This is identity at the center. If it has anything to do with I
am, This is the go to podcast now your hosts Jim McDonald and
Jeff Steadman. Welcome to the Identity at the
Center podcast. I'm Jeff and that's Jim.
Hey, Jim. Hey, Jeff, how are you?
Oh, not so bad yourself. Good, good.
Earlier today I I joined a like an annual or quarterly meeting
for the 1414 venture group, some of the folks that we had on the
podcast in the back in the past Jackie Shobak and Howard Hall
and kind of got into you know my perspective on this is the
expanding, expanding scope of the identity.
Industry, right. We're going from kind of the
traditional towers of authentication, authorization,
access management, identity, governance, even customer.
I am I would say more fits into that.
It's been around for so long and now we've got all these new
areas popping up like I TDR, identity proofing, decentralized
identity and machine accounts. And so I just kind of expanded
on those I I said look there's. A lot of activity going on in
these spaces and a lot of companies in stealth and you
know, kind of how do you find those companies.
And you know that I don't always have the answer to, But if there
are folks out there who are kind of in the stealth mode and want
to connect back to them and be able to pitch where they're at,
you know, reach out to me and Jeff and you know, we'd be more
than happy to make those connections.
Yeah, for sure. I mean, there's a lot of good
ideas out there and some, I'm sure stuff we've never heard of
them was like, yeah, that's like a no brainer.
I was thinking about that before.
And yeah, it's a good group over there too.
I mean, just good people. We've had them on the show like
said before and hopefully we can connect dots if that's something
that you're working on and you want to do an introduction, you
know, reach out to Jim myself. We're happy to to make that
happen. But I don't know, I mean, I feel
like. There's so many untapped
potential. Still.
Did AI come up at all as part of that conversation?
No, I avoided it because, you know, I did.
I wasn't there. Yeah.
Because. You weren't there.
But from an AI perspective, I did have my AI enhanced
headshot. And So what I said was like,
there is value in AI, even if you're an AI hater, AI headshots
look a lot better. Yeah, the one you texted me was.
I got to tell you, man, it was good.
It was real good. But I know, really you You
square off your jaw and, like, you know, you chisel your chin.
I mean, heck, you know what's wrong with that?
I mean, yeah, square off my jaw, the rest of my body, everything.
Could use some some more definition, but it was it was a
good looking picture. I I'll give you that.
My concern is that okay, this is what you look like in the
picture and then you end up disappointing someone.
In real life you don't like anything like that.
You're welcome to my world. Yeah, well, OK.
Speaking of not hopefully not disappointing people as a very
awkward transition to, let's talk about the Authenticate
conference coming up in October. You and I are going to be there
October 16th through the 18th in Carlsbad, CA on a golf course.
I think it's the Omni resort, something like that there.
I don't have the the full name in front of me, probably should
have done that, but if you're listening to this, you can get a
discount. I D AC15 podcast gets you 15%
off your in person registration. We had a planning meeting
earlier today, Jim, about what we're going to be doing.
We're on the main stage. At some point.
I think midday we might be the lunch blocker, which is always a
great spot to be in. We're part of the keynote, man.
Yeah, like, but we're going to run for lunch.
We're thinking about like doing like a live podcast style
presentation type thing, right? It's.
And we'll have some people on the stage with us, I think kind
of thinking about, you know what topics make the most sense.
Maybe this is a call out for people who are listening.
Are there things that you would like us to talk about on stage
at the Authenticate conference? You know, obviously needs to be
probably somewhat appropriate to authentication, fight alliance
pass keys, password less right things like that.
But we love to hear ideas. Obviously, you know, if you're
if you're looking to attend, whether you're in person or if
you're doing something remote because it's, I think it's gonna
be live streamed as well. Always rather answer questions
rather than just kind of try to figure out what people want.
But it's going to be exciting. I think we're going to, we're
going to have a cool live show. It's going to be streamed to, I
don't know, millions, billions of people and yeah.
To 9 billion people, right? Yeah.
And all that. Real people and all the fake
people. Yeah, well, I think it's The
Last of Us we put out, we were like, oh, there's no way, no
second last episode was like. There was no way we could talk
for 90 minutes, right? That's how we started off the
show. And then what did we do?
We recorded for 90 minutes, by far the longest episode we've
done, I think by like a good 10 minutes.
So I'm sure we can fill time if needed, but we'll give about an
hour's worth of a presentation. On the last thing that I'm
really excited about, so if you use our discount code, you
automatically get entered into a raffle and the the kind folks
who are putting on the conference are going to put
together some kind of goodie bag.
And it's going to be the prize for the person who selected
that. Now it could be a bag full of
trinkets, Halloween candy. I have no idea.
But it's going to be something. So you know, make sure you use
that code, You get 15% off and and maybe get a prize.
Yeah, that'd be kind of cool. I don't know.
I'm not sure yet how that's going to work.
Don't have a lot of details, but use the code, support the Show
ID AC15 podcast. I'll have it in our show notes
too, so people can use it there. But yeah, there'll be something.
For a Lucky ID AC15 podcast code user of some sort.
So we got that. I'm going to be at Identity Week
America. A couple weeks before that in
DC, I'm hosting a panel there talking about passkeys and
things like that. So if you're going to be out
there and we're working on a discount code for that one as
well. So good news is we have discount
codes and they're and they're for two conferences.
Couldn't be further apart from each other in the US, the ones
in DC on the East Coast, the other ones in California and the
West Coast. The the the dates and times
don't overlap. So there won't be any conflict
or anything like that. But we'll have that in the
future show. So keep an eye out for that okay
enough promotion. Why don't we get to our topic
today? Because I think this is a
conversation with an individual that's probably a long time
coming and I feel like I want to say that this is his second
appearance on the show. And the only way that you would
know that is if you listen to one of the identifier shows
where I won't say it was harassment or physical, you
know, accostment of one of our accosting one of our our guests
as we were recording in the hallway there.
But this is someone we're excited to have on the show.
His name is David Lee. He's an author, a speaker, a
finance guy. He is an aspiring mogul and most
importantly for us, he is the identity Jedi.
So welcome to the show, David. Thanks.
That's a great introduction. And no, it was not Assault.
It was a nice, it's a nice shoulder massage.
I was trying to make sure Ian was nice and prepped for his
interview. Yeah, well, Ian's good people
and we took him in stride, but. Yeah, great to have you on here.
I think for for people who don't know who you are and you've,
you've put out a lot of content. You've got, you know, YouTube
channel and you've got a whole bunch of stuff you work on.
But hey, this is, I guess we'll call it officially the first
time. We've actually got to sit and
talk with you. We want to find out identity
origin stories, you know, how did you get into the world of
identity? Is it something that you chose
or did it choose you? Yeah, so.
Great question because I, I love to ask those to people as well.
So it shows me and how it started was I came out of
college, wanted to be like it's the best software engineer ever.
And so I started working for federal contracting for the
government. And so my first contract, it
was, you know, pretty cool. I was doing some J2 EE stuff.
That's how old I am. And then I got onto another and
it's another project and it was like, hey, like we're going to
build this. System where people are going to
like you have to manage access and you have to create a way for
people to request the access and it just it sounded like so super
cool and indepth and I'm thinking oh man I'm going to get
a chance to build like something really cool.
So I come in there day one and I'm just I'm all ready to go
right. I'm I'm fresh stuff on you know
Java and how we can do this and the latest things that we can
do. We got like these swing applets
and all the stuff that we can build like I am super geek and
like the architecture's looking at me he's like huh.
