This is identity at the center. If it has anything to do with I
Am, this is the go to podcast now your hosts Jim McDonald and
Jeff Steadman. Welcome to the Identity at the
Center podcast. I'm Jeff and that's Jim.
Hey, Jim. Hey, Jeff.
How are you? Not so bad yourself.
I'm doing great. I mean, there's been some
interesting news in the identity space recently with Tom Abravo
closing their deal to acquire Ford Rock.
It seems to me, based on my LinkedIn, that people from
paying and from Ford Rock seem pretty excited about, you know,
the the future. I mean, I've only seen positive
come out. You know, I don't know that.
I mean, everybody's speculating. What does this actually mean?
What is this going to look like in the future?
I'd like to extend an invitation to anyone from Tom Bravo or Ping
or Ford Rock who wants to come in and talk on the record on the
podcast to please reach out to to me or Jeff.
And we'd love to have you on, because people, we all want to
know what's going on. Yeah, I think people been
thinking about this for a while ever since.
You know, the, the intent was announced several months back.
Now at this point we asked the question on stage at Gartner to
our, you know, our friends Henrique and Becky.
They didn't know, right, just like anyone else.
I think we're starting to see it now, right.
So the deal is closed and I think almost immediately they
announced the, you know the the merging of the two companies for
drag and Ping and Andre Duran has been announced as the the
leader for. For that.
So it's interesting times. You know, it's never a dull
moment in the identity space. I think we kind of saw, you
know, like Okay, like what's the plan here, Be curious to see how
things continue to evolve in the space.
But yeah, definitely happy to talk with anybody from Ping or
Ford truck wants to come out and talk about it.
They wouldn't get Eve. Eve's always been good with us.
He's been great. Yeah.
I just don't know how much, you know how much freedom she'll
have to talk about that kind. Of stuff, but I'm going to go
out of limb and say none. I mean, it's companies, it's
corporate, There's money involved, right?
Stocks maybe. I'm sure we'll get company lines
and stuff like that. But it's seriously to see how
things will turn out. What's the plan here between
Ford Rock and Ping in certain areas?
They're definitely competitors. What's the plan to fold those
together and figure out how it makes each other better or
stronger or faster or something like that?
I mean the the, you know, the customer list of those two
companies now combined is just unreal.
But by the way, you did bring up Andre Duran.
If I could mention his identity at the center alumni, I'm sure
that was the highlight of his career.
Of course, up to this moment anyway.
As it should be for anybody. Yeah, absolutely.
So that's cool, cool news. I'm sure this is going to be the
biggest thing that folks are talking about at the upcoming
conferences. We've got quite a few of them
planned. I mean it's kind of hard.
It's it's the elephant in the room, the girl in the corner,
whatever the right analogy is. But I'm sure people are talking
about it, especially when we start talking about
authentication. So we've got a few things coming
up like that. But yeah, we've got conferences
coming up. So I'm going to be at Identity
Week America. That's October 3rd and 4th.
That's in Washington DC I'm hosting a panel discussion on
pass keys. Actually starting to get the
panel together later this week, so we're actually starting to
figure out what it is we're going to talk about and try to
put together, you know, a good discussion around pass key and
authentications, things like that.
So we've got a discount code that the fine folks over there
have provided to us. This works for both Identity
Week America and also work for Identity Week Asia later this
year. So if you use the code ID AC30I
DA C30 you get 30% off of your conference pass.
Yeah, we're actually dividing in conquering that week because I'm
going to be on the East Coast at DC at Identity Week America and
you're going to be on the West Coast over at Octane.
Yeah, I'll be at Octane. But one thing we will have in
common is we'll both have the new updated Identity Center
stickers and. What's the update?
You got to be clear what the update means.
The update doesn't mean that you look, you know.
But the old stickers had a fatal flaw, which was they were very
hard to get the backing off of. And so now the new and improved
stickers are super easy to get the backing off of.
And you look, it's like these little tweaks, it's like the
iPhone, you know, from iPhone 14 to iPhone 15.
I don't know what all the features are going to be sitting
here today, but they're probably going to seem like small
features that just make it so much nicer to have.
So anyway, well, you'll have stickers.
I'll have stickers. I'll be at Octane 2023 in San
Francisco October 3rd through the 5th and we have a discount
code for that conference as well, which is OKTNIDA C30 and
gets you 30% off your registration.
So the registration link is octa.com/octane and we're also
going to be Co hosting or Co organizing an event with our
friends from accents. We're going to be doing the
quote UN quote party bus, which shouldn't scare people, right.
