The only reason financial services is doing it is because
they've regulators making them do that.
So 1, is that true? And you know, 2 like where is
the value? Is it just to be compliant with
regulation or is there something more?
Really good question and I'm thinking now don't want to
answer it positive or the way I already feel.
Let's go positive first. So you are absolutely correct in
terms of regulatory just environments, which has cost
multiple industries. There's a ton of value in use
access reviews because it is both a detective and really a
corrective type of control. The end of the day it's done to
say, hey, should Jeff and Jam still maintain this access?
And if they shouldn't let me create an action where I do an
attestation and say Nope, I want them out and then some
technology, some tool goes and remove them from that access.
And for small and mid sized companies, it works really well
because there's not a lot of bloat in small and mid sized
businesses. The larger the company is, the
more job roles of companies are really strong.
When I say on our back, you know Rd. based access control, the
more our back you use the larger your access role environment is
going to be, the more access certification use access reviews
you have. Once you hit that threshold, now
it becomes more of. Is there value in this or is it
just a checkbox activity? This is identity at the center
if it has anything to do with IAM.
This is the go to podcast now your hosts Jim McDonald and Jeff
Stedman. Welcome to the Identity at the
Center podcast. I'm Jeff, and that's Jim.
Hey, Jim. Hey, Jeff, how are you?
Oh, not so bad yourself. Doing good.
You know, obviously we always start every show off with
banter. So I was like, OK, what am I
going to hate you with this time?
And I was kind of thinking back to, you know, one of the areas
where I've really been wanting to put together an episode and
the topic is device identity. And So what I did this week on
Monday was I launched a, a poll question on LinkedIn.
So it was in your mind is device identity the discipline focused
on? And then I put a couple of
options like a device, a device's role in authentication,
the accounts local to a device, both or something else.
And it got 55 responses, they got 3 reactions.
So basically 3 thumbs up and they got over 1200 impressions.
I'm wondering what it was about how I put that poll question
together that didn't make it very popular to respond to do.
You think, did I respond to it? I feel I know I saw it and then
I don't remember if I clicked my answer or not.
Well, I don't know. I don't know if you did.
I don't have that data point. We'll just say I did because I'm
a, I'm a, I'm a good, you know, partner in crime on this type of
stuff. Yeah, yeah.
So, you know, I think with the whole non human identity topic,
right, that's getting all the attention.
But then we talked about device identity a lot and you know,
like my perspective has been, I don't really think a device has
identity and I'm starting to change that opinion.
So I'm, I think within the whole non human identity realm, you've
got workload identities and then you have device identities.
And really it's this whole, I think at the core of why a
device identity is even important is this whole shift of
identity is at the center. Identity at the center, of
course, is the name of our podcast.
We could take full credit for that from, you know, six years
ago, but the idea that, you know, firewalls used to
basically say, all right, you can either come in or not come
in based on IP address and port and things like that.
And now they're getting smarter where, you know, they can
actually use authentication. And then when you think about
zero trust, you're not just talking about the firewall, but
you're talking about the infrastructure layers below the
firewall and you're talking about traversing from one
network segment to the other. And should you simply do that
based on IP address and port? Like, no, some devices and some
identities should have access to certain network segments than
others. So to me, like there's where
we're kind of like circling in, but I'm still trying to wrap my
brain around this. And I would say basically the
community either, you know, is kind of like where I have been,
which is like, I don't even know what that definition is, or you
know, there's a mix of answers. I think most people came to a
divisive role in authentication, which kind of makes sense.
A few, only 5 people out of the 55 said the accounts local to a
device, which I think is this non human identity piece like
25% said something else. So anyway, you know, I think
that there's confusion on the topic out there and what I want
to do is have some podcast episodes where we talk about
this and kind of start to solve or at least put an answer behind
it. The official identity at the
center answer behind What is the vice identity?
Got it. Well, I just looked it up and I
didn't vote, but I just voted now.
And I think it, I, I tend to think of device identity as the
device's role in authentication because the other options were
the accounts local to a device. I feel like that's more like
local, local account management or something like that.
But I think this is an area where context matters maybe and
who you're talking to, because maybe I'm approaching, OK, well,
that's what makes sense to me from authentication standpoint.
You know, while somebody who maybe does like, you know, MDM
work all the time or, you know, endpoint management might be
thinking of a different way. I mean, IM community is really
good at having multiple definitions for the same thing.
So you kind of have to know who you're talking to and making
sure that you're communicating effectively to make sure you're
on the same page. That's, you know, I don't want
to one up you man, but you know, 1000, you know, impressions.
I had 5000 on when I asked this week.
I got a lot of really good answers to a question that I
posed on LinkedIn and I got to tell you that I am brain trusts.
The hive mind of people on LinkedIn came through.
I was asking a relatively vague question around device identity
essentially. So this idea of tap and go, but
without the tap part, almost kind of like an ultra wide band
key or some sort of proximity authentication.
The challenge being what if you have multiple people in the same
room? How do you identify the right
person as part of that? I gotta tell you, after 5300
impressions and a whole bunch of views and like 30 or some 40
comments so far and counting, I had so many good people like
reach out, put their thoughts into it.
So there's no way I can reach out to everybody and thank them.
So I'm just going to like as many comments as I can.
But if you're listening to this and you posted, thank you so
much. If you reached out to me on D,
you know, DMS or whatever, maybe I know I've got a couple
meetings already set for next week to kind of talk through
options, but it's something that's, you know, it's called
like AI don't call it a pet project, but it's something that
I've been thinking about. It was like, OK, is there an
option in this space where tap to go can be just go or be and
go or something like that? So shout out to the I am experts
on LinkedIn for, you know, for taking a look at that and taking
the time to to respond. So I appreciate that.
I think LinkedIn, like any social media platform, has
algorithms, right? So you posted that you started
getting comments. LinkedIn picked up, hey, this is
a really popular thread. We're going to show it to more
people. More people see a more people
comment becomes viral. Obviously I posted mine my poll
in it, but was not a very popular topic.
So maybe we should have a bunch of we should not have a bunch of
episodes on this. But I still think it's something
that we need some clarity around.
But maybe we should have something on top and go.
Yeah. Well, I mean, I don't, I don't
know what's there yet and what's realistic because I think some
of the caveats I throughout were like, OK, not proprietary, give
me something that's built off open standards.
You know, maybe it's something that we can use Fido
authentication for. Maybe it's something already
exists elsewhere, SAML open ID and it's just putting the pieces
together. But yeah, I mean, this is the
great part of running this podcast.
Like I don't have valid answers. You don't have answers.