It's pretty cool. I came in, check this out, like,
you know, because the first week back then it took forever to get
your access. So I'm building prototypes, all
this stuff or whatever. And he's like, that's great.
So he comes in and he takes like these two big books, the Sun,
IDM training books, drops them on my desk and goes read through
there. I'll teach you how to install
it. That's the product we're working
on. We got to get this up and
deployed in the next 60 days. Oh, by the way, I'm going on
vacation for two weeks. I expect you to have this
figured out by the time I get back.
Welcome to the project, kid. And walked out And I'm like,
huh? And that's literally how I came
into Identity. I had no clue what it was.
So I started installing some Identity manager, going through
and figuring out the more I'm playing with this thing, I'm
like, I don't need to code anything, like it's kind of all
there. And so I'm digging into this
language, figuring out what it is.
And I'm the type of person that once I'm working with something,
I need to understand everything about it to really understand
where it works. And the analogy I like to use is
like, you know, if you give me a hammer, I want to go look at the
tool set because I want to understand, like, what does this
hammer relate to? Everything else that's send me
okay. Well, This is why I use this
instead of a screwdriver. And so that just put me down a
rabbit hole. I got really good at some idea
understanding roles, provisioning, what Ldaps were,
what access was, what access management, what certificate
authorities were, and just yadda yadda yadda on and on and on.
I've been doing it ever since, so it shows me, and I'm kind of
glad I did. I kind of like the idea of.
Make this trial by fire that you got right.
This guy shows up. He's got books drops on your
desk like I'm. I'm out of here.
Peace. See him like sick.
You know in a couple weeks. You know welcome to the jungle
plays in the background and you're like, all right, well, I
guess I got to get to this right.
I feel like this is like a movie scene that can like come
together and now you've got this thing called the I am Jedi.
Tell me about the identity Jedi. Like, what is this?
Yeah, there's a newsletter. I'm signed up.
I'm getting stuff from you like it seems like every day.
Like, tell me about this. Yeah, so this all originated.
I did a talk at Identifiers, I don't know, maybe two or three
years ago. Now I have to go look it up.
But it's called how to How to Become an identity, right?
News slash. I'm a huge Star Wars man.
But at the time I was just thinking there was, we started
to see this wave of people coming into identity, right.
And what I would say like the second generation of.
Where there was a lot more information out there now like
so back like when I started probably I would, I would assume
when you guys started like you learn this by just doing it and
whatever vendor product you had and then you learned other stuff
like they just there wasn't any place to go.
We didn't have forms. We didn't have anything.
It was just there you go. And so as I was talking to
customers, I started noticing like a lot of them were just
struggling understanding these concepts and basics and a lot of
people that have been leading these organizations, you know
knew nothing about identity. They were just giving A-Team go
run this, you now have to do this and so.
I wanted to create this presentation.
We're just like, okay, This is, this is what it is.
Here's how you can be successful.
There's busiest side, there's technical side.
So I was like, okay, here's how you become an identity Jedi.
And then I just kind of stuck with it.
People loved that talk. They kept going.
And then I was like, well, I'll just keep going with this
moniker. And so from there, it turned
into a newsletter, which is the identityjedi.com.
And so I send a newsletter out every week, usually on
Wednesdays, which there's not going to be 1 today, setting a
chance to write it. So it'll be coming tomorrow,
but. But yeah, just kind of following
following the the industry, right, the news and and what's
going on and different takes that I have on things and
explaining what these things are as is coming out because from
from that time that I gave that talk to now, you know I feel
like the the market has accelerated in the type of
things that we're doing. Identity is so much more front
and center now and so again we're getting more and more
people coming into it. But we still don't do a very
good job of just kind of explaining what all this stuff
is. It's kind of one of these things
like you're already in the clubhouse, so you know.
So when you get somebody brand new coming in, they're like,
well, what's this and what's that?
What's the final like, what's Samuel?
And, And we just talk about this stuff and throw it around like
this is just what we know. And so I want to have a place
where people could come if they knew identity that should learn
if they're just, they love identity like like I do, like
you guys do. Like here's actually things that
I've found and I'd like to rent and write stuff and people like
to read it. So I'm like, oh, here we go.
Somebody brought that up because we were talking before we hit
record about barbers and when I go to the Barber.
You know, take one first of all, it takes a while to find a good
one, and then once you have them, you don't let them go.
Right. Ever.
Yeah. And it's like, OK, one of the
first questions that, you know, typically asks is what do you
do? Oh, I work in consulting.
OK Well, what kind of consultant?
Oh, security. Well, you mean like for doors?
No, for information security. I was like, oh, OK, well, what
do you mean? It's like, OK, well, you know,
like ID's and passwords and things like that.
That's sort of the field that I'm in.
Oh, OK. And then I feel like it's a
courteous, oh, OK, like, I don't know what you just said, but
sure, I'm just going to keep cutting your hair.
How do you like, how do you tell people what you do?
I don't man of mystery, I just. You just.
Put your cloak over your head and then you just turn away and
you just wave your fingers. This is not the Jedi you're
looking for. Honestly like, so if I'm talking
to somebody like outside of the energy, I just tell I was like,
yeah, I work in the cyber screening space and I just
because it just doesn't. Depending on their level of
interest, right. If they really want to get into
it, then, you know, I'll explain it and get into it.
But most of the time I just say I'm in the cybersecurity space.
Or if I get to deep into that, I was like, yeah, especially like
getting access management. I was like, so, you know, like
all the things that you do at work when you go and access your
computer, these applications, stuff like that.
I was like, yeah, well, behind the scenes there's a bunch of
the needs that happen to make sure that you get that.
I was like, I help people build systems that do that and people
usually kind of get that and go okay cool.
So. And we were talking a little bit
about identifiers earlier and the the not harassment that took
place of Ian, but you gave one of the best, like keynote things
that I've seen on the stage in a long time.
And my understanding is it was your first time doing that and I
thought you killed it. What was it like being up there
and for people who weren't there?
Can you just kind of just a real brief synopsis of what your talk
was about and then take me behind the scenes like?
What was going? Through your head.
Like, were you, like, ready? Were you, like, did you black
out like Will Ferrell in old school answering the question,
how did that go? Yeah.
Well, first of all, thank you for that, man.
That means a lot. I appreciate it.
I was telling Ian I was like, it's the athletes that I've
gotten from people. It means the most of me, from my
peers, right, People who are actually in this industry.
And that means a lot. It was my first keynote, but I
mean, it wasn't my first time speaking.
So I want to make sure these people are listening right.
And I didn't just like, I'm going to come to speaker, let's
go on the exact thing and go kill it.
But it was my first keynote and you know, coming up to it, it
was it was pretty nervous and I was more nervous than I than I
usually in for speaking. The talk actually came together
10:00 o'clock the night before. Like not like I had the slides
and everything done like that. All that's was submitted, but
like. You know, I'm not a big person.
I don't, I don't practice a lot. Like, I'm not one of these
people who'll tell you, oh, practice and do all this stuff,
whatever. That's not my style.
I'm much more of a conversational style.
I'm much more of a storyteller. So I had this story of what I
wanted to tell and how I wanted to set it up.
It just wasn't flowing right. They didn't come together.
Like I said, about 10:00, o'clock the night before.
