Cybersecurity has always been an apprenticeship, OK?
It's always been an apprenticeship.
It's not a a skill that is just kind of like learned off of
books. Like you work with a lot of
people. I've learned a lot of stuff from
other people. And there's a lot of repeat work
that you do over and over and over again.
And it gets better every time you do it right.
But we don't have but people that are sticking around long
term to be able to cultivate that apprenticeship models
anymore the way that it used to be.
So if we get 2 years here and you've got another year here and
two years over there, it looks like you've got good experience
at very large, reputable firms and you were part of, you know,
their, their cyber team. But if you took that person as
an individual and you said, OK, let's look at your own personal
depth on something, right, related to these topics, I find
it sometimes lacking. And I think that that's the
shift that that needs to be made is that we've got to bring back
the apprenticeship model a bit more.
We've seen that apprenticeship model like if you if you look at
some of the other countries that are ahead of us in in tech
development and they're moving faster than we are, everywhere
you look, the apprenticeship model is intact.
This is identity at the center if it has anything to do with
IAM. This is the go to podcast now
your hosts Jim McDonald and Jeff Stedman.
Welcome to the Identity at the Center podcast.
I'm Jeff, and that's Jim. Hey, Jim.
Hey, Jeff, how are you? It's a bad cowboy.
How are you I? Was wondering because I was
going to scold you if you didn't say anything about my hat.
How could I not? How could you not?
I mean, you know. OK, so we're at Gartner, I am
Grapevine, TX, and I'm the only one wearing a cowboy hat.
A little disappointed. OK, Mom, you sticking out like a
sore thumb. You've got the you've got the
cowboy hat and you've got the Hugh Hefner sort of crushed
velvet jacket. You definitely look like a
smoking jacket, right? But out of Deadwood or something
like that. Yeah, well, that's that's my
jam, you know? We did talk about it with Head
last year. By the time people were hearing
this, I mentioned that because you looked like a like a dealer
in that one and we got a little bit of that in the very
beginning. I always say I just want to
blend in. You're doing a terrible job of
blending in exactly. So I want to say thank you for
Gartner for having us. We're going to be speaking
tomorrow, so it'll be in the past at this point.
But they've hooked us up with a room.
They've done a really nice job. RSM has paid our expenses to be
here. So thank you to them as well
for, you know, making this possible to be here and to put
this podcast together for the community.
So thank you. So thank you to Gartner, thank
you to RSM. Why don't we jump into it
because this is really the start of a series that we're going to
be working on throughout 2025. And this whole idea of identity
at the center, right, That's what we named this podcast.
And it is all about the intersection of cybersecurity
and digital identity. And one of the things that I
think about here is as identity people, we sort of get into our
silos sometimes like, oh, it's identity thing, but we really
need to understand how identity plays in other parts of
organizations, security, privacy, because we cannot be
successful as an identity individual within an
organization that needs to be organizational buy in.
So a lot of these conversations that we have, sometimes you're
reaching outside of the identity team a lot of times, most of the
time I would say, and you really need to kind of understand, OK,
well, what are the, you know, the, the tricks, the, the, the
tie insurance, right? To how does this affect maybe
somebody who is in application security or attack penetration
or maybe even the business or strategy or risk, right?
So the whole idea here is we're going to put together over the
course of 2025, about 10 episodes where we kind of pull
together these ideas and say, OK, so this is the Identity
Center podcast. What does that mean when it
comes to X? And today we're kind of setting
the stage with it, so we'll kind of go with that.
We're going to talk obviously about digital identity and all
these, but hopefully that makes sense.
Anything going to add? I mean, what I'd like to add to
that is like the biggest theme that's happening at the
conference and in the industry overall is this idea of identity
security. So it's that identity is moving
into a larger role within cybersecurity overall.
And so I had an interesting conversation with a few folks
yesterday where it's like, all right, the industry is kind of
heading to this identity security route.
A lot of clients are still fighting the, the AB, CS and
123's of role based access control gave their
authentication house in order giving privilege access
management. And that's great.
Like if you have to, if that's where you are, that's where you
are and get those things fixed. But this is where the industry's
heading. So even if that's where you are,
pay attention to this because a year, 2 years down the road,
this is where you and your organization are going to be.
This is where you're going to be making your investments.
So start boning up on it now. Yep.
Important to be well-rounded and that's kind of what we're trying
to do here. So we have partnered up and
buddied up with our friends at RSM.
We have a lot of really smart people that we work with.
So we're going to talk with some people from RSM.
We're going to talk with maybe some clients that you and I work
with throughout the year and probably others and experts in
specific domains kind of help tie us all together.
So hopefully by the end of 2025, we'll kind of have this
curriculum where people can kind of go back and look and say OK,
identities at centre. What does that mean and how does
that relate to some of these other topics?
So let's kick it off with the man, the myth, the legend.
He leads our security and privacy and consulting practice
here for RSM. I want to welcome Tasif Ghazi.
Everyone just calls him Ghazi. So welcome to the show, Ghazi.
Thank you guys. It's such an honor to be here on
the podcast. You know, I'd say that it's,
it's not my first time. I, you know, I've been behind
the scenes probably at least three or four times.
So I was really privileged and honoured this time around to, to
get to come and actually speak to both of you.
So thank you for inviting me. So the first time technically, I
think that you saw us do our thing was at a Gartner
conference a couple years ago and we were doing some things
and I, I, I think it was probably in Vegas when we were
doing that. And so, all right, who the heck
are these guys? What are these podcasts all
about? What's going on?
And then I think you hopefully started to see it was like, oh,
you know, we're talking to, you know, really intelligent, smart
people in the business. We're having conversations, not
presentations and really kind of getting to the the crux of
things. So hopefully that made a good
impression. It must have because we're still
doing it two years later. And you've been very supportive
of what we do. No, it was, it was definitely a
really, really good impression. And, you know, I was really
floored. I mean, I had listened to the
podcast before, but you know, just the guests that we're on
and their perspectives, you know, there was so much learning
just, you know, I, I just find that really, really intriguing
because you know, cybersecurity, we're going to get into this
today. It's not a topic that's can be
solved by one 2-3 people in an organization.
It's an organization wide activity, right?
And there's a lot of lessons that we got to learn from other
organizations, other colleagues, you know, third parties that are
helping support one another. You know, there's such a huge
vendor ecosystem now around cyber.
So bringing all that together, you know, and getting that
perspective, I think it's you guys have done a really good job
at this podcast. And, and I was really impressed
with the the guests that come on.
This is going to be the downfall probably.
Well, flattery will get you everywhere on this podcast.
I'm very fond of saying that. And now you're in the hot seat.
So we've got you here for the first time.
Tradition, when you come on our show that we talk about origin
stories. So give us the Ghazi origin
story. How did you get into
cybersecurity at large? You know, it was really by
accident. You know, I was a young boy.
I, you know, really didn't know much about technology, but you
know, my father was very good about making sure that
technology was around me always. I used to have AZX Sinclair
Spectrum plus computer that, you know, most people probably don't
know what that is, but you know, it was a pain in the neck to
boot up and, and work on and, you know, I was resilient on on
making sure that it worked. So it kind of, you know, having
access to it. One was, was really good, but in
my, you know, teens, you know, 1718, one of my first jobs was
actually at a Internet service provider and it was really doing
customer service work. However, the customer service
call center was right next to the server room and I was
fascinated by what was going on in that room, right?