Let's find smart people who do and get them on and, and ask
them about it because I'm sure other people have, you know,
somewhere or questions or, or things that they can contribute
to. So it's not a, it's, it's not a
race. I, I'm not, you know, it's, it's
not that I got five times as many impressions of you.
That's not what it's about, Jim. I've only said it like five
times. Hey, by the way, I did one post
one time and it got over 10,000. That's.
Great, I, I, I only, I only bring it up because like I've
never, I don't think I've ever had a post that had that much
traction. Like even when I do the podcast
weekly that's, you know, maybe a couple 1000 something like that.
That's just people, you know, checking out our new show.
So for whatever reason, this idea of non human identity and
password, more user friendly, password less right,
frictionless or friction, less friction I should say, from
authentication seems to strike a chord.
And I'm wondering if we can I, I let's put something up around
that. I think we should just show
about it. Absolutely.
So hey, if anybody's listening who has a strong opinion, vendor
agnostic, strong opinion, reach out to us questions at idac.com.
It'll get to Jeff and I and we'll try to do something.
Or if you're a vendor with a strong opinion, come on, we're
on a sponsored episode and we'll get your, we'll ask you
questions about it and get out there.
So absolutely, yeah, we got a couple conferences that we're
going to be at later this year. One that we're not going to be
at, but we do have a discount code for is the Gartner IM
Summit taking place in London this March 24th and 25th.
If you use the code ID AC425 you save and I'm not sure if it's
€425 or pounds, you will save 425 of some currency for that
region which is better than nothing for sure.
It might be rupees it. Could you know?
Who knows? Maybe it's, you know, League of
Legend gold coins. Who knows, You will say 425 of
those. It's not 425 bitcoins, I can
tell you that. No.
Yeah, if you got 425 bitcoins, you're probably doing right.
But that's a conference that has been nice to have to extend out
a conference code for people to take advantage of.
I'll have it on our, it's already on our web page,
idacpodcast.com. I try to keep all of our current
discount codes on that. So we've got the Gartner IM
Summit in London again, March 24th and 25th.
One that you and I are very excited to go out, we've talked
about a couple Times Now at this point is the European Identity
and Cloud Conference in Berlin, May 6th through 9th.
If you use the code ID AC25 MKO, you get 25% off.
And so you and I are going to be out in Berlin for a week
roughly. I think we're putting together
what some podcasts might look like and hopefully we even have
time to actually attend the conference and not just be in
recording room the whole time. Yeah, it's going to be so
exciting. I mean, I've never been to
Berlin for great things about the city and I've heard great
things about this conference. Heard that.
It's like information you know will be coming out of your ears
by the end. And I can say the organizers,
obviously, we've had Martin on the show, He's had us working
with this conference team. Marina has been super fantastic
about, you know, helping us coordinate our activities while
we're there. So yeah, we're going to record a
few podcasts on site and like you said, get to enjoy the
conference a little bit. So hopefully we'll get to meet a
lot of you there. And the conference code,
discount code will help you save a couple bucks.
Yeah. And then hot off the presses, we
have Ideniverse 2025 that is in Las Vegas, so June 3rd to the
6th. If you use the code IDV 25-I D
AC25, you get 25% off. I know that's a mouthful.
Again, the links will be in our show notes.
They'll be on our website and you can check it out there.
But that's another one we're looking forward to.
We've got some exciting plans that we probably shouldn't
announce quite yet until we have things kind of sign sealed and
figured out and, and well say delivered, but planned and ready
to go. But if you like prior conference
activities that we have done, we may be doing something similar
at ideniverse. Is that vague enough, Jim?
Yeah, I don't know. Anybody's going to figure it out
based on that? But two fives wild.
So that 25% off for ideniverse 25 IDV 25 dash IDAC 25 code.
I mean, look, it's if you, if you can get to a conference this
year, if you're US based, do it. It's a fun conference too.
There's a lot of really smart people that'll be there and you
learn something. So I'm a fan of it.
Obviously, hats off to them and thanks for them for their
partnership on it. All right, why don't we turn to
our guest because he's been patiently waiting in the wings
here for wow, over 10 minutes. I promised 5 to 10 minutes.
Over at 12 minutes. Let me welcome to the show,
Steven Washington. He's the head of IAM at Discover
Financial. Welcome, Steven.
Hey Jeff, Jim, pleasure to be here.
Looking forward to to a wonderful show you guys have.
Well, thanks so much for taking the time.
And is this your first time being on the show and hopefully
not the last. We'll find out at the end if you
still like us or not. But tell us about your I AM
Orange story. How did you get started in I Am?
Is it something that you chose or did it choose you?
It shows me, I went to college, I got my degree in computer
engineering. I wanted to be the best Java
program in the world. I'm like, yes, go Java 2, Struts
all the way. My first job out of college.
And they said, yeah, you going to start managing, you know, web
service like, OK. And then they said you need to
manage LDAP directories like LDAP.
What is a LDAP? And until this day, you know, I
I realized how the godfathers of I am basically was Novell, you
know audio dev directories and I still use it's called LBE dot
jar is why it was the greatest LDAP browser utility ever
created as I started using it in 2001 and I still have it on my
computer today. It can do wonders and it's a 25
plus year old Java Java. So I'm not familiar with this.
I guess what makes it timeless in your mind that it's held the
test of 25 years on your? And about two, about 2010 I
think Soft Terra must have found no way to take it because they
had the same exact interface. It was just modern.
But the thing about it is you was able to use every feature
possible in terms of certificates, you know, and do
things that you couldn't do with modern security controls.
So I was able to connect to almost any Active Directory
domain, you know, Oracle directory, I mean, almost
anything. And then I love virtual
directories. So I was able to actually use it
and kind of play around with, you know, multiple directories
or through one proxy, you know, way back in the early 2000s.
I remember Softerra, that was the.
I used their LDAP browser as well, but probably not to the
level you were. I was looking at maybe 1 or 280
domains and then I think I was using it all for.
Also maybe some sequel stuff. I don't remember, but I was
definitely not a pro with it. But you mentioned the word
software. I was like, oh, I just had a
flashback. No.
And I mean that interface was exactly the same thing.
It's just that this was a matter of fact.
It was Java Swing, you know, user interface.
So it was old school. So tell me about your role as
the head of IM at discover Financial.
What does that mean? You know, tell me, like, what
does your like day-to-day look like?
Managing the largest team in cybersecurity at Discover
because as you all know well, I am has the most challenges and
also the most opportunities. But we are deployment and I tend
to call I am cyber adjacent. Some people like it when I do,
some people don't, but I call it cyber adjacent because identity
is really a combination of infrastructure, services,
cybersecurity and risk. GRC like risk management, it's a
combination of both of all three.