And I I had the 8:00 o'clock freaking teen outside the
hungover slot. And I had the hangover slot
because we're in Vegas at a conference, right?
And of course, everybody's texting me, oh, come out, come
out. And I'm like, Nope, I had to
turn my phone off, fuck myself. And I was like, no.
I was like, dude, mic check is like at 7.
Like no, I'm not, I'm not going anywhere.
So I get up that morning, go to mic check.
And yeah, like once I kind of submitted to the final like
notes the night before, I felt better about it.
I was kind of walking through it on my phone back in the green
room and just kind of taking everything in.
And then it's funny like a week before I was talking to Ian
about like, when I do give talk it, I I do black out it, it
doesn't. Like, I don't.
I couldn't tell you what happened on stage.
I can tell you what I talked about because another talk.
But I couldn't tell you like what happened on stage.
Like as soon as I, as soon as Andy said it and like, they kind
of raised up the lights and I walked out like that.
That's it. That's all for mayor.
It was just the next thing I remember is walking on stage and
there's Ian giving me this huge big hug and telling me how much
I killed it. And I was like, cool.
I was like, I'm glad people liked it because I couldn't tell
you what that guy just. Said.
It was a lot of fun. It was really good.
So when you went behind stage, it's Vegas where they're like.
I don't know, like drinks flowing.
We had like Sammy, you know, Sammy Davis.
We had a whole bunch of different impersonators there.
Like, what was, what was it like behind the scenes?
Yeah, so I'd love to say that it was like big huge party back
there. It wasn't, It was pretty again,
early hangover slot like. So if I probably had like a
later slot, you know, maybe the Rat Pack would have came by.
But no, like backstage before me and the Green Room and my media
team that I bought and then walking back off stage.
It was literally was Ian in the next panel that was behind me.
And then that was it, right? You know, just kind of walked
off and took my headset and was like, yeah, great job and move.
We got to get to the next thing. So it was very much kind of
like, you know, kind of moving on to the next thing.
But it was very, I knew it was special from the reaction that I
got from everybody afterwards, like the rest of the day, just
kind of coming up to me telling me how much they enjoyed it.
And it's your earlier question of what it was about.
The main premise was just looking at the future of
Identity and Web Three and the promise that.
Web three kind of brings to us and and the questions we have to
kind of start asking and looking at what this means is we start
to kind of develop this technology and that it's, you
know, I believe it's a pivotal technology.
And the fact that it's one of those things that really forces
us to to look back at things that question the decisions
we've made maybe 20 years ago And is this still the case if we
build this new identity, if it's truly decentralized and
connected, like how do we rethink some of these use cases
that we've just known. This is how you do it for, for
years now and some of the implications that it has right I
touched on. You know what this means is we
look at this technology, we're already starting to see some of
it roll out a digital driver's license and then how it affects
it. We've kind of created this
technology term and access to it is kind of risen with it like we
do. A lot of the technology that's
talking about especially around these centralized identity is
built around, you know, like Apple iPhones and Samsung phones
and these things, these things are expensive.
These are $1000, you know phones, right.
And and we count ourselves very privileged in the fact that
yeah, we can afford these, but the average person can.
And so if we're, if we're looking to build.
A new kind of wave of this quickly identity and and make
this stuff more accessible. We also have to think about what
kind of barriers of entry are we creating there right.
Yes. It's it's not like I love my
iPhone. I will never leave.
I I can live through this thing. Right.
I I love it. Right.
And so but that's me, right. That's not like the average
person. So we just need to we need to be
aware of those things and make sure that you know this this is
a chance for us to build a technology that truly is
revolutionary and we just need to make sure that we're thinking
about all of. It.
Yeah, I think it's, you know, just in what you're talking
about with doing the keynote, I would have been nervous as hell.
There's no way I could have gotten through that.
But you did a fantastic job. You also did EIC this year,
right? You got up and did a speech
there. Not this year, but I've done EIC
in in years before, but not this past year.
What was that like? Was that pretty cool?
That was. It was fantastic and and the
reason. So for two reasons.
Number one, I mean I love talking about identity and at
the time I was I was still at some point So me and Mike Kaiser
who was the ivory to my Ebony, we used to always just be
running to do an example. So we actually gave a talk
together at EIC. But it was in Munich.
It was a great time connected with people out there.
I love the European identity community but it was special for
me because I got to just take my mom.
And that was the first time she had ever left the left the
country. So took her to Germany.
We went, got a chance to see some of the sites.
Did a train ride out to Prague, like all this kind of stuff.
And then she, I don't think she would want to come to the
conference. So then she comes to the
conference and she's like walking around and like learning
different stuff about identity that she would have talked to
like Pam and like hanging out with the women in identity.
And it was just hilarious like, and my mom's like olding up to
where like this. A lot of this stuff for her is
just like this is. This is the sci-fi stuff, right,
that they used to talk about. She's just saying, but she had a
blast and it was great. And that she fell in love with
European coffee to the point now where like I have to import like
German coffee for her because, you know, apparently American
coffee is horrible. I don't.
I'm not a coffee drinker so I y'all taste like dirt to me, so
oh. Man, that's that's rough.
I know Jeff's in the same camp I'm from the camp of.
By the way, I love this is one of the things I wanted to talk
about in the like my prediction for the future is that Coke 0 or
any kind of 0 soft drink goes off the charts because I think
Diet Coke, Diet Pepsi. Anything with aspartame in it?
Just, I feel like it kind of already has, though.
I mean, you couldn't get Coke 0 during the pandemic.
I mean, everyone has had it like it was.
Yeah, but like from a restaurant, you're right.
Like you go into a supermarket or grocery store, it's zero.
But if you go into a restaurant, you order a Jack and Coke,
they're like, well, are you say, do you have Coke?
Zero. We have Diet Coke.
It's like, that's not. Yeah, and then you put like the
crossing. Get that away from me.
Yeah. No, no, no.
McDonald's has Coke Zero I discovered recently, so.
Progress is being made in the soda industry, so thank you for
that over. In humanity.
In humanity.
So. David, any more conferences for
you this year? No, that's it.
I am. I'm tapped out this year.
I thought about going to Octane, but you know what?
It's a lot different going to these conferences.
When you gotta, you gotta pick the budget for it.
So I'm like, I'm good. Yeah, especially when they're
like downtown San Fran and the hotel rooms are like 400 a
night. Yeah.
For pretty basic so, but man, you've got so much going on.
We saw that you wrote a book recently.
Want to know, you know, what's it called, what's it about, and
then what made you write it? Because that's a lot of work.
So the name of the book is the only one in the room.
The unwritten rules of being black and tech and.
What made me write it? I'll give you.
I'll do the the short story of it because it is.
It's a pretty long story. But I decided to write it right
after I left Amazon. So I was at Amazon.
I served 10 months at Amazon institution, I mean.
I was served. Thank you for your service.
I was. I was let out for good behavior
and coming out of there I, you know there was a lot of things
that. I I kind of saw both at Amazon
and just in general that I was like you know what this is
there's a there's a kind of dark underside detective and I don't
think we talk about enough. And yeah there have been we've
been having debates and discussions about diversity
equity, inclusion and things of that nature and that's been
okay. It's been progress I guess 0 to
one is progress like to see more but it just kind of hate me
coming after that that I was like hey this is.