It's not like we're going to be driving all over the city and
you know just going crazy. We're going to be doing some
cool sane fun things and networking and seeing some of
the highlights of San Francisco. I mean it's tech town, right?
So a lot of the corporate headquarters are there.
I think we're going to do some of that.
I look, I'm not the not the consigliare of the of the party
bus, but I'm expecting it to be a lot of good scene fun.
So anybody who's interested in that, check out my LinkedIn.
I've reposted the link to get registered, and as we get closer
I'll drop that more and we'll put it in the show notes as
well. Yeah, right on.
I saw pictures from the party bus in Vegas.
I didn't make it, but you were on there and.
It was interesting going around to see the sights.
It was a cool idea. I think it was kind of a a neat
thing that they did. So yeah, I mean we did things
like we went to the Welcome to Las Vegas sign, We all got to go
out and take pictures. And yeah, it just added another
element to the the trip For all the times they've been to Vegas,
which was like over 20 times, I'd never gotten to that sign
before. When you get there, you're just
like, Oh my gosh, it's just like I'm just some Rando St.
Yeah, I I've never been to it either.
So maybe someday. So we got that octane.
We've also got the Authenticate conference that we're going to
be at the week after that or a couple weeks after that.
That is October 16th to the 18th Carlsbad, CA and just north of
San Diego. We have a code for them as well.
I D AC15 podcast, ID AC15 podcast.
You get 15% off, which is very cool.
We're actually going to be on the mainstage part of the kind
of opening festivities and keynotes and.
We're going to do a live show in front of a live studio audience
and also broadcasted to the Internet at large for guests and
conference people and stuff like that.
I still have no idea what we're going to talk about.
We got to figure that out. That's coming up, but that'll be
exciting. Can't wait for that.
I mean, we are the official podcast for the Authenticate
conference and that that discount code of 15%, that's the
best discount code available anywhere.
So if you use that code, in addition to getting 15% off, you
get registered in a raffle of some sort that the conference
organizers are going to select one of the people and give them
a welcome gift of some sort. I don't know what the gift is
going to be, I don't know all the details, but use the darn
code because it's the best one out there anyway.
Yeah. And it supports us too, right?
Shows that people actually listen to the stuff and it's
worth our worth our time. And their time, right, to help
support that. So yeah, looking forward to
that. That's going to be a lot of fun.
Anything else you want to bring up before we get to our main
topic because we're going to talk a little about
authorizations? Well, yeah, I do want to bring
up one thing, just the thought that I have and usually I bring
this up at the end, which is if folks can get out there, if they
like the podcast, subscribe to it, leave us a 5 star review
would be appreciated. Let people know because that's
how people get to know about it. That's how when you go into the
podcast search feature of your your podcast app, we show up
first when someone types an identity and it's really, you
know, that's nothing that Jeff and I can do to improve the that
algorithm. It's really not yet, you know, I
got figured out. Maybe I could use the Flipper 0
somehow to to do that. Yeah, so far all you're able to
do is copy your hotel keys, but that's still a nice little
feature. Yeah, copied a hotel.
I've copied hotel keys and also the the badge system for my
inlaws housing complex. So definitely some things that
could be done there, but if I saw you at Starbucks, I would
not connect to the Wi-Fi. I did get the Wi-Fi dev board,
so I have been playing around with that.
There's a couple of, you know, interesting things you can do
set up like an evil portal. You can do a Rickroll attack,
which basically creates a whole bunch of fake access points that
are Rickroll lyrics. So I'm definitely not a hacker
in quotation works, but there's some neat things you can kind of
do that are fun and explain to people just why they should be
using things like MFA and things like that.
I think you are a hacker. I mean, you might be very green
in the hacker stack, but you're doing hacker things.
Okay. Well, I don't want this to be
evidence, so let's just keep going.
Let's talk about authorization and kind of calling this
authorization 2.0. I don't know if that will stick
or not. But to help us with this
conversation, we've got Rich. Dan Liker.
He's the chief strategist with Vasa.
Welcome to the show, Rich. Thanks, Jeff.
It's great to be here. How you doing, Jim?
Great to have you here. First of all, I love the radio
Pipes. You got a great voice for
podcasts. I will try my best to keep up.
I might, actually. I usually.
I'm trying to like, bring people's voices up, make the
sound, you know, sparkling, you know, right in the editing.
I might have to, like, do the opposite for you, so that there
isn't such a disparity between you, me and Jim.
But. Well, usually people only tell
me that I have a face for radio, but now now I also have the
voice. Well, that's what we always say.
We got faces for radio and voices for a silent movie,
something like that. Well, thanks for joining us and
spend some time with us here today.