So I made friends with the the server engineer and I used to
work the night shift. So, you know, after customer
service calls died down, after all the kids were offline, mirc
and all of that, right? him and I would, would sit there
and, you know, we would talk about routing, we would talk
about some Microsystems, all kinds of other things that were,
that were going on. So I got fascinated by that and
that's how I kind of stepped into it.
Learned a lot of infrastructure, learned a lot of Windows, a lot
of Microsoft tech and really started on the infrastructure
side. And that was really fortunate to
to, you know, step into the security and privacy and the
realm. It came through a public
accounting angle with a big 4. But that gave me an opportunity
to actually go and build a cyber practice.
And, you know, that gave me, while I understood the tech, you
know, it gave me new aspects of what application security means,
right, what penetration testing means and how do you bring that
back together. And then that extended beyond
even enterprise systems into operational technology systems
do a lot of IT and OT convergence work in my career.
And little by little that's just kind of grown.
And I've always been fascinated by cyber security and just tech
in general. So it's constantly kind of fed
itself. I have a finance degree.
So, you know, I, I don't really have any.
I've never had, I've never felt the need to actually go and
study it in, in the university and such.
So, so that's kind of my origin story.
I've been with RSM about 10 years now.
I lead our security and privacy practice for North America.
But my day job is, you know, obviously I, I'm the practice
team, but I'm a client service professional.
I'm really helping organizations build their cyber programs to
help them mitigate against the wide array of risks that that
our clients face today. And that cuts around identity,
that cuts around perimeter endpoints, you know, user
awareness. I mean, you, you pick a cyber
concept and it's there and then, you know, there's, there's
industry specialities that you have to have within that realm
that you have to bring up as well.
So it's been a very, very good journey over the last 25 years
in this space and, and just learning from our clients and
giving back, you know, those learnings to others that don't
know it. So.
Gazi, I love that that curiosity angle injector.
You saw the server room, you got excited.
You know what's going on in there.
Let's stay curious, man. You got to stay.
Curious, you know, and I talked to folks who listen to podcasts.
I don't think there's anybody's job description that says listen
to this podcast. If you listen to the podcast,
they're trying to to expand themselves.
But I would say that's a key for anybody is to you've got to be
curious. You've got to put in the extra
hours to learn. If it's not what you want to
learn, figure out what it is in this world that you want to
learn and what you're passionate about, do that.
But if you want to be in this space, I mean, there's endless
amounts that you can learn. Absolutely.
I mean, I tell people that I'm coaching all the time that, you
know, those learnings don't stay with an organization, right?
That's investment in your own self, right?
And you're going to carry that wherever you go.
So a lot of times people say, well, like, you know, I don't
want to work 40 hours or I don't want to work 50 hours.
I'm like, you know, I'm going to do my job and I'm going to go
home. That's a disservice to yourself,
right? And I'm not saying that you
should do your your job in a, in a way that you're overextending.
I mean, your personal time is very important.
We'll talk about what I do for my personal time maybe today as
well. But I do think that there's
investment that's required, right?
And bring it back to yourself always.
So stay curious and invest in yourself.
Stay curious and then you'll hit the pinnacle of your career
being on the Identity Center podcast.
So there you go. Made it.
So let's talk a little bit about some of these planned episodes
we've got coming up over the year.
We're kind of starting this overview with the digital
identity level and sort of the the overarching kind of vision
of that. But we're also going to talk
about things like strategy and risk, compliance and governance,
architecture and engineering, application security, attack and
surface management, secure cloud, detect and respond,
resilience and recovery. Resilience is a big one that
we're hearing here at the Gartner conference.
And then of course, emerging technologies.
There's always something new on the horizon.
I know I just kind of threw an awful lot out there.
Are there any things that kind of jump out of your mind?
It's like, OK, these are things that are really kind of top of
mind for you right now. I mean, they all are top of
mind, you know, now, some more so than others, right?
But I think the important part is that the, the reason that,
you know, when we were kind of orchestrating this with UVI is
about the, the, the episodes is because you need every single
one of these things to kind of work together, right?
And identity ultimately is that the, the core of everything
because you can't do strategy and risk if you don't, you know,
manage identity workflows properly.
You can't do governance and compliance if you don't manage
identity workflows properly. You can't do application
security if you don't manage identity workflows properly,
right? So whether it's cloud, whether
it's attack surface management, you know, whether it's threat
management, emerging tech, we talked about AI now or you know,
people were talking about blockchain forever, right?
Tomorrow it's going to be about agents in in, in the space of
AI, right, And how they're, there's needs to be rigor around
that. That's going to be another ID
that we're going to talk about at some point, right?
All of that cohesively, right? Has to be on top of mind for
every seesaw like they're contending with all of these.
A lot of times, you know, you talk to seesaw and you're
talking to them about identity. But you know, if you think
about, you know what seesaw thinks about when they're
sleeping at night. They sleep.
One, they don't sleep, but when that is what, what are they
thinking about? I mean, they're thinking about
compliance and governance and they're talking about
architectural engineering, right?
They're talking about resiliency and they're thinking about
resiliency of their organization.
That's why they do sleep because, you know, are they
resilient or not? So you kind of bring all that
together and it's very hard to dissect this in one go.
And I think giving it some time and understanding that there's
all these different pieces, but they all have to come together.
They have to work together. That's how I think about my
cyber team here at RSM as well, that we have specialists in each
one of those areas, right? I'm not an identity specialist
by any means, right? I'm a operational technology
specialist. That's what my bread and butter
was. But you need engineers, right?
You need identity professionals, you need penetration testers,
you need, you know, operations managers, right?
You need governance and compliance specialists and
strategy specialists. So all of that, you know, has to
come together. And I, I think that that's the,
the big hill that everybody has to climb right now is that, and
it's not one thing. It's which people talk about
vacuum, all right, or what what that is.
It's it's always because it's so many of these things, but I
think that if you're organized about it, you can take credit
for multiple things, right? If you engineer things
correctly, right, if you structure your applications
correctly, then you know you've got benefits on on other sides
that you can take. Governance compliance is a great
example of that. If you know you've got to comply
with this on one side, you can comply with the plethora of
other requirements, you know, that might be required for our
organization. PCI compliance or CMMC
compliance or whatever that is, right?
Healthcare compliance, you do it one time, you should be able to
take credit for that because access control is everywhere,
right? Change control is everywhere.
And I know that we'll talk about that in more detail, but, you
know, I think about these these episodes and the structure of
some of these topics that you just talked about, Jeff, as
something that is really interrelated, but at the same
time needs enough time and attention to be kind of
dissected by themselves, right? So they have to stand on their
own, but then they have to come together as well.
So we're hot right now. When I say we're, I mean digital
identity and sort of this business that we're in this,
this vertical or industry, whatever we're going to call it.
Why do you think that is and why, why is it getting heat now?
You mentioned some things like compliance and security and
risk, but identity has been around for a long time.
But now we're starting to see, you know, it's getting a lot
more top of mind, it's being paid more attention.