I think this is something that I that I really want to talk
about. And I looked at like my
experience and what my career had been like and the things
that I have learned. And, you know, for me is the
journey that I've been on. You know, I grew up in Los
Angeles, just outside of Los Angeles, and then I kind of went
to school in the inland, imperative suburbs.
But at the time that I grew up, you know, statistics, you know,
for, you know, people of, of my age group, like as a black male,
I was supposed to be dead or in jail by the age of 17.
That was that was a statistic I was like 67% likely like this is
going to happen. Like it was very low statistics
that anybody actually made it on did anything.
And so that's something that just kind of stuck with me When
I remember hearing that when I was younger and you know to kind
of go from that to things that I've been able to accomplish.
The stages I've spoken on countries I've been able to
visit friends I've been able to do, the lifestyle I've been able
to live looks like there's. It's been pretty cool and and
there's I want to see more people you know like that to
come into this this field but there's a lot of things that
kind of people just don't tell you about that I I said okay if
I could do it all over again. I went back in time and I
grabbed my 19 year old self like what would I tell him and what I
tell him to look out for. And that's kind of what led me
to started writing some of this stuff down and it was it was a
very interesting journey. I will say you know for me I I
love to write. I love to write and read.
Sorry Jim so. Writing the actual book wasn't
wasn't the hard part. Like that actually kind of took
maybe about three or four months.
The whole process took me about three years.
And a lot of that was just mental.
Like, I'm gonna write a book like, what are people gonna
think? Like, man, I'm not some super
famous guy like this guy writing the book.
And then like the title and the subject.
I'm like, man, people are gonna get all crazy.
I'm like, but I'm the type of person I'm very like.
I'm always in front about everything.
Let's let's if there's a problem, let's go tackle it
together. And I think part of the problem
why this thing still exists and we deal with all these issues
because we don't want to talk about it and we want to kind of,
you know, tiptoe around it and like, yeah, we want to be
cognizant of everybody's feelings.
But like, you've got to talk about things that put on the
open, otherwise they'll never change.
And so it was fighting a lot of that just kind of like, man, I
don't know. And and and I I've got a lot.
I've got all kinds of things multicultural all over the
place. And so I knew that this book.
Could kind of One could inspire a lot of people, which it has
done, and I've loved the support of them from that.
But I also wanted to be very clear that I didn't want to
write it in like to make anybody else feel bad or or or hurt
anybody's feelings or pissing anybody off.
But I had to get to the point where I was like, well, that's
okay because I'm talking to a specific person.
And so just in how I crafted the writing and the stories that I
was telling to make sure the story was come across, that
really kind of took a while. A lot of the editing process and
they're just kind of getting through, you know, imposter
syndrome and like do I really want to do this?
Finally just said, you know what?
I've. Than everything else.
Why not? We'll see what happens.
Yeah, I mean, it seems like you you've wrote something about
your lived experience. I think it's one of those things
probably you're probably the most qualified person in the
world when you're writing about your own lived experience,
right? Yeah.
Question for you who should read the book.
Come on, I'm an author. Whatever, everybody should read.
The book is for everyone. But OK, but specifically, right?
The marketing term coming up right The avatar that I created
this book for all my marketing out there will will love that.
The ICP if you will. But I I literally wrote this for
as a love letter and all sense of the word to a young you know
you know black professional looking to get into the
technical space. Like somebody who's just now
coming out of college and maybe get into college and saying hey,
I kind of wanted them in tech but I don't know because I don't
really see a lot of people that look like me which.
That is a very real thing. And then that applies to
anybody. Like if anybody looks at
something and you don't see anything that you can relate to,
it makes it even harder for you to think that you can do that.
And so specifically, that's who I aimed it at.
Like, hey, like this is, this is what I've learned and this is
what I've seen in news and things, right.
So that specifically is what I wrote it for.
But in that case, a lot of the things that I talk about, the
stories that I tell, like, I got a lot of feedback and people was
like, yeah, this can apply to anything.
I was like, yeah, I know. Right.
It there's the secret to a lot of this stuff is hey, when you
really look at it, we're all the same and we kind of want the
same things. It's like we just have to get
outside of ourselves for just enough to realize that hey, when
we get past everything else and we just connect on a human human
basis, wow, Like a lot of the stuff applies to all of us.
But there's a lot of things that just unspoken there.
So short story is I would say young, black, professional
looking at good new tactics. It's really it's for them.
But outside of that anybody could take something from that
and read it and. I wouldn't.
I would encourage like either managers or executives who are
looking at it and say hey, we're struggling with diversity here
to read it and understand like again this is 1 person's
viewpoint, but it kind of gives you some kind of purview into
like okay. Maybe This is why.
Maybe some some of my black employees, maybe they feel this
way okay. Maybe we can start working with
our DII to start addressing some of these things and see if we
can make this easier. So in that case, that's what I'm
saying. I would say anybody read it.
If you've just been curious, someone understand.
I think it's a great one, but. We're going to pick your brain.
We have David Lee, Identity, Jedi, and heck, we all love Star
Trek. So make sense.
That's that's our subscriber should.
I. Cancel subscription I mean.
Don't disconnect them. I might hang out myself and I'm
the host. I'm trying to be funny.
All right. Anyway, so I TDR we knew.
You're hot on that. Explain what is ITDR and what
excites you about it? All right.
So Star Wars, first of all because that come on now we got
to make sure we track that here come the track keys anyway.
But I TDR, identity, threat detection and response, I am
hugely high and excited about this.
And and there's the main reason why is that when you break down
what that means, right. So identity threat detection and
response okay. So it's this growing kind of
market space of looking at. Threats that that apply to
identities and how do we detect those threats and respond to it.
And it's still kind of early on in its quote UN quote market
phases. We've got a couple of different
companies out there that are looking at this area optimized
or we just get recently acquired that are all looking at this.
And the the concept behind it which gets me excited is that we
we finally started taking a step in identity where if you have to
if you take a step back and say when identity quote UN quote
kind of first started, we looked at it and said it was a huge
administration problem, right. The administrators were
screaming, listen, I can't tell you how many accounts I create.
I just don't create the accounts.
I don't know where they are. I don't know who has access.
What are you talking about? I don't know.
And so when we started this, we just said, okay, we just need to
get a handle around this. Let's let's create and automate
things around this administrative burden of
understanding where all my identities are.
What do they have access to? What are things that are driving
that access? And how do we manage this
process of making sure we understand how we're giving
access to everybody and what that does.
That's been the last. But seniors, great, We've done
that. Cool.
But we also wanted to start saying, hey, I'm going to use
part of security and that we've given talks.
Like if we look at the kill chain, if Identity Access
Management Control was involved, then a lot of the security
preachers would have been stopped.
We could have prevented them, but this whole time, identities
just kind of been on the background.
It's like, hey, we're just a submission of the thing.
We're we're not actively in the fight.
We're just like, hey, well, we did everything we're supposed to
do and set it up the right way. And after that we're out of it.
I TDR kind of moves identity more towards that security
operations standpoint. It's like Okay, great.
Well, here are these threats that are coming in and So what
do we do with that? We can see that Okay out of your
100 users, 67 of them don't have MFA configured and we know how
important MFA is. So what do we do about that Or
we're detecting things that are like maybe misconfiguration in
your a WS environments, Okay, these persons shouldn't have
this much access. What do we do without that And
more specifically what I would like to see is this as this kind
of continues to go is. What are we seeing around the
threatening identity like just like security thinks about okay.
I'm going to pretend like whatever I did nothing worked.