We like to hit to really learn about the identity journey that
people have been on. And it's kind of tradition
around here when we have someone on for the first time to
understand what their identity origin story is.
So maybe you just spend just a minute or two kind of talking
about how did you get into the space of identity and access
management or digital identity or whatever the heck we're
calling this field today? Yeah, it actually started when I
was at Octa and I actually back in 2014, I went and joined them
and I led the product management team for about 4 1/2 years
through the IPO period. And so, you know, I think
Identity had definitely, you know, struck A chord with me and
that was one of the things I would did a stint in data loss
prevention. And really seeing how, you know,
sort of network based security tools were just not the thing
you really wanted to see. You wanted you needed to get
down to the person and that was really hard.
You had to go through proxy. You had to do all sorts of fancy
dancing to get there And so that, you know Identity was
definitely something that was like top of my list.
And then Ochter really cemented that for me.
And I think it was, it was a it's it's been a fantastic
journey and you know my my early on in my career, I definitely
said wow, this is a lot more complex than I thought it was
when I started. It always is.
I think the definition too, of kind of being an identity has
changed. A lot of people find themselves,
they just were in it all of a sudden, they didn't like, pick
it. It was just, oh, I I guess I'm
in identity now and now you're a chief strategist for an identity
company. So I love titles because some of
them are very cool. Some of them like okay.
What the heck does that even mean?
What does a chief strategist for an identity company like Visa
do? That's a great question because
I definitely find it a strategy means lots of different things
at lots of different places. It could mean a whole lot and it
can mean a whole lot of nothing. But for us at Vasa, I tend to
split my time between a number of different pillars.
First is really around sort of high level product marketing and
messaging. So I think a lot about how we
position the solution that we provide, how we talk about our
customers, how we talk about the space that we're in.
So that bleeds into a lot of analyst relations and speaking
to the folks like Gartner and speaking to Enrique as well as
sort of looking at the market as a whole and you know, so we're
kind of getting into a competitive analysis as well.
So that bleeds into the second pillar which is helping out our
sales team. So you know, really being sort
of more out on the front lines, helping to, you know, to guide
the folks that are actually talking directly to prospects
about sort of how to talk about things, how to, how to position
things, what people care about and and what identity folks.
Really wanna you know what's top of their list And then the third
is on product strategies. So actually building new
product, working on some of the advanced things that we wanna
get done that are critical for sort of that long term
positioning in the market and sort of really helping take us
where we wanna go in the long term.
So Speaking of products, you've got this company called Vasa
VEZA. I'm sure you get confused with
Visa. A lot people saying it.
So let's get the word out there, right?
It's pronounced Vasa. For those people who are not
familiar with what Vasa does, what's the elevator?
Pitch 30, let's say 62nd elevator ride up.
What do you guys do? Yeah, I think the way I like to
talk about it is really that we help.
The company's operationalized least privilege.
So we do that by really putting together a graph around
authorization that shows you not just what you have across all
your different systems, but where it's wrong, where you need
to fix it right. So we have a core technology
which is our authorization metadata graph, where we really
put together all the different pieces of information about
authorization from users to groups to roles, all the way
down to specific resources that might be in a particular system.
And the permissions down to you know can you read, can you
write, can you head it, can you delete and putting that together
and I think I think that combination makes a really a
really powerful solution to both see what you've got as I said
fix it and also get to compliance, right.
And that's a that's a frequent driver for a lot of customers
and we have a, you know we're we came out of stealth last year.
We've got a number of big customers like Wynn Resorts,
AMD, Intuit, Blackstone. Amex Global business Travel and
Zoom. So it's something that's really,
I think resonated in the market because it's so hard just to see
what you've got and that's often where customers start with us.
Yeah, I think a lot of people think identity, they think
authentication, it's the next step.
After that, it's really where you're going.
It's the authorization side. So where does the name Vasa come
from? Yeah, well, actually it's an
interesting, interesting story. When I first joined the company,
we had a different name. We were called Cookie dot A I,
and this is even before Chachi BT.
So it was prescient in one way about, you know, having the A I,
the, the the the dot A I there. But you know, obviously Cookie
dot A I has a lot of, has a lot of baggage.
So that was one where I was like, yeah, I don't know if
that's going to really fly long term.
And so I actually helped drive that the new naming and Vasa
comes from the Zulu word meaning to reveal.
So I was like wow that's pretty cool.
If I had to pick a language that I, I based the name on Zulu's
probably Yep that's about the the peak of it and it has like a
it has a good meaning you we could we could get the.com
domain for not an outrageous amount of money and the ticker
symbol was available. You know, you always got to be
thinking ahead. Hey, rich, authorizations really
seem to have blown up in the past year or so.