We're seeing more investments in it.
Why do you think it is now? Is there something that's maybe
changed within the last couple years or is it just this is the
normal evolution of kind of how you've seen maybe waves come
through cybersecurity at large? Well, I think that the change
happened 10 years ago, maybe maybe even more.
What's done over the last two or three years is the, I think
acceleration, right? And I'll talk about that in a
minute. But I think before that, why is
identity hot? I think that's, that's a really
critical question. And I think we've started this
conversation about why are we talking about identity and
cybersecurity together, right? They've always been together.
There's never been cybersecurity without identity.
There have been times where identity has been carved out
from cybersecurity because it's it's a massive endeavor.
And and you know, there's a business enablement component to
it that you've got to work through.
But why is it hot? Think about what, you know, what
hackers do today, right? It's credential theft, right?
And it's bypassing authentication, right?
It's impersonation, it's session hijacking.
It's man in the middle attacks, right?
Exploitation of token systems. Everything that I just said is
related to identity one way or the other.
OK, so I don't know if you've ever played this game, Call of
Duty. If you play Call of Duty,
there's a there's a mode of play mode called War Zone, right?
And in war zone, you kind of see this perimeter, right?
And then over a period of time, that perimeter shrinks and
shrinks and shrinks and shrinks, right?
And it gets to a very, very confined spot till the time the
the last man is standing. That's how I think about
identity is because that perimeter has been shifting,
right? We used to have perimeters.
We had defined perimeters, we knew what they were.
And then we went to cloud, right?
And as we went into into SAS applications and cloud
environments, we lost the control of the perimeter, right?
So it started coming in. So then you have to go to the
next thing. What's the next thing?
Well, how are you going to protect it?
Well, identity becomes naturally the place.
Well, then we added remote workforce right through COVID.
Well, that accelerated. We also added bring your own
device, right? So that's accelerated.
So you have to kind of start seeing all of these things that
happened in the last and all these things happened in the
last 10 years. And that's accelerated the
conversation and really put identity at the forefront
because honestly, what what else are you going to do?
How else are you going to protect your environment, right,
if you can't protect it by by making sure that identity is at
the centre of it. So I think that's what's changed
in my mind. I don't think identity has
become more important. I think it's just become more
visible to people clearly on what that is.
And then the technology stack has changed, like what you could
do with identity 10 years ago, right?
You, you can do so much more today, right?
Whether it's role based access control or, you know, secrets
management and things like that. There's so much more there to
dive into to, to get a better, you know, security profile of
your organization and get better protections.
Yeah, you touched on this a little bit, but so when Jeff and
I came up with the name of this podcast, it was a 2019.
So the idea of identity security hadn't even been thought of at
that point. But in terms of, you know, what
we were thinking with identity at the center's, identity should
be at the center. I think right now or back in
2019, it was silo, silo silo's. Now what you're hearing more and
more folks come on our podcast and they're like, because
identity is at the center and they're like, oh, that's kind of
funny. I'm on the identity at the
center podcast. But I also think our industry
can be a bit of an echo chamber. Like it's identity at the
center. We're in identity, go identity,
everything's identity. And you know, I hear terms like
identity is the new perimeter. People are saying that a little
bit less, but I wonder when I when you hear that that term
identity is new perimeter, and maybe you just touched on it
there with like that analogy of the shrinking perimeter.
What is that? Is that what you're kind of
getting out with the identity as the new perimeter?
In other words, you can't trust, I think that the old perimeter,
the idea was, you know, you have this crunchy shell and the soft
inside. That was what produced the sale
time, right? And that doesn't work anymore.
Like the crunchy shell is just almost might as well not even
have, even though I'm more in favor of layers of defense.
In other words, like, you know, get past the crunchy shell.
Now I get past this, now I get past this and then, you know,
we're going to instantiate the identity check.
But I also kind of feel like I have this.
This is like a a spider web that reaches out into so many areas
where identity is now part of your your logging mechanism
where you can start to use behavioral analytics where
you're watching who's coming in and you're tying it all all back
to an identity. Or it looks like somebody's been
compromised. Maybe somebody's laptop has been
compromised and that shows up an X number of vectors, but a lot
of them are identity based. So when you hear identity as a
new perimeter, what what of that resonates or kind of what comes
top of mind to you? Yeah.
I mean, it's, it's all of that, right?
For me, you know, it's, it's really challenging to figure out
where to put the controls, right?
As a cyber professional, that's the fundamental job, right?
Is that where are you going to put the controls?
So the analogy that I was sharing from this game, right,
where the perimeter is shrinking, that's what's
happening. Over the last 15 years, we've
seen that perimeter shrink, right?
You, you, you had edge computing and edge protections, they're
kind of dissipated, right? Then you go inside and you say,
OK, well, maybe it's on the application level, right?
I need to put that, well, that didn't work out really well,
right? So much compromise happened in
the application security space. Then you can go on the endpoint
level, right? But endpoint still has the
challenges of what you said, right?
What access should you have, right?
And what is you, you as a person, what should you be
granted access to? So you start looking at all of
those challenges. I mean, we've had PKI
infrastructure used and, you know, public private key
infrastructure used forever, right?
It wasn't easy to use. So it's shrinking, shrinking,
shrinking, becoming more and more difficult to manage and
ultimately where you settle down.
Is that OK? Well, I think it's the
individual. What is the access that you need
to do your job right? What are the resources that you
need access to? What are the two or three things
that you need to have to validate or verify that identity
that it is you, right? And you know, is it going to be
multi factor authentication and all of that?
And you know, or it's going to be a, you know, UB key and you
know, you're going to have tokens and and other things to
to support that. Or, you know, it's going to be a
text message. Whatever the the vector is that
you're going to use, it's still coming back to the person,
right? Or the non all the non human
stuff, right? It's my phone, it's my laptop,
it's my IoT device that's sitting out there, right?
But you have to take that in connection with the
proliferation of those devices. I can't tell you how many people
I know that walk around with two phones, right?
They've got a laptop, they've got an iPad.
So each person, if they're walking around with four
devices, right? I mean, that's, that's a lot,
right, to, to work through. So for every single human ID you
have, you know, fourfold, I would say even probably more
once you get servers and desktops and all kinds of other
peripherals accounted for. It's, it's a massive endeavour
to, to work through. And there is no control point
other than the identity of that device of that person for you to
put any, any sort of control on. And that's where it's been very
difficult actually that's that's been challenging for Cisos in in
general for for our clients as where does that start?
Yeah, You're hitting on a very interesting point about the
control point and understanding access control and what it
means. Because, you know, you can say,
all right, we're going to rely on identity as the kind of the
final perimeter to whatever our data or application, but what
does that mean? Identity is?
How did that identity get created?
How's it authenticating? You know, how's it being
monitored? So there's all these controls in
on top of like identity is just one word, but it means all these
different things. One of the things that I'm, I'm
really interested in with this series that Jeff and I are
starting up around the intersection of identity
security and cyber security is the conversations that we're
going to get into. So for example, one is secure
cloud. I mean when I think about secure
cloud, there's, you know, I think of two types of clouds
primarily. 1 is your SAS applications and one is your
platforms or your infrastructures as, as a
service, really what, what can you manage as an organization
from a security perspective with those applications?