How do I stop you from getting it?
How do I prevent that zero day when you get into, when you
break into an application from spreading, how do I protect
that? The same thing we have to do
with identity Okay. So day one it starts.
We we put everything in place but let's say something didn't
work the right way. Some guy did get in and now they
want to go and get access to you know the admin accounts are
creating things. What do we do to make sure that
doesn't happen? And that to me is a much more
active conversation and involvement.
We've got all this great data in context within Identity Systems
and we have all these controls that we can now start to
automate and make sure they're a part of it.
Because if you look at it just simply as simple as taking your
IM system, right. So let's, I'll be very close.
Let's look at your SSO system. So you've got everything set up
for SSO, let's connect that to your IGA system and say okay, we
know how we're going to provision things and what they
need to be and. We had a separation of duties
and policies. Great.
And that matches my SSO. Now tie that with your IGM
system and then sorry your Pam system for when somebody wants
to go get access to a privilege access account.
All three of those are talking and connected.
Then at any given time if anything gets out of whack, the
three of those are kind of working in in conjunction to
make sure that doesn't happen. That's really just if you look
at the core, but that's ITDR right okay like here's how we're
going to apply these things to make sure responded to the
threat so. That to me, and I've always
wanted identity to have a much more active say in security
conversations. And so that's what excites me
about it. It's the type of conversations
and what you're bringing to identity teams.
And as they're now talking to security teams and saying, hey,
we're sending you not only telemetry data, but there's
things that we're seeing that we can start doing.
How can we work with you as you guys are tracking down incidents
and you're stopping things from coming in.
Let's make sure we're sharing with you how that's connected to
any identity, right? So if somebody gets breaching,
gets to the server, hey, we can tell you, here's everybody that
has access to the server, how they have access to these groups
and here's how the provisions ain't no problem, we can do
responses on our side to make sure that, hey, even though we
didn't stop them getting known and they got to the database
server, like we can really quickly mitigate like how far
they can get. So I feel like and tell me if
this is fair, but I've said this before in previous episodes that
I feel like I TDR is sort of UBA.
UEBA, the user behavior analysis, User and entity
behavior analysis of like a decade ago and is that one, is
that fair And two why do you think that is?
Is it because we have more maturity when it comes to
identity within enterprises where thou that data is actually
available and now we can actually do stuff?
With it. So I would say it's the.
The only thing that would different with you sort of say,
I would say it's the concept of what we wanted to do with UEVA
from a decade ago, right. The whole reason why we wanted
to understand activity of the user so we could know and have a
better understanding of okay, here's this access.
But like what are you really doing with it, right?
Because with Identity so far, we knew how to model the access and
say here you go, okay, great, you're going to have these
things. What does that mean?
What do you do with it? Like how how much do you access
this? And when you log into it, how
long are you logging in? And so that was what we're
trying to do with UVA and I. The, the second part of the
answer is like why, why now and why didn't it work then?
I don't think it's the data that we have now is the same amount
of data we had back then. I think connectivity is a little
better, right. More standards is coming in and
so we can connect, it's easier to connect to these different
applications and kind of send data across.
I think that has improved. But I also think honestly think
it's a mindset from a maturity standpoint, a customer has
gotten a little bit more advanced and smarter and
understanding without it's right for identity for the longest
time. We were dragging the customer to
understand what the value was and kind of getting them there
and all they wanted to do was pass their audits and make sure
people could single song like I'm done, right.
They just they didn't really want to dig in and see the value
of all the other things. I think we we passed that mark.
We're only dragging the customer.
The customer gets it, the got it.
And we understand yes my audits, but like also there's other
things that I can be doing here Okay and now that they're ready
to kind of have those conversations and customers are
leading those conversations. Now I think that's why it's,
it's starting to hit it home a little bit more, right, because
we can kind of use this and say like we can actually start
putting this into action and doing some things.
And so yeah, I I think it's going to be interesting to see
how those, some of those, you know UEBA kind of vendors from
the past like I'm really surprised they haven't jumped
all over this, right, because they they kind of already have
set up the interesting things to do.
So we'll it'll be interesting to see if we start to hear them
talk about this in the next, you know coming months.
You know, I can't. I've said this before on past
episodes, and I think this is the next major thing in
identity, because we always thought of identity as who has
access to what. But I think it's then and what
are they doing with it? And you see this in the Kim
space, right, where it's like we're trying to remove any
unnecessary privileges, so we get to at least privilege.
So give an account these roles. Have they used those roles?
If not? Remove those roles.
I think it's, if you can apply that to your entire identity
infrastructure that takes a ton of data and a ton of ability to
process data. I don't think we're there yet.
But to me, like that was the promise of the UBA.
I just think that it was based on a reality that isn't reality,
right. We don't have all those logs
available. We can't process big data in
that way with the tools we have. So let's pivot, because I want
to talk about what's happening in this, this old piece of
technology called Azure Active Directory.
We've got this new thing called Microsoft Entra.
I mean, for, you know, for veterans of the industry who
have been around since Azure Active Directory was around,
we've now got this thing called Microsoft Entra.
What is Microsoft doing with Entra?
So what I hope they're doing is. Finally figuring out that, hey,
we're Microsoft and we've got every single connection point to
kind of create this nice comprehensive solution for truly
managing access within the environment, like from something
else, like we can kind of do it all.
I think they're trying to lean into that.
The reason I'm hesitant is because it's this isn't the
first time that they've done that.
Like, this is like the fifth or sixth time we've seen them kind
of, like get something rebranded, hey, and we're like,
oh wait, Microsoft's finally getting it.
And then we're like, no, right, No.
Someone is like a template. Right.
Find and replace old name, put new name.
There's like no new functionality.
So for people who aren't aware, like Microsoft just recently
announced as of time recording that now there's this thing
called Microsoft Entra and the idea is that it's basically just
a name change. For Azure Active Directory,
which OK, fine, you know, whatever.
I can understand the confusion. When you say AD, the next
question is, well, what do you mean is it you're on Prime AD or
Azure AD, OK, that'll help, but AD is AD and now you've got
Microsoft Entra. So is that me?
And now I think of is that Windows me the not well.
Received. Windows that was out there.
So yeah, I mean, right now it seems to me as I kind of, you
know, I don't have any inside information, but.
I read articles just like everyone else does and it just
seems like a name change and that's it.
So it's a name change, but also it is unfolding the work that
they've been doing with their verifiable credential work that
they've been doing, a lot of things they've been doing around
like their activity protection services that has always kind of
been there, but they're trying to highlight that a little bit
more. So and that's why I'm hesitating
cuz, yeah. They, they made this big press
release and it's like, oh, it's now this and it's a name chain.
It's like, all right, but you didn't.
And now we're including all these things like.
So the stuff that you already had that's kind of been there,
you're not including. It's all intra great what I'm
waiting to see next and it could be out there.
So if this is out there, who are Microsoft lovers out there?
And it's like there's this blog right now, we'll talk about, I'm
sorry, I haven't already yet, but there could be data out
there. What I wanted to see from there
was like okay, This is what we see within the Microsoft Intra,
you know, network, whatever they're going to call it.
Like, here's how you connect all these dots and make this happen.
But they've had it for such a long time, right?
So I'm cautiously optimistic that maybe we'll see some of
that coming out. I do know that it's done enough,
right, that I've talked to a couple of friends of mine who
are also consultants and kind of talking to customers where it's
causing customers to do a pause and say, hey, well, let's maybe
in this side box, let's see what Microsoft has to do there.