And if someone asked me, you know, what's hot in identity
right now, I run down a list of, you know, converged identity,
which I don't think is that exciting decentralized Kim, ITDR
Pastor list and authorization. And it's like that whole list I
went through until I got the authorization.
Those are all new things, right? They're all things that have
kind of happened in the past several years, but
authorization's been around for pretty much the beginning of
identity. And so I'm wondering, what do
you attribute this blowing up of authorization, as I put it?
What do you attribute that to? I really think it's a
consequence of most organizations really pushing
forward with authentication and props to Octa, props to
Microsoft really for driving forward the world of SSO with
SAML and OIDC and getting MFA implemented and driving forward
on password lists. So most companies that I talked
to have really you know how they've kind of gone through
that and they've said Yep, we've done, you know we've done the
lion's share what we need to do around authentication and wow
things aren't fixed yet. We still, we still have all
these issues. We're still getting either we
have security tax, we still don't really have a handle on
identity. It's not just a, it's not a
solved problem yet. And so it's just as you said,
it's a very natural thing when you after you've you've gone and
tackled authentication, authorization is the next step.
Right. And so I think that that natural
sort of like you know what do we do next.
We know there's something here. We know how core identity is to
all these different things to the you know to the IT stack to
the security stack and yet you know it's it's not we.
We know we're not done. Now Rich, when we talk about
frameworks for authentication some of the the ones that our
listeners may be familiar with our our back a back P back, some
some of those people might not be familiar with.
Could you help us define each one of those and helps which
one's the best one? What a loaded question.
That's awesome. So yeah, RBAC is a role based
assets control. So this is, this is probably
what I see as the most commonly used one.
And you'll be, you know, you'll be used to this in an enterprise
scenario where you'll have some sort of description.
You know, I might be like a, you know, W marketing or you know,
I'm a super admin and that sort of gives you based on a role.
There's some, ideally there's some commonality across an
organization that collects up a bunch of different permissions
that's organized in sort of your function at the organization
into a role that's the ideal state.
Then you have things like a back, which attribute based
access control and that's where you're not doing it necessarily
in a role, but typically more dynamically like you can think
of. I think the best analogy is.
You're used to this around sort of, you know, attribute based
authentication, right? It might be geolocation based
right, where you actually you're pulling in some attributes,
oftentimes dynamically and making a decision about, all
right, is this person actually allowed to get to certain
resources and take certain actions and certain resources
based on the value of those attributes?
So there's it's typically done more at runtime and more
dynamically. And then policy based access
control where you're it's a it's a pretty similar kind of thing
and a lot of similarities to a back, but it tends to be a bit
more around design so that you can actually make broad policy
based changes across the organization without having to
go through and rejigger all your roles, right.
So it's sort of more, you know, a goal and A and a target
design. From.
From what I've seen RBAC is the most commonly used one and you
know. And I know we, we talked about
this, it's like for for being, for me being in in in the
authorization space. I'm amazingly not opinionated
about which one is best. So that's a tough question for
me. But I know that my my favorite
one was like that's I was listening to one of this one of
the C shows I was talking to. He says our back, yeah really
bad access control. And I think I have a strong
resonance with that because even though that's the most commonly
used one that's you know that's the one I see most often.
It's just has so many gaps and so many holes.
Can you have least privilege without RBAC?
You know least privilege is obviously it's a you know it's a
big slope. And I think really that the
trick is like you know, and this and this is also, you know, I'm
don't want to, don't want to pitch.
But you know it's like everybody agrees least privilege is
something you need to get to. But getting it in practice and
and you know, how do you actually get an operational
program. You know we've we've all gone
through those compliance surveys and said, hey do you follow
least privilegedly? Yes we do.
But what does that mean? Like you know and how do you
know and where is it off and how can you get better.
Those are the, you know, when the rubber meets the road.
I think those are the most important questions.
So I I see it as less of a, you know, are you using RBAC or A
back or P back? It's more around do you have the
tools and the processes and the people to actually get to least
privilege? Least privilege is the goal, no
matter which of these frameworks you're trying to do.
Jeff Rich refuses to answer my question.
It's baby back. What's the best back?
What is the best? I mean, without question.
Got back and that is the winner folks.
OK. So Rich, it seems like that in
the past at least in my experience authorization was an
area focused on for CIM customer I M and less so for enterprise.
But it seems like this blowing up that I refer to is really a
reversal of that trend and it's becoming more of a shift toward.