Primarily when it comes to SAS applications, all you can
control, there might be some configurations, but it's your
identities, you know who gets access to what and then what
authentication do they go through.
If you're setting up your IDP, if you're talking about
platforms, there's more, you know, infrastructural service,
there's more that you can manage, but identity is probably
still the key one. When you talk about resilience
and recovery, that's another conversation.
One of the things that gets me jazzed up about that is, you
know, I kind of feel like I did a disaster recovery plan a long
time ago and you know, it's like the Active Directory on Prem
Active Directory was like, can we restore that?
Well, OK, well, you know, check, move on to the next thing.
Now it's just such a complex web that needs to be up and active
before you can access anything. So these conversations, I think
are going to get really interesting.
For sure. I mean resilience 1 is, is, I'll
just pick on that one. You know, it's not about the
business continuity plan anymore or it's not about Emergency
Management. It's how quickly can you
recover, right? How quickly are you going to get
back on your feet and what's the loss right, associated with it?
So, you know, you start thinking about resiliency very
differently. In order for you to accomplish
that, yes, you need a business continuity plan, right?
But you need to make sure that your vendor ecosystem is just as
as tightly knit because when an issue happens, it's it's
especially if it's related identities and those identities
are cutting across multi cloud, Those identities are cutting
across multiple SAS applications.
Well, you got to have all those people in the huddle with you,
right, to solve for it. Your security operation centres
need to be be read into it. You've got to have better
monitoring and, and all of that. I mean, you talked about even
identity based threat monitoring earlier.
I think identity based threat modelling is going to be like
almost a necessity. You can't flip things back on
until that's working. If you do, it'll be down in five
seconds. Exactly right.
So you have to rely on the heuristics and the behaviours of
people. Ghazi connects from this device
from this geographic location 95% of the time.
If he's outside of that, this probably should be a flag.
Somewhere I'm really excited for that conversation because I
think another thing when it comes to disasters is the nature
of disasters is different. You know, OK, you could still
have an earthquake and your primary data center that you
manage goes down and then you fell over to Sun Guard or
something. The new disaster is a hacker
comes in and encrypts all your data.
It's an intentional disaster. There's no failing over to
another data centre. Yeah.
And we, we consciously you know at RSM, we moved our business
card community team and you know our disaster recovery teams
alongside our cyber teams because a lot of those events
now are, are actual cyber related events, right.
So you have to be integrated in delivery of that service.
And it's not just for us to integrate and, and be be able to
deliver that service, but it's also for our clients.
They have to think about it the same way, right?
Because they can't. You, you have to have all of
these pieces together to be able to solve that problem.
And it's very difficult when when you know you're in that
boat where you know you, you, your data is encrypted.
Yeah, guys, you one thing I want to talk to you about while, you
know, I don't want to shift completely away from this
technology conversation so exciting, but you manage a large
organization of cybersecurity professionals.
There's a huge skills gap out there and it gets worse every
year, right, Even though we're starting to build many more or
create many more opportunities for people coming out to college
or coming into the industry. However, the gap gets wider and
wider between the need and what's available.
And so you had some ideas in terms of some of the, I mean,
you talked about being from public accounting firm and that
being a a great opportunity for folks to kind of learn the base
skills and turn into cyber professionals.
I was wondering if you could explain why that is?
Yeah. You know, I, I, I'm a techie,
right? And I believe in engineering and
I believe in the bits and bytes of, of everything that that we
do. However, over the last 25 years
of, of being part of cyber practices and running cyber
practices and, and really helping clients stand up there,
you know, operations and, and programs.
You need, you know, people that can do penetration testing and
people that can do cloud engineering and somebody that
can do, you know, infrastructure as code and somebody that does
CID to CD pipelining and all of those right, They're all
required, But there's also a general lack of, you know, kind
of lifting and shifting. So one of the things that, you
know, I've found very helpful throughout my career, and this
wasn't really, this is again, by by accident that that you know,
this happened when I joined a public accounting firm.
I actually didn't understand what I was doing right
holistically. Like I, I joined a cybersecurity
practice, but a lot of the work that I actually did wasn't
really cyber security. It was really controls work.
And that was just the nature of the, the market at that time,
right? Sarbanes-Oxley was new.
Everybody wanted to talk about Sarbanes-Oxley, right?
But if you think about those type of compliance requirement,
what, what, what is it talking about?
The fundamental very first thing it talks about is access
control, right? So you have people that are
getting schooled and trained in the basics of access control,
basics of program management, basics of change control, right,
basics of resiliency like backups and operations and how
you're going to make sure that your environment is resilient.
So is there a skill gap? Yeah.
But there's also people that can shift right and can be skilled
up. Not everybody needs to be your,
you know, high end engineer in this space.
There's a lot of work that needs to be done and it's everything
from policy writing to making sure that compliance and
governance is in place, right, to making sure that, you know,
the programs are being managed appropriately and orchestrated.
Cost management is a huge portion of it.
Like you, you know, I mean, there's a lot of cost to cyber
tools. There's a lot of FDE cost
associated with cyber management of cyber operations, right?
So management becomes just as important as the the skill set.
So I think that there is, there is definitely places you can
pull from to holistically build a team, right, and orchestrate
this. It's been really successful for
me right, to upskill people. It's been really successful for
for me to actually invest time in the university systems and
actually help them kind of develop the program that we
need. Because the biggest issue is not
that you're not getting people that have a cybersecurity
degree. I mean, most universities now
offer a cybersecurity degree. That wasn't a thing 20 years
ago, right? There was barely an IT was a
thing 20 years ago. So most whatever they're
learning in school is better right, from a cyber perspective
than it was 20 years ago. However, are they coming in
ready, right, ready to jump in? And I think that there's a gap
there. So right now my work with some
of the universities that I recruit at is trying to get
people more ready for the actual work that needs to happen.
And the, you know, the actual work is around the, the 10
things that you Jeff talked about at the beginning, right?
It is around application security, it's around secure
cloud, it's around detect and respond, right?
It's around resiliency and recovery, right.
But are they touching this at a, at a topical level where they
just know the the concept or are they getting any practical
experience with it? Right?
And that's been the biggest challenge.
The other thing that goes alongside with, and this might
be a little deviation from your question, but it's it's skill
set related, the shortage in the market then, you know, you, you
get people to move around. But cybersecurity has always
been an apprenticeship, OK, It's always been an apprenticeship.
It's not a, a skill that is just kind of like learned off of
books. Like you work with a lot of
people. I've learned a lot of stuff from
other people and there's a lot of repeat work that you do over
and over and over again, and it gets better every time you do it
right. But we don't have people that
are sticking around long term to be able to cultivate that
apprenticeship models anymore the way that it used to be.
So if we get 2 years here and we've got another year here and
two years over there, it looks like you've got good experience
at very large, reputable firms and you were part of, you know,
their, their cyber team. But if you took that person as
an individual and you said, OK, let's look at your own personal
depth on something right, related to these topics, I find
it sometimes lacking. And I think that that's the
shift that that needs to be made is that we've got to bring back
the apprenticeship model a bit more.