Because I mean. They've always had the most
compelling use case to make it to anybody, right?
It's like okay. Well, why go buy anything when I
can? I got outlook, I use the, I got
a DI got all this stuff. I'm just going to stay right
here. And if you tell me that I can
package all that into an E5 or E6 or whatever license, I mean
procurement just got easier like manual just got easier like
everything just right there. And I know a couple of
organizations that are that are just there die, they're going to
do that. But it's just Microsoft was
never delivered on the rest of the features, right.
They just they've never really either.
I don't wanna say they didn't care about identity, but it
didn't seem like it. They just they don't seem to dig
to dive deep into identity. They just say hey e-mail will do
protection will do. This will be great cool like.
They. Tried governance for 10 years
and just can't get right. They have good solutions and
it's like most things, right? Once you follow the sweet spot
of Microsoft, typically that's where the cracks start to show
through and it's a very captive audience.
It's the same question that I always get as well.
Why would you buy something else if you're looking at
authentication and you're already a 365 customer?
You're already paying for it. Probably quick side note,
because I know we're going to talk about AI a little bit
later, but I don't know if you saw recently the pricing that
they've announced for Microsoft Copilot.
They want to basically double the price of licensing.
It's another $30 per user per month to use all the AI features
they've been developing. So this is quickly going to
become a very expensive space and I'm sure you know they'll
make money off it just like anything else.
But yeah, it is not cheap to operate in the cloud.
Interesting. Yeah.
I was just wondering like if Microsoft can deliver on the
governance. I I agree with everything David
said, everything you said, Jeff, if they do deliver, do they run
the table? I think the answer is probably
no, they don't probably run the table.
But I think would be great though is if the features that
make up governance now become available to the lower middle
market small businesses that basically can't afford identity
governance at this point. And I wonder if it's like air
conditioning, right? Used to be a luxury item and
then it got cheaper and cheaper and came down like, you know, I,
my first car had roll windows, You know, now when you say I'm
going to roll my window down and was like, you're really just
pushing a button. But hey, we're old school.
We know what we're talking about, right?
So maybe at some point, yeah, there is that kind of trickle
down. Let's move on because I want to
talk about Thanos, I mean, to my Bravo and all of the identity
companies that they are collecting into their Infinity
Gauntlet. What?
What do you think? Like what's going on with Tomo
Bravo? Is it truly an Infinity Gauntlet
situation or do you see it more of a Pokémon situation where
they have a bunch? Of you guys talking about, I
don't even know what these things are.
Nerds talking, Jim, just just go back on you what?
Podcast Am I on? What do you think, David?
So I'm going with my I'm going with my, my, my initial gut
instinct, which I think it's much more.
Of a Danos Infinity Gauntlet thing.
Although I've I've made the case that it could be just a Pokémon
of a I just want to catch. I just wanted I'm just going to
grab up all of these and get as as much get them as efficient
and as profitable as possible and I'll see which one wins,
right? And guess what?
Like I've got all of them and the time they bought them I
bought them at a discount. So either way I kind of win.
But I really think though and and the reason why I think it's
more than the Infinity Gauntlet is because.
Of an interview that they put out on a podcast was it was I'm
going to it was one of the main partners and I I don't remember
saying well I must say wrong and he talked about their whole
process with sell Point and why they came back and bought sell
point again and how much they learned about the identity
security market from working with sell Point.
Sell Point was their first venture into that market.
It was super successful. Then they took him out IPO.
And so they wanted, they saw like growth again, they want to
come back in. And so listen, investors don't
make money by not being greedy like you know what I mean?
So it's like they're looking at this and going, OK, well, how we
did it, oh boy, man, rest of these are kind of on sale right
now. Let's go gobble them up and do
something again. And and now they're much more
attuned to where the market is going.
So the shortage of the way I think they're doing is I do
think they're going to look at this and and have this different
technology and pay attention to over the next five years where's
this market going to go. And I've got enough IP that A,
if I need to put together my quote, UN quote Infinity dollar
and create an identity security platform, I've got all the
pieces to do it right. It'll be ugly like.
And I mean ugly from like how they're going to have to do it
like okay, we're going to chop this and have chop this and have
you go over here like it's not going to be pretty what what
comes out of that thing from what they're going to have to
cut to go do it. But they have the assets, they
actually go do it. And so I just think that when we
look at these PE firms, right, you're talking.
At minimum, 7 to 10X is what they're looking for.
Like that's the only return that I can see for them doing that.
I don't see them taking these companies and holding them and
go, we're just going to turn in the cash cows or just hold them
okay. But that's not what you do like
you look for big returns, right. So I do think at some point
we're going to start seeing everybody to the opinion sell
point that kind of makes the most sense because their
customer bases are similar. But I think what they're waiting
to see is how this next kind of technology term of what happens
over the next two years and where they need to augment that
with, right. I don't know, I haven't.
I stopped following for a while. I know there's some things with
Ford Rock that I haven't quite closed yet, but at some point
that'll close what they're missing from there.
And and and this is what I would say you, you definitely know
they're going towards Infinity outlet, look at their next
purchase, right, if they purchase something either in.
Let's say cuz they get orchestration with with Ping and
Da Vinci and they get some Ford like if they look at something
more towards the security space, something like a a Kim
management or even like they go by one of these like smaller
IGDR companies. If you see a purchase of their
that, that's typically and that's exactly where they're
going, right? Like so it's their next kind of
one or two purchases for me that are going to like really tip the
head of where they're going. Because they've made this
person, they've kind of done silent, which I mean, look, they
just spent what, what was it like, $14 billion?
I'm like, all right, look, there's a lot of money.
You bought a lot of things. Go play with your toys.
But there is they're building something.
I just, it just doesn't. I can't see them.
Not like what? Why do you get into P/E?
How do you get it to nuts off all of it if you don't comply
with something and say, I can take this and then put it out
and tell it is that much more? That's the only possible path I
see. Interesting conversation.
I I didn't know what an Infinity Gauntlet was or Athano's, but I
kind of figured out what you guys are talking about.
It's like. We'll get off your don't worry
about it. That's right.
They're going to get, they're going to get their money because
that my analogy was they bought 3 super cars and they could kind
of like take the best of each car and like build one really
super, super car or. They could just keep the three
cars, wait a little while and sell them for more money than
they paid. Either way, they probably win.
So I don't think nobody's going to get on on a podcast and say,
like, hey, I'm from home row and this is what we're doing.
So we're all just sitting here like, you know, thinking about
like, okay, what might we do if we were playing with billions of
dollars of identity companies? I'd probably challenge another
billionaire to a wrestling match or page matches.
That's just me. Hey, that's just me.
I don't know, you know? So, so David, do you have a
winner in that in that UFC fight between Zuck and Elon?
Look, man, I I do. And it and it and it changed
just recently. And I'm gonna tell you what
changed. What did you saw that picture?
Yeah buddy, cuz like Israel, I can never pronounce his last
name like. That dude's no joke, right?
Like, so if you were, and it could have just been a promotion
picture. But like, dude, I'm looking at
like, dude shredding. Like, if you did any kind of
training at all with these guys, like, just kept up with them for
a practice round. I'm like, dude, that's.
And Elon, I'm with you, man. His workout routine is reaching
for the next, so I. I think that exactly right.