Enterprises doing more advanced authorization projects or taking
that authorization focus, is that right?
Do you agree with that? Yep, I do.
And I think I think traditionally authorization has
been sort of front and center of a of a CI AM project because
when you're building a custom application which is typically
with those things, what's involved there, you you can't
not build authorization in, right.
You've got to have something and so you you have to build some
sort of structure or some sort of componentry.
I think to be fair I'd say that you know the the the CIAM types
of projects haven't gone away and actually we're seeing a
really strong push here, not so much in terms of sort of the
bulk users that are going into an application.
For instance, if you're, you know, if you're a customer, a
consumer facing company and have a CIM application, you've
generally done a pretty good job of separating and isolating
customer one from customer two. Like I if I'm going into
Expedia, I can't get to Jeff's travel profile and access Jeff's
credit cards and then for the most part that's a well
understood problem. The trick and I think the sort
of the frontier for that on the CIAM side is really things like
help desk people, right? If you have or you have admins
or DevOps people who are logging in and sort of getting access to
customer data, getting privileged permissions into some
of these things, potentially cutting across multiple
customers, doing some sort of operational management.
And of that, I think I find a lot of customers are really
weren't they weren't thinking about that.
That's not sort of the primary use case of authorization in
that custom app. And so it's they often have very
little visibility, especially when you get to the security
team, you've got the developers, you're kind of, you know,
there's one guy who knows exactly how it all works.
But then when you go to the security team, they don't have
visibility, they don't have logins, they don't know how it
works and that that's a real, real gap there in the CIM side.
But to your, to your point, I think it's now also hitting on
this sort of the enterprise application side.
And I think there's a lot of crossover because some of the
data storage systems like going to the cloud platforms of AWS
and Azure and Google Cloud, those are now sort of crossing
over where they're being used for enterprise data.
They're also being used for customer data and so you know
you, you really see a lot of commonality in leveraging
similar platforms across the the internal enterprise, traditional
internal enterprise applications and consumer applications and
customer applications. So when I talk about
authorization with people, I my mind shifts back to the
framework around the insaccharable standard and you
know, Policy Decision Point, Policy Enforcement Point, and
again like my reference point is a lot on customer I am.
And I've always thought like, OK, externalizing and
centralizing the policy decision point is pretty drastic.
You know, if you've got a couple of, you know, business portals
for transacting, whether it's placing orders or warranty, it
depends on what business you happen to be in.
But a lot of times those applications were built
individually. They're right.
They're not just one big portal that does it all.
And to centralize all that, I always thought to myself like
okay, that probably makes sense for like the FBI or something
like that where they want to have a centralized log of those
policy decisions. So to me, the policy decision
point was always like the the big most important component of
that framework. The way of thinking about
Zackamal and I'm wondering like does that.
Framework still hold value. Do you still use that framework
and that type of those terms, Policy Decision point, Policy
Enforcement point, things like that?
And you know, is the policy decision point still the most
important concept of that standard or is this something
else now? Yeah, that's a great, a great
question. I think.
I think those especially those concepts are very valid today as
valid as they as they were when the, you know when the standards
were being developed there. And I I think that that sort of
methodology and that that conceptual division makes a ton
of sense. And I find that you know it's a,
it's a still a small fraction of folks we we tend to not talk
about those things as explicitly in today like in our in our
marketing and documentation materials.
But I definitely run across plenty of customers who still
talk about it and say hey you know give me know tell me how
this fits into that world. And so I think it's they're
definitely folks out there who still think about it this way
and I think if you explain it to them it, it makes a ton of
sense. Here's one where I actually am
opinionated and this is 1 where I'm actually, I'll put in my
vote for my favorite, my favorite component is the, the
policy administration point. And that's one where I think the
issue with the with sort of centralizing as you pointed out
with the decision point, you know it's it's really, you know
you have there's a performance issue you you're generally
you're looking at that with the with the enforcement point
potentially and putting those things together I think tends to
make a lot of sense. But trying to reroute the
network and trying to you know channel everything to A to a
single choke point, that's not how, that's not how the modern
cloud architecture and modern day, modern day systems are
working. And as you said like once you've
got it up and running no one wants to rearchitect that stuff.
No one wants to put a new a new component in the middle of
something especially when you're talking about sort of customers
and you know and production data or actually getting transactions
done. It's a really hard pill for
folks to swallow. So I think you know.
Multiple applications that could be.
Posted around the world you can have scalability, reliability,
network type issues. That's right.
That's right there. Just there's so many other
things that sort of drive that. And you know and you know I can
imagine like an enterprise architect trying to go say hey
we want to centralize all this to a single point and get thrown
out of the room because it's just like it.