We've seen that apprenticeship model like if you, if you look
at some of the other countries that are ahead of us in, in tech
development and they're moving faster than we are, everywhere
you look, the apprenticeship model is intact.
So that's what my, I guess soapbox is that I got I, I
really, I really struggle with that one.
Yeah. But I mean that's a a big part
of you know, developing people. It's not only the long term
benefit of two through organizations that person is
going to really appreciate and start to build their career.
And I think we have this concept of at RSM of the boomerang
people. So it's like people who go out
into industry work 3 or 4 years to come back now they've got
some new skills and experiences. But I do agree with you, the one
year, 2 year, it's kind of like go somewhere time start to get
rough. If you stick it out, that's
where you really build your metal is going through the hard
times. And I think that's a life skill,
right? It's you learn more from the
hard times than from the easy times.
You guys have been doing the identity podcast for since 2019,
but you've been doing identity work a lot, way longer, right?
And I, I bet that even in the last two or three days, you've
probably learned a thing or two that's new, right?
And it's always evolving and you're probably going to go
teach that to somebody, whatever you've learned.
And that's what it's all about, right?
So keeping teams together and I think building that
apprenticeship model, whether it's a consulting business or
whether it's a, you know, you're, you're in the industry
and you know, you're kind of running your own operations,
it's required either way, so. Yeah.
I mean, one thing I did want to kind of pull out of that
conversation was that, you know, it's, it's kind of the working
with the frameworks, understanding the frameworks and
the access controls. So the access control or I'm
sorry, the frameworks are designed to help you meet the
access controls, right. So it's going in and taking a
NIST cybersecurity framework. Questionnaire and kind of like
working through that. And I think you you mentioned it
gets better the more times people end up doing it, they
understand it more. Now when they go to a position
where they're applying that framework and building a program
around that framework, those pieces are really coming
together. I think it has additional
benefits as well, right? A lot of cyber stuff still gets
pushed down because of, you know, compliance requirements,
right, or governance needs and things like that.
So some of that actually helps you work out, hey, you know,
here's what the operational things are, right?
Here's the tactical things I've got to do, but why am I doing
some of these things, right? And if you understand the, the,
the control side of it, you understand the auditable side of
it, right, versus the actual, the work that needs to be done,
I think you can be a better consultant, you can be a better
internal specialist because you understand both sides of the
house, right? I don't think I had appreciation
of that till much later in my career.
I did not like doing the the control work personally.
I was like, I'm a cyber professional, right?
I can architect and not work for you, right?
And do a pen test for you. Why am I doing this other stuff?
But you realize over a period of time that you still have to at
some point justify those things, right?
You still have to be compliant with certain regulations and so
forth. And by understanding the
infrastructure side of it, you know what that difficulty is,
You come up with newer ways or better ways to solve for the
compliance challenges you have because now you understand both
sides of the world, right? So you bringing those two things
together, it's, it's really hard for people because you know, the
compliance is boring. It's really boring, right?
But it drives a lot of like budgets for security, right, for
organization, even for identity, like a lot of big companies,
they, they do what they do because there are compliance
requirements that they need to fund.
Especially in certain industries.
I mean, that is so that that was my background was I was in
identity doing a lot of engineering program management,
but in the manufacturing industry where it wasn't as
heavily regulated, especially working on a lot of CIA and
stuff. I ended up in the financial
services industry doing internal as well as banking and and the
loan operations. What I found out, especially on
the workforce side of the House was the regulatory framework or
regulatory oversight, which led to all the frameworks and having
the GRC controls in place tested on a frequent basis and making
sure it's a lot more rigid and demanding.
And if you don't take the time to understand that and I had to
kind of learn trial by fire, if you will, but I mean that was
it's foundational I think for identity as you move up into
more advanced leadership roles. And it, it's only going to get
complicated with hybrid cloud environments, right?
Because what is inherent in the cloud environment that gives you
those controls, right? What is it that you need to
build on top of that? Because just by putting your
stuff in in the cloud, you're, you're not, it's, it's still
your risk, right? It's still your data, it's still
your problem, right? Ultimately.
So sometimes I find it naive for people to say, OK, well, yeah,
what was in Azure? And Azure's giving me these
control points, right? What was it configured for that,
right? If it's not configured for that,
then you're you're not going to get those control points and the
auditor will come and and we'll find you weaken those, right.
We'll talk a little bit more about AI, but I, I kind of feel
like this is 1 area where if we put AI in charge of making
decisions about our access, we may have a harder time tracing
it back to, OK, you know, was the right decision made, was the
right information provided in order for that decision to be
made. But I don't want to divert us
into the. I didn't want to add 1 one thing
real, real quick because I think it's, it's related to what we
were just speaking to. One of the things that I've, you
know, been really contemplating is so the large companies,
right? Generally, there's a lot of
conversation around identity at those companies, right?
We deal with those clients all the time.
You guys deal with them, I deal with them, right.
But we have about 30,000 companies that are in the 500
million to $5 billion range, right?
In the United States. They don't have the resource
leverage that that some of these larger companies have.
They don't have the budgets, right?
They're still contending with the same proliferation, right?
They, they have scaling issues, They're still running hybrid
environments in most cases. They're still kind of on prime
and then they've got some stuff in the cloud.
It's not very cohesive, right? They still need to be compliant
with, with different requirements, right?
So you kind of think about that demographic and I think that
we've seen over the course of last so predominantly in the
last five years that the attack vectors have shifted from large
corporations right to some of these middle market companies or
upper middle market companies, right?
And it's because of that reason, it's because hackers are
generally lazy, right? They're going to go after what's
what's easier. And I think within the identity
space and generally within broadly in the cybersecurity
space, you can't functionally deal with those companies the
same way that as the larger companies are because they don't
have big programs that they that you can tap into.
They don't have 10 resources to, to go pull on, right?
They might have a total of five, they might have a total of 2
cyber professionals that are in that organization, right?
But they're still rotating through, you know, $2 billion.
So there are, they need a lot, a lot of help as well.
And you know, I think there's going to be some changes that,
that are going to be required on how identities are administered,
built, managed, operated for that demographic of client.
And we've been, we've been thinking about that a lot in RSM
on how we can make that mechanical and mechanise that
holistically for those that demographic of client.
But that's, that's huge. That's where most of the attacks
are right now, and that's. Getting scanned just as much as
the big companies. And it's kind of like the point
that you were like, I was thinking like a safari example.
The lion scans the herd and looks for what the weakest, the
youngest, whatever, the easiest target.
And so if we're scanning everybody and somebody's under
invested and has some weakness like that's the target.
So I thought I'd I'd mention that a little bit because it's
been, it's been on my mind lately.
AI is on the top of everyone's mind right now.
I think I'd like to do a little bit of a lightning round, maybe
an identity or security Rorschach test for you.
So I'm going to throw out some terms and just tell me what
comes to mind when you hear the term zero trust.
I don't think there's anything else.
Zero trust. I think it's a great concept
like, hey, I don't trust anybody.
OK? So you have to prove to me every
single time that you're going to get access to a resource that
you know you are who you are and you are connecting from where
you're connecting. Otherwise, no.
But reality is that it's, it's not been implemented at at an
appropriate level and it is extremely cumbersome to manage.