You see, like the stats of Elon's taller, he's kind of got
a little bit of attitude, but Zack just looks like a fighter.
I I didn't think that. Like when you see him with his
clothes on, he just looks like Joe Average.
But man, that guy's ready to fight.
Next question. So you know, thinking of the IGA
space seems pretty clear. Yeah, sailplane and savient,
they're wanting to. Who in your mind is #3?
And obviously we had the whole Microsoft conversation, so don't
we sure answer by using them. But who do you think might shake
it up? So I I don't think there's a
clear number three. I think once, once after you
leave those two, it comes down to like you know, customer size,
profits and things like that and there's a number of them that
you can look at. What I will say is like who I
think has the potential to really shake it up to be honest
is is Octa and I don't know if they will or not.
But they but they have a chance. Their IGA product has been, it's
been interesting and also like almost two years ago now and I
still haven't really seen much from it.
But their ability of what they're going to be able to do
from a perspective of not only from with their IGA, their
access certifications. They'll they'll automatically
have like activity and usage data.
Like they'll be able to give you a much deeper understanding of
not only what Access is, but how it's being used and kind of more
closer real time. And I think it's going to be a
game changer for a lot of people.
I I like some kind of up and comers.
Visa is a company that assembled across a couple of weeks ago.
I kind of really like what they're doing and how they're
going after it. Zilla security what's the I can
I can see the other company actually it's going to kill me
because we talk about it all the time.
There's another one you would test there we go and you would
test is another one like there's these nice little kind of small.
Smaller companies that are that are a lot more focused and
they're focusing on making sure that from an IGA perspective
kind of have me focus on access search.
So I'm like okay, there's more to it than that.
But that's that's the hairiest part.
With an IGA product like if you ever implemented it like those
are things that just take forever.
They're fact, they're really focused on automating that and
making that easier. So I think you've got a handful
of players there once you pass like save it that you can tend
to choose from, you kind of pull together.
But I if I had to put my money on something, I was like I just
got the biggest chance to really kind of shake up that market
because they can quickly give you kind of like what you know a
Gardner kind of calls a converged I AM right.
They've got enough pieces to quickly put that together and
get you a good offering for that.
And they don't like, it's like they don't have to do much to
get it there right, like their IGA product doesn't have to be
stellar, it just has to be functional.
And they've got everything else they're going to make it happen.
So it's so it's surprising me to see that that just hasn't taken
off. So I'm, I'm watching that one.
We're kind of made it graph to see how they come out.
That's what's, yeah, that's a really cool answer and it's
interesting. I was bouncing back to the
Cooper Coal IGA, what they call it, the market Compass from last
year and they didn't even list doctor, which I thought, you
know, if there was a gap in their list, that's it because.
I agree with you. They've been at the the IGA
project for a while and they could really shake up the game.
So yeah, I'd like that answer. Last thing, which of these
technologies are you the hottest on Kim, which we talked about is
like Pam 2.0 around here, Identity verification or
decentralized identity? Decentralized identity by far
like I think it's it's got the potential to completely reshape.
How we look at identity and then how we look at identity, how we
use it from a daytoday basis, from workforce like all the way
down to like everyday person like it's just got a huge range
of impact that it can have. And so to me it's it's the one
thing that I, I follow and check up on the most because it's
it's, it's interesting to me it's it's really that cool kind
of scifi thing that you know I won't say everybody but like me
when I would look at some knowledge and stuff like that
when we see these. You know look at Minority
Report, right. The people used to trip out
about that and the things you can do and like these kind of
advertising that you would see that would target people and
things of that nature and we kind of saw them American.
But like I used to always think about Minority Minority Report
like how how far it seemed from a technical logical advancement.
I look at these centralized, I did it in some of the use cases
we were talking about like and the fact that we basically walk
around with supercomputers in our pocket now like it's.
It really it has the chance to make like the biggest impact,
right? All the way down to like how we,
how we purchase food, how we, you know, get transit.
Like you can do all of this stuff in carrier identity with
you and really protect it like that.
I don't know that that's game changing, right?
And if we can get it down to where it's, we could get it to a
device that anybody can get access to and carry, right?
Now what does that look like, right?
Like, what are those interactions look like?
So it's it's both interesting and scary at the same time,
right? Like I do see a world where that
kind of gets away from us, but by far to me, that's that's the
most one that I'm interested. In whenever I think about the
decentralized identity, my mind goes to the mobile driver's
licenses and I think to myself if 10 years from now we're still
carrying around plastic cards. Or paper passports or whatever
like that. It's going to be really
disappointing. I'm not saying that in 10 years
will be fully realized where every credential is completely
electronic 20 years from now. I think so.
But you know I it is kind of hard to see the vision of going
from where we are today to that 10 year vision.
But I feel like it's got, it's just got to happen.
I'm with you. I think it does too.
It's how do we do it responsibly?
Right. Like we I'm going to be, I'm
going to be very careful because like this topic gets into so
many different things, right. Like I'll just say this, the US
doesn't have a great history when it comes to the tracking of
individuals, right? Like you start going down that
history path, they're like, oh this is that's not good and and
so that's the question. It's like yes, we want to be
able to have that from the convenience but to really do
that that means. We've got to get a device that
we can, something that we can now get to anybody and everybody
that can have some kind of credential on it, right?
And we've got to do that responsibly so everybody can
have it and then give them the ability to share what data they
want. But as we've seen, it's the
question what happens on the other side of that, How much
then is other people able to track and use that data?
And that's where we got to be really careful because we've
already seen with, you know, the whole Facebook, Cambridge
scandal and everything we've seen over the last, you know,
decade. When there's a regulation around
data, like, we will just do stupid things with it because we
can, right? And so that's the biggest thing
about it. I think that's going to, that's
going to, that's going to add to the length of time of what it
takes to get there is how do we do this responsibly?
We we want people to have it. And yes, it it makes it not only
convenient, but it's more efficient and it's sometimes
like safer, right? And that's awesome.
But how do we make sure we do that responsibly?
How do we think about the things?
Just lessons that we've already learned, right?
I always go back to the Jurassic Park, you know, right?
Like we all suffer the same thing.
We're quick to see whether we can something, but we never
started to think. Should we do this right and
that? Is an awesome comment and I
think, you know, we could sit here and debate because that
that's a rabbit hole. That is a rabbit hole.
Well, let's go ahead and and wrap up with a I because it
wouldn't be an episode without some a I at the center talk.
Where do you see a I taking? You know the identity space.
I think it I think it helps transforming to its next kind of
state. I had this conversations at RSAI
think with so I I got to back up with this concept when I first
saw what everything what chat GP Jack's chat GPD was doing and I
saw these LOAS and generative a I I didn't get excited about oh
chat GP can write A blog for me say no no what this tells me is
that. The underlying components of it,
right? To be able to build the data
sets, to train models, have gotten to a point where you can
actually develop applications on top of it quickly.
I was like, that means we've made a huge progression there.
That's awesome, because now that means I can take these things
and start to put them into other things and use them in different
ways, which we've seen since then.
Like everything literally has a I in it now.
Freaking Google Dash. Just roll something out right,
Like so. Having said that.
Where I see AI coming in is that we can, we can start to look at
that and imply that there's a lot of things that we do in
identity that are just inefficient because they're
administrative heavy, that can easily be automated, that you
can give to a training model and say, oh, this is how this works,
I know how to do this, no problem, take it there.