There's so many other factors in there that that drive it.
And so I think my personal take is attacking it at the
administration point is the is the right way to go.
We've been talking a lot about, I guess.
Theory, for lack of a better word, right.
How things should work. I always like to hear like
what's the real world doing in this space?
You mentioned some of the clients that you've worked with
in the past and some customers you've got.
What are some of the use cases you know that you've seen where
an authorization tool has helped solve some of these real world
problems that we're seeing out? Because, you know, I think
everyone points back and say, oh we're we're a role based access
control company. Okay, Are you really?
And how good is it? It usually sucks and it's a
pain, pain in the butt to maintain and you know they kind
of gave up maybe after. Oh yeah, we have 5 rules, right?
Something like that. And I feel like it's it's a
struggle for a lot of organizations out there.
They every every company that I talked to says that they are or
they want to be role based and it's hard in the real world,
especially when you have these applications that are using
their own authorization schemes and they have not moved to.
You know a centralized policy, decision point or access point
or engine or whatever it may be. What are you seeing in the real
world around this space? How are you know these?
How are these things moving forward?
Yeah, I I find that you know one of the big issues and I
mentioned this before about you know the the really bad access
control crack. But that one of the one of the
challenges is you know you can you can do it at a point in
time. And typically I what I hear is
like you know hire a systems integrator like Accenture to
come in and get you know and get like a whole raft of you know
warm warm bodies from from the consulting or to go and have
tons of interviews with every organization across you know
across the company. And that's a tremendous amount
of work and they. Better yet, hire our son to do
it. There you go.
But then you get drift over
time. And then you get, you know, you
get people you know and say, well, you know, maybe I'll use
this role for something it wasn't quite intended for, but
it sounds about right. Or things get tacked onto the
role and so the permissions change and actually what's in
that role changes the use and the and the and what it's what's
being applied for changes. And you know, essentially, you
know, then then you're going or you, you know, you get someone
who says, you know, oh, I need this new role for this new
purpose. And this sounds about right, but
man, I don't really know what that role does.
Let me create a new role. And so then you get this
proliferation. And So what I find is that most
organizations, even when they want to be a role based access
control company, they're trying to manage it just on the name of
the role. Like when you're trying to say,
hey, is this right? It's like the role is named
super secret admin #2 okay. Like what does that mean?
And people have no idea. And so the thing that surprises
me I think around all this and the real world customer examples
that I see is that oftentimes the things that customers are
struggling with is so much simpler than you would ever
imagine. And you know, so one example we
have a, you know a very large Fortune 500 company and they
actually went through this and that, you know they came to us
and said hey you know can you tell tell us when a new admin is
created in Salesforce, We're like yes, we can chew that.
And what it turned out to be is that they had an IGA, a very
large IGA company that you would the name you would know as a
leader in the IGA space and they were using that to provision
Salesforce. And yet they found that when
someone went around that provisioning process, the
approved process and went directly into the Salesforce
console or create a new admin in there, their IGA solution
couldn't tell them And they would go around this and they
tried to actually custom code some solutions to do it.
And there were just so many different ways to do it.
They couldn't find that. They could plug all the holes.
And what it turned out was that they had failed two socks on it
because of that, right. And so it sounds so simple and
you take someone outside of identity or peripheral identity
and say you know, do you know, how can you not know when a new
admin is created in Salesforce? Like how is that possible and
yet that's the thing that these very large, very sophisticated
companies are struggling with. And so you know, so that's what
we hear, see is sometimes it's a compliance driver.
It's like when, you know, when your auditor gets the the taste
of that and they know that you don't have controls, you can't
demonstrate controls like that is a big deal and they will,
they will drive that and companies are very, very
motivated to fix that. Other times it's just a
visibility thing. And I know there was a former
SISO of a very large telco that was telling me a story about
sort of when he came to believe in, in authorization as sort of
a really key thing. It was actually after an
incident. And so they had, They'd had an
intruder come in. They'd had an account takeover.
And they ended up being able to block that and and locked out
that account before they they lost a lot of data.
But he was doing a postmortem with all of his direct reports.
And so he had them. We were all in a room.
And he says, all right, here's the first account that got taken
over. What did that have?
What did this account have access to?
And they all look at each other and they say, we don't know.
He's like, okay, here's the second account.
How about this one? We don't know.
He's like, how is this possible? How can we not do this thing
that's so fundamental to security and being able to
respond to these types of incidents.
So I find it, you know different different organizations and
people come at it from different sides.