It requires a lot of manual intervention.
So I feel it's more, you know, I'm not going to throw it as
that it's not a good concept. It's a great concept, but it's
hard to implement. It's really, really hard to
implement. Real world execution is is the
trick, right? Because it's not just why I
bought it in a zero trust product.
Now I'm zero trust. It's it's a combination of
things. And there's a lot of, you know,
product conversation around it, right?
Well, you get this product and you get that in and you know
it's going to solve the world's problems, right?
But it's about how it's implemented.
It's about how it's used. It's also very important.
The one thing that I find missing in zero trust
conversation is the, the business acumen within that
conversation. There's no two businesses are
alike, right? So what this business needs is
very different than what this business needs, right?
And the way that they access things is very different than
the way that they access things, right?
And the frequency of the, the the access is very different
than the frequency of the access.
So I think that it has to be business centric.
Does it work? And I don't think that you need
to have zero trust deployed everywhere.
I think you need to know what you're trying to protect in the
1st place and then define, you know, your zero trust
architecture around that. A lot of companies just think,
OK, well, that's by default. That's what we're going to go
do. It's a very, very costly
proposition to get that through and manage it.
No, I wanted to throw one thing into zero trust conversation.
I'm sure you've heard this your entire career of doing
consulting in the cyberspace, which is you talk to a client
and they'll say, well, only people who are plugged into a
network slot can access this. They can get it.
No password or no MSA. It's like, so as a consultant,
you just nod your head. It's like, yes, that is better
than if the outside Internet could come in.
No, MFAI grant you that. But if you're asking me to say
that's OK, I'm not going to or the the example we see all the
time is, but there's only seven people in the domain
administrators and we know them all, so it's OK.
It's like if you're asking me to tell you whether or not that's
OK, the answer is no, it's not OK.
You can't be. Familiarity isn't security.
Exactly, that's spot on. So you know, I feel like that's
a important part of 0 trust. Like the implementation of it is
like, OK, you may not get 10 out of 10, but let's not just like
because we, you know, getting from 9 out of 10 to 10 out of 10
is just so difficult. We're just not going to do it
fine. 9 out of 10, not ten out of 10.
No, I, I agree. I I do though, think that the
zero trust conversation should be uncoupled from least
privilege. They're two different things,
right? A lot of times people would just
kind of combine them together. It's like, well it's least
privilege. OK, Least privilege should be by
by DNA right? That do you need 7 domain admins
or did you need like 3 in the 1st place?
Does their job actually require them?
But what if? What if?
What if that? Then that's how that circle
expands. Exactly.
Well, I think. There's also even vendors in
this technology, vendors in the space that will actually
encourage organizations to grant people access that they don't
need by saying, oh, this role is 80% of the people who are in the
accounting department have access to this application.
So why don't I just give it to 100.
It's going to be simpler to manage.
There is a benefit to simpler to manage this. 20% of people don't
need the access. By definition of what least
privilege is, they should not have the access.
So I don't know, maybe I'm just fighting over principle, but I
think that's I think that's what it comes down to.
A lot of times it's like, hey, there's just so much to manage
that you have that these trade-offs to say.
All right, well, some, you know, bundling this into roles and
maybe people get more access than they need becomes more
secure become because it makes it more manageable.
I mean, you always have to hedge risk, right?
This that's that's basically the bottom line is that you have to,
you may have to make smart choices based off of the cards
that that are in your hand, right, But you also have to
learn from what good looks like, right, and what best looks like
and try to achieve that at the lowest cost point that you that
you can. That's the name of the game, to
be honest. All right, next one pass
password less. What do you think of?
That excites me password less. Yes, I mean who, who, why, why,
why are we remembering passwords like it, you know, 2025?
I wanna have 48 different passwords for things said nobody
ever. It's like it's, it's just the,
it's the oldest thing that we've had, right?
This password less Yes, all the way.
What do you think stops or maybe slows organizations from
adopting it 'cause this is a a standard that the Fight Alliance
has, has really helped kind of put forward over the last couple
years and it's there, it works, people are using it.
What is the what is the driver that a CSO needs to say is like,
we're going to do this? I think Cecil's are pushing.
I've, I've had a lot of conversations with CSO's where
they're driving that it's, it's getting comfortable with the
technology, right, that you're employing.
It's getting comfortable, it gets getting the the board
comfortable. It's getting the executive
management comfortable. It's getting the regulators
comfortable because how are you going to audit that, right, in a
regulated environment? So if if you don't have the
standards for it today, you're going to create one, right?
So it's it's all of those things, right?
And people get gun shy because they're like, OK, well, it's
new. Well, I don't want to be
bleeding edge, but you know, and it's not, this is not a bleeding
edge concept. I mean, it's been around for a
while, but I think the adoption of it is really getting people
comfortable with the idea that they don't, they don't need to
know their password, right? And how they're going to
mechanize their processes are completely different, right?
It's very much a possession based authentication scheme and
not everybody has something that they're comfortable using for
possession based. And there are challenges, right
field services and other types like, you know, not No2 business
or alike. It's it's easy where you know,
if you're connected to the Internet all the time and you're
connected to a device all the time, OK, great.
But you know, there's a lot of business.
It's the edge cases, and I think that's the excuse that people
give the most on why it won't work here.
It's that legacy system or the field engineer.
But I say then carve those out, do password lists everywhere you
can, and do some other mechanism for the edge case.
I agree. I mean, I I that one excites me.
Yeah, like I can't get rid of. So your team password list, I'm
with you on that. One I'm I'm definitely team
password. List, how about I'm going to
call an audible here because I had a couple of different ones
who were kind of picked through, but you mentioned blockchain
earlier. So when it comes to blockchain
and decentralized identity, what it comes to mind?
You could do a full podcast. On that and we have in.
My Bitcoin wallet, What's it doing today?
Yeah. Do you know anybody who's using
it today out of all your clients and people that you're working
with? I do not.
In fact, I, I would say there's a lot of innovation that is
coming with blockchain, but it hasn't moved as fast as
everybody thought it was going to move.
At least that's my impression. OK.
I, I, I won't speak for companies that are actively
doing building tools technology on, on blockchain, right?
But I'm a cyber professional and I've, I've evaluated based off
of the number of requests that, that you know, are coming to us
to say, hey, we're implementing this new technology.
I don't know if this is going to work for us.
Can you come in and test it out? So far there have been zero
those requests, right? So it's, you know, it's not like
there's a ton of them. There are some and there's some
some really, really creative ones that you go into like, oh,
shoosh, this is going to, this is tough and it's hard both from
a, it is, it is well orchestrated from a security
perspective, right. But then in, in general, I think
your, your question is more identity and distribution of
that. It's, it's very hard in a, in an
environment where you know, you don't have you, you have
obscurity, like how are you going to regulate that?
There's this trouble already in regulating blockchain right now
where you're going to go and, and say a public, public company
that is a SEC registered that that is going to come and deal
with identity through obscurity and you can't really manage that
appropriately. I think it's a really tough sell
right now. I think it's a great concept,
but I think blockchain and crypto in general has to kind of
flush itself out for the masses, for the masses.