So it is that it cannot fit in just one specific space, but
most times it's either infrastructure or cybersecurity
and that discover we are withstand cybersecurity so.
Cybersecurity adjacent? I guess I've always thought of
IM as in cybersecurity. What makes it adjacent for you?
So if you think about what the the major utilities, the Igas,
the IDM, the the vaulting solutions, they all are
basically shared services, which means they have a large
component, which is infrastructure base.
And you think about it gives more focus on resiliency,
operational overhead, consumption, you know, and those
are more infrastructure services.
When you think about cybersecurity, you're not
thinking about that. You're thinking about sometimes,
you know, governance risk, thinking about, you know,
security incident, response to tech, you know, response.
Those are kind of the areas of cybersecurity that most people
think about. But identity is kind of like the
that mixture of it has more products within it.
So managing a product life cycle you are already doing more
infrastructure based services than strictly cyber.
I was looking through your LinkedIn profile, doing a little
soothing and saying who is this guy?
Steven? I noticed you've spent some time
consulting and we have a lot of consultants.
Jim and I are consultants ourselves, you know, that are
listening and I'm curious what are some of the things that
prepared you for your role? Because y'all still work at
Freddie Mac and you would discover now, but what are some
of the things that you did as a consultant that really kind of
prepared you for roles, we'll call it in industry, right?
Or civilian lifes maybe I might call it.
No, no, I have a really good story about that.
I actually went from engineer, developer, architect, but I
wanted to learn more about, you know, how to run a business.
So if you look at it, my pathway went from big pharma, big
retail. Then I jumped to a startup.
After the startup, I spent a few years there and I understood how
to run a business when there's less than 10 employees.
You have to basically wear every hat when there's less than 10
employees. But then I went to Deloitte
after that because I said, OK, I know I don't run a business, I'm
learning it, but how do I articulate what it is that we
need? Like, how do I get people to
yes? My biggest mantra is I'm going
to get you to yes. People say no by default.
So as a consultant, the job is to understand how to do
PowerPoints, how to do decks, and how to communicate the
vision, the operator model to the right audience.
That's the most important part is to the right audience.
And when you focus on that, you can basically sell anything.
And I leverage that because now in financial services, everyone
wants to say no. It's just, I mean, it's
corporate America. It's easier to say no than to
say yes, so. I kick them to to yes by doing
one thing. If you tell me no, I say why you
give me data, I'll go back and use my consultant net and craft
another or a better story to come back to me and say, well,
you say no because of ABCI saw it for that and then here's more
data. Now do you say yes and at some
point in time that iterative process, they are going to say
yes or say, Steven, get the hell out of here.
So. Stop bothering me, Here you go.
Just get it done. One more question I want to ask
you. I know we're going to talk about
like user access reviews and, and maybe get some of that, but
so there's a lot of people that I've known as wanting to get
into IAM. What would be a word of advice
that you have for people who are looking to get into IAM as just
the start of their journey? Or maybe they're looking to
pivot into IAM from some other field?
That is one of my favorite questions, Jeff.
Let me tell you why is you can learn almost every other aspect
of cybersecurity through a class, through a course, through
some training, but you cannot learn I am through a single
entity at all. You have to be broad in your
skills to do I am. You have to know a little bit
of, you know, operating systems, you have to know about
directories, you have to know about networking, you have to
know about firewalls. I mean, especially today,
everything is cloud based. If you don't understand the
simple proxy, reverse proxy, how to open up a point, you're not
going to do well here. Even things as simple as IDP
configurations now from cloud to cloud, SAS to SAS, you have to
be well versed in everything. So one of my favorite sayings is
Jack O or trades master of none, but oftentimes better than a
master of one that that creates an iron professional.
You have to know a lot about a lot, but you don't got to be
super deep in any one thing to be amazing in this field.
Yeah, I really love that answer. I think what I would add to it
is you mentioned a lot of the technical skills you need, but
you also need to have business skills.
You need to know things about human resources and how the
business works. You have to at least be geared
toward that to be really great as I am.
I also thought it was funny when you're talking about consulting,
you brought it back to how do you sell things?
But no, how do you sell an idea? So that is pretty funny.
And as Jeff mentioned, I'm going to drag you down the route of
talking about user access reviews.
But before that, when we're talking in the beginning of the
show about the idea around device identity, it almost
looked like you wanted to jump right into the conversation at
that point. So I was wondering, did I, did I
see that right? And is there anything that you
you wanted to say or that you were chomping at the bit to say?
Absolutely, I said this is their show, so let me be quiet and
stay on mute until my time is up.
However, Matt Atkins, I'm going to have the floor.
I'll take it. But I think of device identity.
It's, it's so important that we think about every device we
have. I mean in my house alone,
there's probably 6-7 Alexis 810 series.
I mean every device has some type of access management
component to it. But I like what you said Jeff,
about when you think of it, you think about the authentication
piece. Well, what folks don't realize
is every device is doing a form of authentication, a lot of it
sometimes anonymous, a lot of it is some form of PKI, but is
doing something or phoning home. And that's the part where it's
tricky because most, most cyber professionals don't even use
those, you know, home utilities, like they say Alexa is disabled
anything else. But in general, Jim, I think
it's just device identity exists.
We need to find a way to actually manage the life cycle
just like we do human accounts and not human accounts, you
know, And it's only get to a point sooner than later where we
just have objects, identity, objects.
Everything is looked at through the lens of identity.
And ironically, I'm going to use your pun, but yes, identity is
at the center, the center of everything.
I mean, identity is the front door.
And what I say is to a house, identity is the front door.
But also when you go to each room, each lock on the door is
another layer of identity. And then over time we get to the
point where as you in your kitchen and just hanging around,
you would have something doing a check on should you still be
here? And is it still your own, which
is a deeper layer of identity. So it's it's definitely at the
center. Yeah, it's crazy.
You hear identity is the new perimeter, then someone will say
the next sentence. Identity is the center.
So it's like identity is everywhere.
Identity is the the whole kit and kaboodle.
This could have been that could have been the name of the
podcast. That's too long for that's too
long for a URL, so just keep it at IDAC podcast.
You can. You can use a TinyURL Jeff.
And you can use a TinyURL Sir. So.
Security people don't like tiny URLs because you don't know
where you're clicking on. We found that out early on where
I was like, all right, we had to think.
A sponsor gave us a TinyURL and I got so many emails about.
Secured. Yeah, you should not use tiny
URLs like I understand. I get it OK.
