auditor looked.
• 49:11
  SPEAKER_01: Phase seven enforces microcertifications triggered by high-risk events.
• 49:15
  SPEAKER_00: How does that work?
• 49:16
  SPEAKER_01: If Bob changes departments, boom, the system instantly triggers a micro-certification, requiring his new manager to recertify his specific access within 48 hours.
• 49:26
  SPEAKER_01: Phase seven ensures the skyscraper you just spent two years building doesn't slowly sink into the mud because you stopped doing maintenance.
• 49:33
  SPEAKER_00: Okay.
• 49:34
  SPEAKER_00: We have covered an immense amount of ground today.
• 49:36
  SPEAKER_00: From the political scoping battles of phase zero through the ruthless autopsy of phase one, the CFO logic of phase two, the policy laws of three and workflows of four, the architecture of five, the psychology of six, all the way to the continuous operations of phase seven.
• 49:51
  SPEAKER_00: Yeah.
• 49:51
  SPEAKER_00: I think if there's one core takeaway from all this source material, it's that treating identity as the operational core of your security posture, not just a peripheral IT function, is the only way to scale securely and prevent catastrophic pipeline shutting breaches.
• 50:06
  SPEAKER_01: The sequence matters.
• 50:07
  SPEAKER_01: You have to uncover the facts, build the strategy, establish the rules, map the processes, design the architecture, manage the human resistance, and operate it continuously.
• 50:16
  SPEAKER_01: Skip a step, and the house of cards falls.
• 50:19
  SPEAKER_00: But before we wrap up, we want to leave you with one final provocative thought.
• 50:23
  SPEAKER_00: Something to mull over.
• 50:24
  SPEAKER_00: Everything we've discussed today, mapping the joiner, mover, lever process, managing access, arguing with lead developers about privileges we've largely been talking about humans, biological employees.
• 50:36
  SPEAKER_01: Which raises an incredibly important, almost terrifying question about the near future.
• 50:41
  SPEAKER_01: As we move deeper into the age of artificial intelligence, non-human identities, AI agents, automated bots, API service accounts, machine identities executing autonomous code are beginning to vastly outnumber human employees on corporate networks.
• 50:57
  SPEAKER_00: Think about the mechanics of that.
• 50:59
  SPEAKER_00: We talked about how hard it is to manage Bob moving from marketing to finance.
• 51:03
  SPEAKER_00: But if your organization struggled to map the life cycle for a single human being in phase one, how will your IAM blueprint handle a future where thousands of autonomous AI agents are spun up dynamically by the system, granted high-level access to sensitive data to perform a specific analytical task, and then terminate it all in a matter of milliseconds?
• 51:21
  SPEAKER_01: It fundamentally breaks the traditional manual review cycle.
• 51:24
  SPEAKER_01: You cannot have a human manager approve an access request for an AI agent that only exists for three seconds.
• 51:31
  SPEAKER_01: If you haven't mastered the foundational seven-phase blueprint for humans, if you don't have perfect automated policy-driven lifecycle management in place, the automated AI future will completely overwhelm your security posture.
• 51:45
  SPEAKER_01: You won't have shadow identities, you'll have an invisible army of autonomous entities with keys to the kingdom.
• 51:51
  SPEAKER_00: You cannot install the high-speed elevators if the foundation is already cracking.
• 51:55
  SPEAKER_00: Thank you for joining us on this deep dive.
• 51:57
  SPEAKER_00: Take a hard look at your own organization's IAM posture this week through the lens of this blueprint.
• 52:03
  SPEAKER_00: Are you carefully building a governed, sequential skyscraper, or are you just trying to buy the penthouse furniture first?
• 52:09
  SPEAKER_00: We'll see you next time.
• 52:10
  SPEAKER_00: That's a wrap on episode one of the identity blueprint.
• 52:14
  SPEAKER_00: On our next episode, Jose and I are going to walk you through how to execute a ruthless identity security autopsy, how to tear apart your existing IAM program, find exactly where it's broken, and build a clear picture of where you need to go.
• 52:29
  SPEAKER_00: You won't want to miss it.
• 52:30
  SPEAKER_00: If you want to connect, find me on LinkedIn at LinkedIn.com forward slash IN slash Ernie Prescott.
• 52:37
  SPEAKER_00: I'd love to hear your thoughts on today's episode and what identity challenges you're dealing with in the real world.
• 52:43
  SPEAKER_00: Subscribe wherever you listen to podcasts so you never miss an episode.
• 52:46
  SPEAKER_00: Until next time.