Yeah, I feel the same because I think like it's the solution
that's been out there now for a while, but I don't know anybody
who's using it not in the in what I'll call the real world,
right? I'm sure there are some
excellent use cases for it. When it comes to decentralized
identity, I think we have to figure out, OK, well, who's
blockchain, who's running that blockchain and how are we making
that interoperable with others? And do you trust the blockchain
that it's on? I mean, at any given point, half
the population is for or against government.
There's healthcare, there's education, there's finance, and
then you've got social media networks.
You know, I, I think it's a really interesting, almost like
a social experiment. It's OK.
Well, when does this come? Because I've been hearing about
it now for, I don't know, almost a decade I feel like.
But I've yet to see a I'll call a normal company adopt
decentralized identity as part of their identity apparatus.
I I haven't seen much of that either, so.
I think the interesting thing about blockchain is this
uneditable Ledger idea. I don't know the exact use case
that it's going to be used for from an identity perspective,
but I can tell you this where at Gartner I am it's not being
talked about. So it there's probably somebody
listening to this podcast right now like you dummies, you this
is the this is the future. Yeah, they're probably lighting
up right now, but. I mean, I, I think the the fact
is not like blockchain as a technology, it's fantastic.
OK, So this is not a dig on blockchain in itself.
Is your question is, is it being used today?
I don't see it being used. Are there solutions out there?
Yeah. Are they implemented solutions
where they're working? No.
And just with any technology, it comes with its risks.
You got to still figure out how you're going to make it
resilient, right? How are you going to test it?
How are you going to make it auditably compliant, right.
All of those questions still have to be be answered.
So I think there's work to be done there.
OK. Last one we kind of touched on
earlier, but AI, where do you see AI taking us in 2025?
Let's just do kind of predictions.
It's it's January when people listen to this.
Where do you see AI taking both cybersecurity and identity?
And maybe there's any linkage between the two?
No, I, I think that wherever we're going to go, it's going to
be much, much better. I am really positive on on AI
simple things, right, security operations, there's so much
potential to automate things, right?
I think that there are certain cases that I personally believe
again, it's my belief system. So take it for what it is that
there is accuracy in decision making for for AI because this
it doesn't have the emotion. I don't know if you saw this
report, I might misquote it a little bit, but I think they ran
some experiment where with doctors and they said, OK,
doctors, you know, diagnosing a complex problem for for a
patient and they're, you know, and they are going to do it by
themselves. They're going to diagnose that
problem with the assistance of AI and AI will diagnose the
problem by itself. And I think the AI diagnosed the
problem 95% of the time or 93% of the time correctly.
The doctors identified the the problem like 70% of the time, or
maybe it was 75% of the time. OK.
And doctors using AI actually reduced their competence in
their own ability to to, you know.
Meaning they became more reliant on the AI to make.
The No, they didn't. They didn't trust the.
Game they didn't trust the AI, OK.
So I think it was 65% where where it was.
And so you take that, OK, we take it with a grain of salt,
right, Because I don't know what the experiment parameters were
and all that. But I do think that there are
ample scenarios within cybersecurity, in the construct
of cybersecurity in a broad sense where AI can be used to
automate a lot of those decision making points, OK?
I've seen that within our practice and our security
operation centers already in the amount of alerts that we are
generating now that we can use AI to, to cleanse through what
false positives are and so forth, right.
I think workflows will become really, really big in 2025.
What does that mean? That means in in doing your
day-to-day activities, right? I'm a consultant, so I do a lot
of consulting engagements which require writing reports and
making presentations and, you know, evaluating controls and
evaluating configurations and things like that.
There's very, very simplistic ways of, of using AI to evaluate
those to make the process more efficient and actually increase
the quality in the in, in that right.
But you have to what AI is not, it's not a silver bullet, right?
You still have to, to give it the parameters.
And I, the thing I think that I don't think this will happen in
2025, but it's very soon after it's going to be the ability for
AI to use agents on devices and do different things where, you
know, it can simplify the tasks. And I know people are, are
afraid of that, right? That if, if you've got AAI agent
running on your laptop and it's monitoring for two months of
what activity you do and it's kind of figures out, here's the
patterns, here's what you do, e-mail comes in, you respond to
it this way and then you go do this task, right?
If it can compress that and predict that.
Just to you, it could be you. Right.
But then people take that immediately and say, OK, well,
that means I'm out of a job. OK, well, no, it's it's not
going to happen that way, right? You just have to stay abreast of
it. But at one point we used to have
a Ledger, right? We used to take all the, this
was the accounting spreadsheet. Somebody would like debit some
credits and write it down. And then spreadsheets came in,
right? And you don't see people walking
around with a register underneath their arm, right?
That has all that information, like it's readily available.
And then spreadsheets turn into ERPS and you know those like all
that information is available. Yeah, when's the last time you
bought an encyclopedica for Canada, right?
To that point, but are you are, is the accounting professional
profession done? No, you still need accountants,
right? So it's, I think that you have
to separate the technology and what it can provide you from the
actual, you know, job that you have.
Your job is going to evolve. The people that are going to
lose their jobs are the ones that don't keep abreast of it,
right? You got to make sure that you're
abreast of it, you understand it and utilize it for what that is.
But something that used to take 40 hours can take like, you
know, 10 minutes to do. Yeah, why not?
Why wouldn't we do that? Why wouldn't we take that
efficiency, Right? Why wouldn't a business take
that efficiency? Absolutely we would.
Yeah, I think that there's a lot of thinking that the upcoming
generation, they're the ones that are going to lose their
jobs, say AI, and I think the exact opposite is true.
They're going to be so much more efficient than our generation
was because they're going to be able to use technology and have
technology do all these menial tasks, things we don't think of
as menial tasks right now, but we do them.
They take a lot of our time to write reports or analyze
reports, and they'll just be able to expand the amount that
they get done putting in less time using the technology so.
And, and we'll have to completely update the controls
and the protections and the mechanisms of, of authentication
that we have as that proliferates.
Why? Because the bad guys are going
to have it as well, right? They're going to make their
workflows just as more efficient, right?
So it's not just for, hey, if you use it for, for, for the
good, right? Everything has two sides to it.
And that comes with risks. That means that the security
profession of the future, we'll have to account for that to
understand how how those risks, risks, you know, propagate and
manifest themselves in our clients environments and how
we're going to protect against that, right?
Are their pro, are their programs, you know, ready and
set. And it's, you know, with any new
technology when you roll out, you know, it comes with
learning. A lot of companies are
experimenting with this, right? And there's so many, some
companies have the stance of saying, OK, their acceptable use
policy is that that should not use AI, right, for any work
purposes. There's others that are like,
OK, well, we're going to segment this portion off.
That's where we're going to do it, right?
And there's others that are like absolutely 100% we're going all
that, right? And if the all insurance don't,
I mean, there's a risk, right with AI like you know, what if
it's not secure enough, what if our crown jewels data goes into
our AI model and somehow it's. I mean, there's a lot of
acceptable use conversations around that.
If that doesn't happen, though, they're going to leave their
competitors in the dust. I mean, they're going to get so
much more done. The competitors could go out of
business if they don't. I think you'll see this
happening over the next few years where companies will cease
to exist because they didn't. They didn't transform.