Yeah, OK, here's a QR code. So OK, let's talk about user
access reviews or what I've used traditionally called
recertification. I don't know if you even use
that term, but you would user access reviews, you know, you
see them used a lot in financial services and heavy heavily
regulated industries. I say 5-10 years ago outside of
heavily regulated industries, people question should I even do
this thing right? The only reason financial
services is doing it is because they have regulators making them
do that. So 1, is that true?
And you know 2 like where is the value?
Is it just to be compliant with regulation or is there something
more? We have a good question and I'm
thinking now don't want to answer it positive or the way I
already feel, let's go positive first.
So you are absolutely correct in terms of regulatory just
environments which is course multiple industries.
There's a ton of value in use access reviews because it is
both a detective and really a corrective type of control.
The end of the day is done to say, hey, should Jeff and Jim
still maintain his access? And if they shouldn't let me
create an action where I do an attestation and say Nope, I want
them out and then some technology, some tool goes and
remove them from that access. And for small and mid sized
companies, it works really well because there's not a lot of
bloat. And small and mid sized
businesses, the larger the company is, the more job roles
of companies are really strong. When I say on our back, you
know, Rd. based access control, the more our back you use, the
larger your access role environment is going to be, the
more access certification use access reviews you have.
Once you hit that threshold, now it becomes more of is there
value in this or is it just a check box activity?
So I have a person who I have people in multiple companies
that they have to attest or certify over 1002 thousand
users. And sometimes it's twice a year,
sometimes it's once a year, saying things like privilege
access, maybe every quarter, depending on the standards or
the requirements of the company. When you have to do something
this frequently, if the user interface isn't smart, most
people tend to just do a check box activity.
They say, you know what, we just got a blindly check it all
because I don't have the time, the bandwidth or the
understanding of what's needed. And when you think about that or
kind of, you know, like traveling that out, if that's
being done, let's say 50% of the time, where's their value in it?
But their value does come from the auditors, the regulators,
because that's something that they can say, how do I trust
that you're doing something? Something is always better than
nothing. I mean, we can all agree to
that, but at least I have a name associated to a decision.
And that's why the biggest value of use Access reviews is you
have a named resource making a decision on access.
Regardless of how they made that decision, that certification is
important. And that's needed because for a
regulatory body, they can say, OK, 99% of these folks attested
in the positive, great, 1% they're not.
But all the access has been certified.
I can take that and support any action or decision the company
needs to make. So it is.
So that's the value in that just overall.
So you're kind enough and diplomatic enough to take the
positive side, I'm going to take it down the negative side a
little bit and see if you agree with me.
Are user access reviews a reaction to poor life cycle
management? Meaning we have to do user
access reviews because we just don't do a good job of cleaning
up accounts and accesses that shouldn't be there after they're
no longer needed. I did not know that question was
coming, but I would say that that's a perfect segue to, to to
what my vision is in terms of what I've been designing for
user access reviews. You are absolutely correct,
Jeff, and I'll take the steps further.
The way that I think about this is the reason why they exist in
general is because now your life cycle management is really the
access chain is how do I know that Jeff is using his access?
So if you really think about it, let's give an example.
If I say, hey Jim, you have access to application A, but I
modified my standards, my requirements to say a user
should only have access to an application for 30 days.
After 30 days, the access is automatically removed.
That means that Jim access the application day one.
He gets in just fine. On day 32, he tries to access
it, he says access denied. But so that alone is great.
But then it becomes a really poor user experience because now
Jim has to go through a whole access request again.
No one wants that. But in terms of, I mean, we in
2025, we have so much tools out, so many tools out there that are
great. So let's add some orchestration,
some ID PS into it and say on day 32, Jim goes to the
application, the IDP says, Nope, you don't have the right claim,
the right access. However, it makes a call, was
Jim approved to have his access previous?
If that answer is yes, then they can actually go ahead and give
Jim the access again, because the standard states is only
going to be good for 30 days because of that.
That process makes it a great music experience.
Jim doesn't have to lose his access, but there's no standing
permissions. Jim doesn't have the access more
than he's needed. And if there's a need for a
certification, then it's probably going to be empty
because most people don't use applications, you know, day in
and day out. They already don't.
I didn't give you, I mean even AHR tool like a work day which
is really generic. Almost every company has it.
You use it maybe to do your goals or a check in right?
Like you're not using tools all the time.
Steven, I wanted to ask you what you meant about UI, but I think
that's going to be part of your answer to my different question,
which is, you know, so Jeff and I are very fortunate.
We get to go to a lot of conferences doing the podcast, a
lot of vendors reach out to us. We see a lot of demonstrations
of IGA products and the amount of innovation that's still
happening in the space. IGAI mean it's it's been around
for quite a long time, right, But people are continuing to
innovate. I'd say why is that?
What are the innovations that to you are exciting without getting
into specific vendor names, right, Yeah.
Yeah. No, no, no, no.
I think that the biggest one is the use of AI of causing ML
right the end of the day. Let's go back to the example I
said of the individual that had 1000 access request.
He had the test. Well, AIML now has the ability
to go look at it and do some of the things I mentioned.
Hey, when was the last time they used this access?
Hey, did all their team members use the same access?
So now we can have more smart IGA, more smart services to say,
hey, Jeff out there 1750 are because of the team name, the
team description and they're all operation and support.
They should have that. You can then say, OK, I'm going
to blanket approve that because those 750 I don't have to look
at now you're down to 250, which is much more manageable.
But then the AIML can do even more stuff and say, hey, only
about 25 of these are privileged.
So now that 1000 goes down to 25 and what you're doing now
hopefully is saying, let me, you know, you use a fine tooth comb
and go through those 25 each and hopefully remove actions that
shouldn't exist or just say, yes, they all should be
maintained. So that's really where the
innovation is coming from, Jim. Yeah, I think, I think that's a
a huge innovation is the AII also see back end changes that
are happening where it's like no longer are these IGA systems
running on a relational sequel database, right.
They're running big data platforms and allowing
organizations to identify what is identity data to them, what
is risk data to them or data that can be part of the risk
story. So if you start to say what is
not only what am I using, but what am I not using, that is of
relevance, right? So if I don't look at the
cafeteria menu or are you going to take the cafeteria menu away
from me? Like what's the point is 0
value? The value is I've got a very
powerful role in a very important risky system.
Now let's challenge on something like that.
Well, you know, I've got to be able to draw the connectivity to
that, that risk level and that might be very specific to my
organization. No, no.
I would say it is, Jim. I like it is really well around.
I love the construct of an identity data lake.