So what I see is things like access reviews I see actually
use being the thing of the past, I think between activity data
using a. An, A, I model to understand
access patterns and relationships that you could
certify in real time, like what Access somebody has, turn around
with like a digital signature to sign it.
And you can even pass out to otters and go like, yeah, I
don't need to run an Access view.
I can literally tell you here is what the Access that people have
today, here's what they're approved to have, and here's how
we're making sure they always kind of have that.
And so I think there's going to be certain things like that that
just get completely wiped out, like you no longer need to do
them. So that's what I look at for AI
as we start to look at this and learn and understand more about
the data and what we can do with these data and build these
models. I see things like that just kind
of completely transforming those features and making them
something that is not. It's an afterthought, It's like
it's just kind of something we do.
Yeah, I agree with that. I mean, it's exciting to see the
advances. I'm bullish on it, but we've got
to make sure that we do it right and.
We've talked about, like the statement.
I remember who it was. But it's like, you know, now
with 50% more a I, right. This identity tool, it's like,
OK, well, well, you know, great, cool.
You know, my definition of it changed when we saw things like
ChatGPT come out, was like, wow. And now I use it a lot.
I mean, it's a great starting point, but it also lies a lot.
You know, it hallucinates whatever, you know, whatever
term you want to use for providing, you know, not factual
data, right. Those are the things that I
think we need to keep an eye out for.
But it'll get better. That's the that's the bright
side, right? This is the worst that it will
ever be, and it's pretty darn good.
But, and here's the also thing about it, right?
This is, to me, this is the this is brought to life.
In saying that, we always say garbage in, garbage out.
You're literally seeing it, right?
So people complain about, oh does this or whatever it was
like, it's trained on this like it's only going to come up with
the data that you give it. So if you want to complain, oh,
it's biased because data is biased.
Oh, it's this because it's the data you gave it.
Like, it's not going to magically make things better.
It's just when you look at machine learning in general,
it's like it can consume mass amounts of data faster than the
human brain. That's the whole purpose.
Great. All right, cool.
Do all this for me and then show me the patterns, right.
If you don't like the patterns that it shows you, it's because
you got to go look at the data that you're giving it.
So to your point about that, it will get better because as we
start to, we want to use and do more, we're going to have to
learn okay. How do we?
We need to make sure that we're getting the data that we want
and we're getting more about asking our questions about the
data, doing better, about making sure that our our systems are
actually creating the data that we want, right?
Another rabbit that we can get into.
But I'll just say with this, like something as specific as
like looking at your identity system, like what are the audit
records that you're writing? Most of the sounds are very
customizable and nobody touches them, right?
So like, you could literally say okay.
Well, if I can customize my audit records and say here's the
things I want to audit every single time.
Now I'm giving it much more data that guess what?
Then I can start building patterns off of and doing
models. So it's things like that.
As we start to learn and understand it, that then it will
start to get better. We just have to, you know, dig
it and do what? All right, well, we've got David
Lee, the identity in Jedi, so we're gonna end on a lightsaber
note. So what I wanna understand from
you, David, is what color is your identity, Jedi lightsaber.
OK, so. And I hope it's not the same as
mine. We'll find out.
Mine is white and I got to get the story of why it's right.
This is for all the Star Wars in there.
So Jim, you're not going to like this.
I'm sorry. Before it, it was purple, right?
Because I loved Ms. Swindoo. He was like one of my favorite
characters. I was like, yes, that is that is
the color that I will go for it. And then I finally got into
Rebels and like I watched all of that in.
When I saw kind of a soca's timeline, I agreed so much with
the soca that I was like, Nope, that is kind of where I would
go. White lightsaber all the way.
All right, So white is kind of traditionally seen as like
purity, peace, positivity, neutrality, kind of that Gray
Jedi potential, right? I think more on the side of.
You know, not seeking conflict. You're right.
That kind of thing. So I'm surprised that you said
white, because I thought for sure you gonna be seeing me,
because mine is definitely purple.
I I am a Gray Jedi, like through and through.
I will pull from the light side, the dark side.
It doesn't matter. I'm going at it.
Whatever I need to do to get the job done.
Not seeking it out. So I'm not, you know, that that
side of it. But definitely, yeah, Mace
Windu. And then, of course, you know
Samuel Jackson. I mean, come on, man.
That's the way to go. Jim, what's your color of
lightsaber? What color was Yoda?
Yoda was green, I think. Yeah, is that.
Yeah, it's a it's a growth safety harmony.
I've got a little with CHEAT SHEET, I mean.
I like Yoda. So here's the question I had
because I saw someone wearing a tshirt and there's that, I don't
know animal or person that looks like a baby Yoda.
Yeah. Is that baby Yoda?
It's. Groku.
Yeah. Is that the same person?
It's the same what race or creatures or whatever species.
That's what I was looking for, yeah, yeah.
Is that a Jedi we? Don't know yet, yeah.
They're definitely force sensitive.
The midichlorians are going crazy on that kid I.
Don't know. Jim doesn't even know what
questions to ask. He's like.
Well, just pick a color. Like what was the card again?
He just makes it so that's all he does.
I'm going to go. I got to go Yoda.
I go green. All right.
Growth. Safety, Harmony.
All right, all right. This has been a fun
conversation. David, thank you so much for
joining us. We're going to have a whole
bunch of links in our show notes, you know, for you, for
people to connect with you on LinkedIn, we'll have a link to
your book, which just came out a month ago, which is very
exciting. Good times.
The only one in the room, the unwritten rules of being black
and tech. So definitely check that out.
And of course, the Identity Jedi website.
Sign up for the newsletter. It's cool.
I dig it. I like the style.
It's totally up my speed. So well done.
Congratulations. Hopefully you'll come back and
join us. Hopefully we will have you come
live on a show when we're next time we're at a conference
together or something like that, and maybe Ian will assault you
while you're on the microphone. Next time, just to make it even.
Make it fair. Yeah, exactly.
Well, you know, that's that's, you know, fair balance to the
force, right? All that kind of good stuff.
All right, enough Star Star Wars stuff.
We're going to leave it there for this week.
Don't forget to check out our discount code for Authenticate
ID AC15 podcast. Get you 15% off.
Hopefully we'll see a lot of people at Authenticate Friendly
Faces hopefully see a lot of people friendly faces at
Identity Week America also coming up And yeah, we're on the
web, identitythecenter.com. On Twitter IDAC Podcast Mastodon
IDAC podcast at infosec dot exchange.
Still hate the names and the way that works, but whatever.
Connect with us on LinkedIn. Looking for ideas, for show
notes, for I mean for for for future shows.
Questions, right? Things like that.
And connect with David. What I saw today was that David
and I have like 180. Contacts in common.
So yeah, you had. Me beat by almost.
No, I think I have like 111 or something like that.
So we know a lot of the same people or we accept every invite
that comes our way and we don't really filter out whatever it
is. One of the two, Yeah, we'll go
in there like subscribe, share with a friend, share with an
enemy, don't care as long as they're listening.
This all matters to us. So thanks, David, so much for
your time, Jim. Thanks for your time.
And we'll talk with everyone in the next one.
You've been listening to Identity at the Center.
We hope you've enjoyed the show. Make sure to like, rate and
review and we'll be back soon. But in the meantime, hit the
website at identity@thecenter.com and find
us on Twitter at IDAC Podcast. See you next time on Identity at
the Center.