That will transform themselves. And I think that that's going to
be very, very prominent in the cyberspace because we started
this conversation about skills and we talked about gap as well
of people lack of lack of talent that's available, right?
Well, the solution to the talent problem is twofold, right?
1 is OK, Well, upskill other people, train more people, get
more people interested in cybersecurity, right?
Like I'm, I've got a 17 year old daughter.
I'm really passionate about, you know, young girls being in the
cyber field. I think it's a hugely rewarding
field. I mean, it's three of us here,
right? I mean, career wise it's been
it's been fantastic. This is.
Work. This is what I always think.
Feel like this is our job? And this is, I mean, I love it.
So other people should have that, you know, satisfaction in
life that, you know, you can, you can do that something that's
that's going to, you know, take you somewhere and you're going
to enjoy it. But, you know, we nearly don't
have enough, you know, women joining the cybersecurity
professional. I mean, it's better than what it
was, but it's not anywhere close to what it needs to be.
And I find that every time that I have, you know, women in my
team, the perspective is different.
And it's, it's so much, you know, there's diversity of
thought there, right? That that allows you to be be a
little bit richer. But the point on this was the
skill gap is either you, you train people up, right?
And you add more, or you solve it by technology by taking out
the manual work, right? And you transform that with
tech. And that's, that's the work.
And if that's the work, now, if you look at everybody, because
they're all short staffed, if that's the work, well, AI is the
one that's going to help you solve it.
But you, you, you also mentioned we, the, the risk portion of it
is that you can't have publicly available models, right?
You're not feeding all the like, you know, corporations have to
be very careful that they're most organizations in the future
will have their own large language models, right, That
that are supportive for, for their own needs, so that their
their data, their, their stuff is in their own.
Their data center and then eventually it will all be a
software as a service, right? And then you will still need
identity around all of that to manage that.
So identity will stay at the center I think for for a good
bit of time. So.
That was quite the lightning round, Jeff.
No kidding, right? Well, let's go ahead and and
let's let's shift gears a little bit.
I want to talk some music because I know that you're into
music. We've traded some stories around
it. Tell me about your inspirations,
the music you create, your process.
Are you available to edit podcasts?
Tell me all that kind of stuff. I I will I will gladly lend a
hand in editing a podcast, probably do a good job.
What's your inspiration when it comes to making music?
You know, it's, it comes from a lot of different places It comes
from it generally comes from life, right?
But it comes from sad times, it comes from happy times, it comes
from fun times, it comes from stress times.
And it's I've I've I've noticed that the inspiration arrives
weirdly. It's not like I'm actively
sitting down to create something.
In fact, most times I'll actively sit down and create
something, it doesn't happen. You're trying to force the
creativity. But then I'd be on a plane, you
know, going from Houston to Chicago and, you know, something
pops in my mind and, you know, then I then I need to do
something about it, right? So I'll, I'll sketch out ideas
when whenever that happens. So, but yeah, I've been at it
for about 20, five years. I think mostly electronic music
kind of it's a good, you know, way to blow off steam.
There's a lot of learning in that that space as well.
I find, you know, the intricacies of chord structures
and, you know, different genres of music and their intersection
really, really fascinating. So there's a lot of learning
there. I'm I'm a geek when it comes to
audio production. We were learning about our about
our rack deck 4 it's. Got my, my new Mac so yeah,
I've, I've been like, I've revved it up to, to make sure
that it's going to work. But yeah, I've got a full
recording studio. You know, I'll do it for myself.
I'll, I'll have friends come in and you know, they, they want to
record a song or or two, I'll do it.
Got about 120,000 people following me on Facebook so.
Maybe we'll get we'll call a couple more thousand maybe after
listening that's. That's been, that's been fun,
but you know, it's, I think for me having passions outside of
your, your work. It's not like I don't love my
job. I love my job, but you have
three parts to you. It's the, the piece that you do
for yourself, the piece that you do for your family and the piece
that you do for your work, right?
And it's very hard to juggle, but I've noticed that anytime
the cup is empty in one of those three, right?
Life is not stable and you need to do a good job at work and you
need to make sure that you're, you know, you're, you're, you're
creating something valuable. And just like I started this
conversation, you have to continue to invest in yourself
because it's not really who you're working for or what
you're doing, but it's really what are you getting back out of
it personally, The family is, is, is head and shoulders above
all the rest. And then you know your personal
things and it could be anything, right?
Your music or you like travelling or whatever that is.
A podcast. Podcast, whatever that is,
right? You got to have those three
things in check all the times. It's that balance, right?
I think what you're looking for in, you know, the the great
warrior poet Thanos once said balance in all things, and then
he snapped and half the universe disappeared.
He was a badass though I think. It's probably a good spot where
we can leave it. This has been a really good
conversation. I'm really excited for this
series that we're going to put together throughout the year.
And I think this is kind of a great starter, right intro.
It's always, I always enjoy listening to you and hearing
your thoughts and perspective on things.
You know, we're always kind of synthesizing data that we get
from our different sources. And I think this is going to be
a fun run that we're going to have here.
So and, and thank you for the support for the pockets that
you've shown over the last couple years.
I again, you know, I know you all are passionate about it and
we are passionate with you about it because I, I think it, it's
such a good service to the community, the identity
community and then broadly to the, the cybersecurity
community, such a good resource for people to go and listen to.
And you know, it's, it's easy to listen to, right?
And we try. Yeah, a lot of people have
identified with those problems and and you know, I think they
could probably find some solutions through through this
or or at least a a different thought process than than what
they've had. But I think the series that
we've talked about and just generally talking about how the
intersection of cybersecurity identity happened and how,
whether it's risk governance, engineering, you know, all these
concepts, resilience, how they interplay.
I think it's going to be really fun here for you all to to
dissect that and I'm happy to support it.
Well, this is what we do for fun, Jim.
Our day job is identity consulting.
I think we've done a good job with the podcast, people not
realizing that we actually have day jobs.
Well, I always say, people say, oh, Jim, you've, you work really
hard. I'm like, well, it's not quite
like going into a coal mine or something, right?
It's. Oh, we got to pump that up.
Like, yeah, it is. It's terrible.
It is like my. Back all right.
Let's go ahead and leave it there for this week.
Thank you so much, Ghazi, for joining us.
I'm going to have a link in our show notes to your LinkedIn
profile for people to reach out. Maybe if I can convince you to
get your Facebook link for the music stuff so people could
check that out as well. It's it's interesting.
We have such a diverse population of people, not only
in identity, but in cybersecurity.
A lot of musicians we've actually had on the show and,
and, and things like that. So it's, it's very cool.
We'll leave it there. We're on the web,
idacpodcast.com. If you're watching this on
YouTube, thank you. Like and subscribe.
If you're not watching it on YouTube, check it out.
idacpodcast.tv. Connect with any of us on
LinkedIn. We're always happy to have
conversations with folks and, and just kind of engage that
way. And yeah, so we'll leave it
there. Thanks everyone for watching and
or listening and we'll talk with you all in the next one.
Thank you all. You've been listening to
Identity at the Center. We hope you've enjoyed the show.
Make sure to like, rate and review, and we'll be back soon.
But in the meantime, hit the website at
identity@thecenter.com. See you next time on Identity at
the Center.