And what I mean by that is we need to basically put all our
identity data access management, data access row data request
data access chain and data. And you're right, seek SQL
databases aren't always the best for that.
Some of the new graph kind of DBS already good.
But the whole point of this is now if I have to do something
like give to a regulator one order, they say, hey Steve, I
want to know all the access that was provisioned for this
application over the last six months.
Well, right now I'm going through my tools and extracting
reports and doing some pivot tables or some V look UPS.
That's a lot of work. If we have orders in like a data
lake, I can easily create a query to pull that data, but now
I can also align and correlate it to an access request number,
let's say a service now that ServiceNow request and then they
can actually see that it was actually done and they can give
the reason and the description or in place.
So using that data from let's say a data lake, you can now
pull from now only the access request data, the life cycle
management data, any friendlers access as well as any
pre-existing certification data. All that is now combined in one
location where you can do easy queries to extract that and make
better fine grained decisions on the actual real data.
Yeah. So let me let me ask this
question. So obviously we talked about the
AI and kind of like narrowing the focus on the important
decisions. Is that really also being driven
in part by what we call identity fatigue?
Just, you know, it winds up in a large organization where there's
a few people who become I, I don't want to use the term
bottlenecks because it sounds so negative, but the idea that they
wind up becoming the person who approves or disapproves a large
amount of access and really trying to tailor identity
becomes an exercise so that they don't get overwhelmed and start
rubber stamping access. Is that kind of the driver in
your mind? That's the largest driver.
But I guess in addition to that, you also have identity.
I call it identity hygiene. Most people do it now.
It's the hygiene part has been what's been missing over the
last decade. We all, even tools, products,
vendors, startups, they all want to do the action.
Let's make a better IGA. Let's make a better LC and life
cycle management. Let's make better tools to
actually and better products so we can sell the product.
But what if we get is the cleanup is actually more
important because you can have one of the best products in the
world if you keep on provisioning, keep on adding and
never clean up or remove your actual audit data is poor
because the hygiene is poor. And that means that now more
people are doing request and guess what?
That leads to the fatigue because now it's saying, I don't
know why I'm improving this, but I've been doing it for seven
years. They could be no one even use
the application can be gone in the environment where people can
still be potentially approving that access because it's the
name you know isn't on the sheet that comes across every six
months. You know, I've, I've seen some
scenarios where the access review with AI looks like this.
So Steven, Jeff works for Steven.
Steven, here's the access that Jeff has.
And then AI highlights 3 or 4 entitlements that, hey, you may
really want to look at this. So if you're Steven, you're only
going to look at those three and ignore the rest, right?
So why even show the rest? Is it because some organizations
just say, hey, we have to, we have to check this box from a
regulation and compliance standpoint.
So we're going to show all 25, We all probably agree it's only
the three that matter. So it's, and I, I know I'm
asking a super generalized question.
It probably depends a little bit on the situation, but do you
feel like that's something that regulators are going to push
back on and say, no, sorry, the rule says you got to review the
access. So you need to look at all 25
and you can use AI, they kind of point people, but you can't
eliminate 22 of them. So really good question and I
have a great answer for that. If you think about this, Jim, if
he didn't change anything in the organization and you brought in
a tool to do that, that would not pass an audit exam, it would
not pass a regulatory exam, because even though it's better
and it's actually reducing more risk and it's actually a better
hygiene. Most companies, the auditors,
the regulators, their job is to validate what you have written
in your standards and your requirements.
Think about it as like a soft skills.
A lot of engineers like working and consultants like the hard
skills, the hands on, the tangible skills.
But even when it comes to things like access reviews or just
anything that's audit related, you have to focus on changing
your actual requirements and your standards and your policies
by changing that. If I just change the line, Jim,
and say we're going to certify multiple times a year, access
that is determined through a systematic slash AI generated
method, the ones that need to be reviewed, then I can now use
that because the auditor, the regulator has to look at what
the requirement is for our organization.
OK. So you have to kind of take that
step wise approach where you first change the policy and then
you comply with your own policy. That makes sense to me.
You got it. Last thing I want to kind of
explore when it comes to access reviews is what is your advice
for the practitioners out there who are maybe doing access
reviews the old fashioned way or let's call it IGA Gen. 1?
Are we really now at IGA Gen. 2? Do you think if I wait a couple
years, it's going to be dramatically better and I should
sit around and, you know, watch what happens in the market or
Yeah, what are? Your thoughts are, I would
think, I would say the last conference I went to a few
months ago, there was two complete rows of just IGA
startups and vendors. And even though to me that seems
like it's overkill, it actually gives us hope because that means
people are now invested heavily in doing this.
Not not the best, but doing it in a way that is modernized and
that's more efficient. So at some point in time having
access to the data is going to translate into leveraging tools,
slash processes to be able to make better decisions.
So right now we say IGA one is the normal HEXA certifications.
Do IGA two, we going to skip Gen. 2V2 because right now V2 is
now adding AIML into it, but it's still in its early states.
The next generation is going to have that more hard and fast.
I guess it's going to be modernized, it's going to be
tested. But even the vendors have to
understand it can't just be by the technology.
You have to look at it as how can you approach some of these
regulatory bodies and these compliance bodies and say, hey,
will you be OK if our solution shows you this?
Because that's how you really get to the next level is
companies can just say let's have the best product because it
does have the best product that can comply with water
regulations out there. Well, I think the best product
is what you can afford. Also, I think there's an
underserved market for IGA. Where you've got the big
behemoths and we all know who those people are.
Those companies, there's a lot of companies that can't afford
those types of things and there's a lot of good IGA or you
know, sometimes they're called IGA light vendors that are also
helpful. But even those vendors I'm
seeing kind of what their pricing has been and it's there.
There isn't a fine, there isn't much of A financial benefit to
just say, OK, well, for, you know, 10% more, 15% more,
whatever the number is, right? I'm just making them up.
I can go with a tried and true, you know, established, you know,
world class, you know, partner of this.
Or do I gamble on something that is nobody's ever used before and
they might have a great product, but trying to get in the door
without references, without a track record.
I feel like in that case, and I'm focused mostly on small mid
sized businesses, they don't have the money to afford, you
know, an upper right garden or quadrant for the most part,
unless they are heavily regulated or maybe they've had
an impact, you know, an incident or something like that, right
where they have to do something about it.
Do you have? Does that make sense?
It makes sense if I want to chime in on something from Even
Jim Said, how did the Kermit practitioners do this?
In most SM DS? A lot of people do.
This was just spreadsheets today.
So let's talk about tools. Spreadsheets today are easy.