But inevitably when they dig down and really see what's there
and see what they know and what they don't know, it's a little
terrifying and and you know it's it's such a basic thing you
imagine like you know how how is this possible that we can't do
this and yet it's incredibly hard it's made it's been a lot
harder with the with the cloud. Rich, just thinking like you
just told the story. I'm thinking, man, this folks
who are in that room said, we don't know.
That must have been just like such an embarrassing and painful
moment for them. It's like it's your job, you
know? I mean, look, I'm not saying,
like I would have gotten it right.
I'm just saying that I'm sure, I'm sure glad I wasn't in their
shoes at that moment. Because, you know, when you
think about identity, it's ensuring that the right people
have the right access. You know, knowing who has access
to what and when you can't answer that question, like, wow,
that's that's downright embarrassing.
It. It really is.
And I think I think it's, you know, it.
It underscores the fact that like just the the tool set has
just hasn't been there. Like, you know, it's like we've
done all these advances and you know, like we were talking about
before, authentication has come a long way in the last five,
five, 6-7 years. The tools that we got available
are so much better. And I think, you know, that's
another common thread is that the tools for authorization have
been pretty stagnant. There just hasn't been a lot.
And so, you know, I think back to another, another guy who was
in, he actually leads the engineering team at his at his
organization. He was telling me a story about,
you know, when they didn't have any tools.
He said, yeah, the auditors asked me for, you know, everyone
who could access this one database.
We had to really get in and the auditor was like would not let
it go. And in order to answer that
question of like who has access to this database, what can they
do in this database, He said he had to take his best developer
off for a week of custom scripting to go answer it for
one database. So now multiply that across, you
know your entire environment and you just can't do it.
Like, you know you can get the answer, you can figure it out.
But the amount of time and effort and energy it takes to do
it without a good tool set is brutal.
Well, I think this is where the fundamental question that.
I always ask folks is you know, can you answer this question?
It's very simple. Who has access to what and how
quickly can you pull that answer together?
And how accurate do you think that data is?
Because if you can't answer that question, my mind your identity
and access management program is failing.
It's a basic question, right? And it's.
I also find you really need to dig down because most people
will say, well, yeah, I know you know these, the people in these
groups, OK. But you know, like, dig it.
Let's dig a little deeper, like. Nested groups?
What does it even mean? It's been you know, that group
is used for eight different things, one of which was the
original intention, right? Stuff like that, that's right.
And you know, it comes down to, you know, to brass tacks.
Usually it's like, you know, pick your, you know, your most
sensitive, you know, data element, whether you know it's a
table, maybe it's a box folder, you know, maybe it's a, you
know, a data lake, you know, in Snowflake or something like
that. And say like who can get to that
and exactly what they, what can they do, right.
And like it's going, but it's going down to these data
elements. Because you like, I think
everybody has somewhat of a handle around users and groups
and some connection to role. But I find the biggest gap is
what does that role actually do? What does that mean?
Like what can you actually get to with permissions?
And then you get all these other things like what about local
permissions, what about local users?
What about system accounts and machine identities?
And like you know now it's pulling on all those threads
where you know it's not in the 70 or 80% solution, but it's at
the edges. And those are typically the
biggest issues when you when it comes to security and
compliance. Those are the ones that you
really need to worry about are those ones that you?
You. You know you.
Most of the time you don't. You have no idea.
Well, you've got the point in time definition.
And then what are you doing to make sure that that definition
stays the same? Because things change, right?
Exactly. Do you find that there is a
particular platform or system or something?
That is like the hardest thing to include when we start talking
about authorization, maybe even as a program.
I think people think of identity as a program.
Authorization as a program might might need to be a thing as well
considering you know that's that's really the keys of the
castle, whatever, you know, what are people getting access to.
But I know I found you know doing integrations different,
you know technologies out there. There are some platforms or
systems that are just. Of real pain that you know what
and it's either not well documented or you can't do
certain things because API's aren't available, whatever it
may be. But what kinds of platforms do
you see as, like the hardest to include as part of this, this
capturing of who has access to what?
Yeah, from a from a tactical standpoint, the hardest ones are
definitely the, you know, the old and crusty on Prem ERP
systems. You know, those are the ones you
know there's no Restful API like they've been, you know they've
been cut, they've been you've had an SI come in for eight
years and is you know is custom fine tuning it.
And so it ends up being something that has very little
commonality with anyone else's deployment.
And so it's just a tremendous amount of customization and the
hooks are not there. So from a tactical standpoint,
those are the hardest ones or custom applications as well.