Some of the easiest ways to go ahead and say, hey, I've done my
Access certification because depending on the volume, if it's
only to say 50 people in a company, you can do that for
these. Now most, let's say financial
companies or companies have the alliances, say PCI as an
example, PCI 4 point O, you know, rig was published and came
out truly like last year, but it goes into effect starting this
year. There's a requirement about
service accounts, not only my identities having to be kind of
certified. Most IGA tools today don't
really do service account or not humanities.
Well, like they're not because it's not as simple as just
pulling from an existing, you know, life cycle management tool
and it's showing on the screen, hey, accounts entitlements.
So because at PCI, four more companies are trying to not get
into service accounts or non human identities certifications.
And it's driven because now PCI is saying you have to do this.
So sometimes the regulations and the and the regulators kind of
help lead and define where the industry is going.
And that's a very positive thing.
That's a great point. Yeah, I mean, there's a lot to
unpack there and I think I want to try and take advantage of
your big brain when it comes to the stuff.
I, So we have a listener out in the western part of the US, Bert
and he and I were trading a couple of messages on LinkedIn
and he wanted us to do a podcast on how in scope companies can
comply with NYDFS. And I'll explain in a second
because one of their IM requirements is periodically,
but at a minimum, annually review all user access
privileges and remove or disable accounts and access that are no
longer necessary. So first of all, let me explain
NYDFS because we have people around the world and people not
being familiar with that. NYDFS is the New York Department
of Financial Services, and they have a cybersecurity requirement
for financial services companies that operate in the state of New
York where they have to have a cybersecurity program and
certain controls to, you know, maintain confidentiality,
integrity, availability, right, all those types of stuff.
And of course, if there are cybersecurity regulation, there
are IM components, and one of those is this idea of doing user
access reviews. So I want to bring this back to
you because obviously, you know, this is something that's
probably near and dear to your heart is can you talk about
NYDDFS and specifically the user access review component of that?
How should financial services firms be looking at how to
comply with that? What should we be looking at?
What should we be certifying? What should we not be
certifying? And are there any gotchas or
things or tips and tricks that you might have?
No, absolutely. So NYDFS, I've worked for a few
companies that have been in scope for that, but I'll make it
a little bit more broader for like the entire audience.
I mean, think about NYDFS, think about the Federal Reserve Board,
FDIC, you can think about even socks, you know, socks
compliance, sock one compliance. They all have these similar
requirements. And sometimes the best way that
tell people to kind of point them to is if you have a
security program alliance with the NIST cybersecurity
framework, you go into naturally 99% align to everything else, to
whatever it's already bodies because most of the bodies pull
from things like NIST, I mean, other frameworks as well.
But the NIST CSF Cybersecurity framework, especially that 2.0
is where a lot of the government cybersecurity programs, the
NYDFS and others are pulling from.
And they're really important of access reviews from NYDFS or
anyone else is really defining what is the scope of the access
video meaning newer heading Jim mentioned earlier or something
like Adobe or something like that.
Do I want to a test or certified Adobe Acrobat Reader?
What's the value of something like that?
You know, it's just a it's a product that most people have
Chrome, I mean web browsers though, is there really value in
it? Now there's a financial Sox
tool, there's a ton of value in a testing there.
The problem in the industry is this everyone have not scoped
out the applications or the access that truly require it.
So a regulatory body or an internal auditor or they can do
is say show me everything. And that's the.
That's the biggest issue. Without having that scope
clearly defined, you have to produce everything for because,
and it does make sense. It's like if you can't tell me
exactly what's in scope, I have to see everything.
I like that idea of scoping because I do see that as an
issue. I think one of the main things
to consider in this might be non public information, right?
Who cares about the stuff that is public?
It's public while you're reviewing that access.
But I think one of the areas that maybe helps fine tune,
right, what you should be looking at are what are the
things that are not public? And then from the non public
information, what are things that do carry the risk factors
that might be associated with either data breach or, you know,
maybe it's transmission of that data, obviously customer data or
you know, things like that. I love that idea of getting your
scope right because if you don't have the scope right, it's like
you said before, you know, my experience, auditors, they're
just checking what you're said you're going to do.
And if you haven't written your policy or your standard or
whatever it is that you do, you know, to to articulate that and
you leave it open to interpretation, that's where you
get into trouble. So I think if you craft very
well defined policy standards and processes around what are we
looking at, you know, and try to leave as few argument points as
possible that someone can go against, you'll be in a much
better position. Does that make sense?
No, it makes a lot of sense and, and even more so, there is so
much value in taking the time to architect and design the
processes for a program, for an identity program.
And what I mean by that is I'm teaching my own organization, my
team. Don't just look for technology
to solve the problem. Create a process that you want
to solve for and then you can look to see, do you mean
technology or do you just need, you know, people like not
everything is solved by having a just a big as hammer, you know,
and. But we bought IGA, it's going to
solve all our problems. If that was the case, the world
be in a better place. And I don't haven't talked to
any regulators or auditors in my life.
Unfortunately, even they don't like automation.
I mean, I mean we always have some automation and we got
scripting languages and we can do all these wonderful things.
Even when you give it to them, they are saying the next
question is, well, how do I know this is complete and accurate?
And it's like, oh, so the end of the day is trying to be fancy
with the regulators and the ordinance does not work.
It's. It's simply giving them your
scope and saying. This is what we're doing for our
scope. Now they could always argue all
their points, right? You should be looking to start
thinking, OK, well, that's a different discussion now.
It's not what we're looking at is what else should we be
looking at? Which is probably a better
position to be in. I guess I've, I've had the right
management responses in the past.
They're not fun. Oh no, no, they are not at all.
And at some point the, the world and the industry and everyone is
going to start shifting to automation and AI and all these,
you know, cool tools that are still relatively cutting edge
for a lot of organizations. And auditors are going to be
like, you know, that the policy or the configuration is going to
be all right. Well, we do this through our IJ
platform and it's all automated. At some point, the others are
probably going to ask more questions around the how is the
product configured? What are the configurations or
policies that you've set up within the actual tools?
Do you have any thoughts or guidance on how you might want
to address that in the future for people who are listening?
Yeah, one of the first things is you have to make sure that you
train your auditors. And I know that sounds kind of
funny, but the end of the day. It's absolutely true.
It's so a choice. How much time do you want to
spend every cycle teaching them about what you're doing?
But even things, I mean, we all know that a policy based access
control is probably the best thing, but it's so challenging
and difficult to get to policy based access control no matter
what tools exist, no matter how much you try, because RBAC is
just easier. I mean, RBAC is just easy, you
know, even attribute based access control, a back, even a
back is a little bit easier, you know, But when it comes to
policy based, that is where it's going.
And once we can tie together that a policy is almost his own
requirement and that requirement can be tied to a standard, then
the auditors can actually start to take that because they can
easily correlate and take and tie this policy here is
referenced in this standard or policy or policy.
And I can actually control and validate that myself.
So we need to get there and doing weed automation is going
to work is that we actually get to the point where they can
trust the policy. But that also requires a lot of
training and teaching to to to let them know how this actually
works. It's interesting you said our
back and a back are easier. I think they're easier to
explain to people, to actually be successful in managing them,
to get the results that you want.
I don't know that it's easier. Yeah, I know I would agree with
that. I would say that it's the, it's,
it's the name, you know, like everyone understands our back.
And when most, most people who call me to do an assessment,
they always say, Oh yeah, we can talk about, you know, the best
our back model to use. And whenever someone says our
back model to me in the last 2-3 years, how they condemn with
trepidation like are you telling me that are back that they use
right now with this whole cloud size base just in time, no
standard permissions, Are you sure you want to go in there?
It's hard. I think there's a lot of
companies who wish they were RBAC and there's a lot of
companies that are RBAC and wish maybe they hadn't gone on the
RBAC route. It's, it's difficult to do.
It's, it's why I typically will encourage organizations that are
starting on that road to maybe focus on attribute based access
control because they feel it's a little bit more of a, of a hill
versus a mountain. It still requires good data,
right? And the, the, the idea is like
throughout any of these back models, whatever they are, is
you still need data to drive that.
And I feel like most organizations, even if it's just
basic attribute based access control is, is the person an
employee or not? That might be, as you know, that
might be as grand or as you can get based on the data, But hey,
at least it's something and you start working with your business
partners on the HR side, right? Hey, if we got this data, we
could do this thing, right? And I think it's funny, you
mentioned training auditors and I think that is the importance
of establishing relationships with other groups, right?
If you are, if you have a good relationship with your auditors,
they can be advocates for you. I think a lot of times they come
in as the enemy to some degree. But if they understand how
you're operating and you've trained them, you've educated
them on, look, here's what we're doing and you actually engage
them in a pro proactive way and say, hey, here's what we're
doing, what am I missing? You're going to audit me, Tell
me what I need to be looking for, help me out here.
Their job isn't really to get you into trouble because most
likely, especially in the bigger organization, and feel free to
correct me, am I wrong? You have an internal audit team
that does like an internal check and then the external auditors
come in and those are the ones you want to be very concerned
about. So almost like a catch before
the real audit comes through. That makes sense.
Absolutely no. I tell everyone this internal
audit, which we call the DARE line of defense, their their job
is to be independent, but their job is the same job as first
line defense, which is normally us is to protect the company,
period. You know, when we look at them
as the bad cops, for example, we're not getting the best out
of the partnership. Yes, we can't share everything
because they have to still maintain independence and that's
important. Now the external auditors just
come in with industry best practices in the check box and
say we need to say are you doing ABCDENF?
And they're showing me that you're doing ABCDEN.
So you really can't build relationships with external what
it is as much where your internal audit program is there
to protect the company the same reason as you are.
Well, I appreciate you spending time with us.
I think there's, there's so much going on here.
And you know, this is one of those things where I wouldn't
say it's a sexy part of I am, but it's a necessary part.
It's plumbing, I guess how sexy it is, is based on the UI maybe
you've created, you know, maybe that can have, you know, some
bells and whistles on it. But I really appreciate you
spending time with us. I want to end the show on a
lighter note. We were talking and I just kind
of sprung this before we hit record here.
You mentioned that you are, you know, you're definitely into
fitness. You mentioned things like Tough
Mudder, Spartan Races, Pelotons, you know, working out.
Obviously, you and Jim can probably go on at this for about
an hour. I'll just kind of plot, you
know, not politely and stare at my Peloton row that's over here
that has been collecting dust. Tell me about Tough Mudder and
Spartan races and all these things that you're doing just to
sort of stay fit. And I guess explain them in a
way was like, OK, not everyone may be familiar with what these
are. Explain for people that aren't
familiar what a Tough Mudder is, for example.
So I get there. I want to talk about the why
behind it. The why is when you run large
organizations or just have a lot of work, I will work.
Cybersecurity is stressful. I don't care what anyone says it
is stressful is a lot of work and we all need a reprieve.
So if he would do that different ways, you know, health, healthy
ways are working out like crazy. You know, other ways are
drinking. I mean, whatever floats your
boat. But the end of the day, I got
into just physical fitness about five years ago.
Doctor was like, you had to want to make a change, Steven, or
you're not going to be around. So I said let me go all the way
in and make a change. But the Tough Mudder is an
afternoon course based race. You know my first one we did 3.1
miles like a 5K. But next we doing one in April
which is 15K. So you're close to 10 miles
roughly and it's about 25 obstacles.
And when I say that you get it's called Tough Mudder half the
half the obstacles that require some form of mud or water.
But when you already have mud and you go into a pool of water,
it will become muddy. And it's but it's fun because
it's not just a race. You got to work as a team, as a
group. And I think the reason I love it
so much is that it's about 10 to 15 of us who do it together.
And it's not about who can win. Because some of the races or
some of the after groups, you have to use 3-4 people to form a
base. Then two people have to climb on
top of them, then the one person have to climb on top of all of
them and then you got to pull each one up as well.
So it really is more teamwork in building that Comrado and most
of my workout partners, we all met during COVID 1 pedaton.
So a new one. COVID, no one was at gyms and we
just used the pedaton as a way to engage, interact.
Yeah, you know, Facebook groups. And it was, we said when it was
over, hey, let's meet up in real life and do some.
Physical activities, I love that.
And you mentioned you've got the whole peloton Armada between the
the row, the bike, the Tread, if somebody, which is your favorite
of those three because I've only used the the bike and the row.
So the tread is my favorite, but it's any any of the machines are
great. But I have such a competitive
spirit that the reason why I like Peloton is because the one
thing the leaderboard and some days I wake up and say I'm gonna
have a low impact day and I'll get on the bike.
We get on the tread. I do a nice job and if someone
will high 5 me which and like they're right next to me but
they below me in terms of like the output, but then they'll
high 5 me and then pass it. And my gut feeling is, is that
intentional? Like I'm fine.
That was like that peace dude, I'm flying past you.
I'm like, I'm fine too. So when I see that Jeff, it's
like here we go now turn everything up, take the shirt
off and now I'm just running. Now it's like now I was like,
OK, let me get to the six minute mile and let me see how long I
go with this and we out. I love that.
What's your What is your favorite and least favorite
Tough Mudder obstacle? The ice, the ice bucket, or the
ice pole is probably my least favorite.
OK, what is? What is that?
So is we ordered the ice bucket challenge from a few years ago.
We're basically in a bucket of ice or even going to like ice
bath is basically 2 ice baths put together and you got to go
underneath 2 walls or inside inside of the ice bath.
So you literally got to climb inside and then go under the
water. So it's all ice now and they got
to come up and then go under it again and come up.
And this is normally at the end of the race.
So it's you're already mighty. I mean it's just some people say
what is cleaning you up? No, it is still I can.
Think of better ways to get clean 7. 0° And what happens
right after that is the electrical shock.
So it's like a whole lot of strings of just electrified, you
know, tape and you got then went through that.
Have you just came out the ice mask?
So yeah, that is not the best part.
I think it was one obstacle that was fun.
It was huge tree logs and they had like little notches in it,
complete mud. And you have to literally throw
your body up or try to jump and grab on.
And it reminded me of when I was young.
I used to watch what is it American Gladiator and Jazz that
that show how we wanted to do things like that and you're
trying to like climb over, you know, like those rollers in
American Gladiators. So I always send a thing that
I'm back in the 90s and 2000s watching American Gladiator and
going crazy. Jim, I know you work out.
Jim, I've known you for what, nine years, 10 years, some like
that. And ever since I've known you,
you are religious about your workouts every day.
I don't know if you've ever done a Tough Mudder.
Is that something you would do? It's not so it's it's so funny
when I was listening to Stephen talk about why he started, how
he started, it felt like he was telling my story.
But I've been at this probably 15 years.
So I exact same thing. You know, I'd be in this
stressful world of IT and Infosec and I and the day like I
had to wind down. So it'd be a couple beers or
something and then you just start to realize like that's not
good for you. So I started running and you
know, I worked my way all the way up to doing marathons.
It didn't take really that long, maybe a year from going from,
you know, having a few beers after work to just I'm going to
go run for a couple hours. And what a stress reliever.
I did wind up hurting my back running and I started doing more
like cross training and trying to build up strength in my core
is what I realized was you get these really powerful calves
from running, but it doesn't necessarily build a strong core.
So I started building my core that led to more or less like
bodybuilding style workouts. And I love being strong.
I love seeing muscle in my body. It makes me eat better.
And you know, I truly used to do it because like I liked looking
better made me feel better about myself.
Now I just do it because it's like it's my stress relief.
It's my outlet and I don't know how I would deal with stress
without it. So yeah, that's it's very
similar story to Steven. But why I couldn't see myself
doing like Tough Mudder or something similar is like in my
old age, I've kind of realized like I can only do what I what I
do if I don't get hurt. So if I do something that's
going to risk injury, it doesn't mean you're going to get
injured. But you know, when I hear about
people doing things that are, you know, prone to injury, like
doing like dead lifting heavyweight and stuff.
Like jumping at a muddy tree log and trying to hang on.
That kind of stuff. I'm like, yeah, well, what if I
slip a disc or something and I'm, you know, out of the gym
for six months? I'm, I'm not going to do that.
So, you know, yeah, it's like super risk averse, but that's
kind of the reason reason I don't do things that are risky
like that. But that makes a lot of sense,
Jim. I mean, one other thing that I
thought about as you were speaking, Jim, is I also work
out about two hours a day because my vice is a grilled
cheese and French fries. So in order for me to maintain
when I'm traveling to have some fries when I want to pay to make
sure that I work out, but my 19 year old daughter says this
about me. She says my dad has two
explains. He's got the kids menu guy
grilled cheese and fries or he's like an 85 Wagyu steak guy.
And I said I mean she's not wrong, but it is like, hey, I
can go eat at any restaurant. There's a kids menu or I can go
to a nice steakhouse and enjoy myself as well.
That's actually. So now you're talking Jeff's
talk. Yeah, now I would say now you've
got me, now you've got me interested all.
Right describe your. Perfect grilled cheese What's
What's the right cheese for a Steven Washington grilled cheese
sandwich and the bread? Too So sourdough bread first and
foremost. I'm with you.
And now no cheese. Not better than American.
However, as we get older I realize American probably isn't
already cheese, but I'm say that for a different show.
OK so cheddar, white cheddar. I also like Gouda.
I like some Swiss and mozzarella so it's so it's a crazy
combination. But if I want to do 1 is like
the white cheddar. But I also enjoy Gouda cheese,
which is kind of odd because it's a more smoky flavor as
well. But sometimes I buy sourdough
bread and just cheddar cheese combination is great.
And some restaurants like like Melt is really awesome.
Even though if I had too much butter, I think they had like a
whole stick of butter for one sandwich.
But when you work out for two hours, you can do that guy.
You got a little leeway there. I'm with you on the sourdough.
I think sourdough is fantastic. I am a American and pepper Jack
mix because I want a little bit of a spice to it.
Not crazy, but enough there. And I'll never turn down ham or
bacon or something like that. But what I like is when we we
press the sandwich as thin as possible, like almost in
between, like not a Panini, but like pressed and man, I can, I
can put those away. No, no Jeff.
OK, so so now I got to add this. My my best thing is when I say
I've been fasting because I went too many fasting as well.
So when I eat, I eat a ton and sometimes like I want some
bread, so I get 3 slices of bread, lay a multiple layers of
cheese between each thing, some ham.
And then I really will have a press.
Not not convenient, but it's like a matter like a cast iron
press that I just put down on top of the skillet and I just
push that down. And as the best, most
unhealthiest thing potentially in the world.
So good. But it's so good.
All right, we're going to wrap up grilled cheese at the Center
for this week. Steven, you've been so great
with your time. Really appreciate it.
Looking forward to maybe giving you an official fist bump of
gratitude for being on the show at a conference at sometime in
the future. I'll have your LinkedIn profile
as well in our show notes, if that's OK.
People can reach out with questions or grilled cheese
recipes or whatever it may be. And then Jim, you and I will be
on the web as usual. idacpodcast.com, connect with
us. If you're listening to this, go
on over to our YouTube channel, hit that like and subscribe
button that's helping us grow and appreciate you sharing with
friends or enemies. We don't care.
Whoever listens as long as they like and subscribe, I don't
care. So with that, we'll go ahead and
leave it for this week. Thanks everyone for watching and
or listening and we'll talk with you all in the next one.
You've been listening to Identity at the Center.
We hope you've enjoyed the show. Make sure to like, rate and
review, and we'll be back soon. But in the meantime, hit the
website at identity@thecenter.com.
See you next time on Identity at the Center.