They're just, you know, they're kind of, there's snowflakes,
right. Nobody else has it And so there
it aren't a lot of common tools that still like you to
integrate. But from a program perspective
actually find it's the other way where you see that you know a
lot of times when you look at you know identity governance
programs they've got like the ERP system that was always the
number one thing that was so that's priority one.
So they've actually this you know gutted it through and you
know by you know really you know brutal house to house search
they've they've gone and figured that out.
But then you say well you know how many apps do you need for
socks or relevance for socks compliance and are subject to
that And and you know those is like well it's like you know
it's like 30 apps. How many do you have covered in
your Identity governance program?
Three. And what are you doing about all
the rest? And so from a program
perspective, it's actually that longer tail.
It's the stuff that's still relevant for compliance and it
knows there's critical data in it.
But usually the lift is so heavy to get these things integrated
into an identity governance platform that they have huge
gaps and they know that. Yeah.
You know, I kind of, I think one of the things about
authorization is. You have to make a decision on
how far you take your authorization program.
So let's say we take one of those apps that you just
mentioned, custom build. App developers have been
hammering away on it for decades.
Maybe building like, oh this view and that view and like
things that are not standard. Or take something that's
out-of-the-box that I thought you might.
Answer that question with which is like ERP systems where
especially older ERP systems where you say you have access to
this table, this screen, this business unit.
So now it's like multidimensional access and it's
like that's just you know if you spend your IEM program focus on
nailing the authorization for that, that is all you're going
to get done like you might have an IM program with.
A handful of people. So to me it's kind of been like
okay, so, So what is our I am program going to do?
It's going to take it this far. It's going to provision a person
into these right groups or it's going to in real time present
the application with some assertions of authorizations.
But they're going to be at this level.
It's not going to be like they should be able to see all these
tables and things like that, so. I guess to translate that back
into your real world story where this uses like Okay, we're going
to take this application, take this account that got
compromised. What did they have access to in
our ERP system? I would say the I M team should
say, well, we sent these authorizations or we put the
person into these roles in these groups and then somebody from
the ERP side should said be able to say.
And that gives them access to these screens and these database
tables or things like that, right?
But somewhere along the way. So do you have a rule of thumb
or is it really just having that that knowledge should be able to
say, all right, here's a couple of rules of thumb that we're
going to apply. Yeah.
The, the rule of thumb that I find is, is sort of the
commonality. If I look at customers who have
been the most successful at doing this kind of thing, it
it's absolutely prioritization is the name of the game.
I mean, that's the first thing is you cannot do everything
right. And so you have to pick your
battles. And I find that the one of the
most valuable things is actually going, you know, you know,
starting at the end, right. And like looking at like, OK,
what's the most critical data we need to protect, right.
And that that's typically the thing that's fundamentally like
the board cares about, you know the see, so the CIO care about
and so hey let's figure out like what roles give access to that
and what can they do, right. And so typically that's that's
where I found it, it's most valuable is kind of starting at
the end. But to your point, Jim, I think
a rate you raised a great point is like a lot of times this data
to put that whole story together and to get their true visibility
all the way down to the data level, It's on different teams,
right. It's in different systems,
they're different groups. And you know, does the identity
group really understand the inner workings of the ERP system
authorization scheme? Like heck no, right.
And so and every single system is different, right.
You know, just because you know, one system like you, you got to
kind of be an expert in each one And that it's that that
translation across systems, that's also really, really hard.
So now you think about, you know, now you boil it back up
and now you're a see so and you say, hey, you know I just want
to make sure that no contractor in China gets access to my
customer data. Let me make that happen.
Now you think about like what do you have to do in terms of
technical controls on every system that might have customer
data. What do you, what knob do you
actually tweak, what's the JSON actually look like for that?
That's a really hard thing to answer, although that's, again,
it seems like a very simple kind of thing that's, you know, that
that's would be very reasonable for a SISO to want.
And yet bringing that and actually putting that into
action is super, super hard. That's a great answer.
You know the other thing that was as we're talking about, we
kept talking about authorization as a program.
And I'm not recommending that folks go out there and spin up a
program and have an authorization program manager,
but it reminded me the of the impact that authorization has to
humans. I'm also sure that the impacts
on the end user. But definitely the application
owners and these application teams and making sure people are
clear on roles and responsibilities and to make
sure that where I drop it, you pick it up, etcetera.
What are your thoughts on that impact?
Is there an impact to end users? And then the app owners, who are
app owners, developers and database administrators, all
those folks, yeah, absolutely. There's impact on end users
because usually it's like, hey, I need access to this thing.
I need to get my job done and I need more access.
That's typically how it goes. So you know, obviously you start
off with birthright access, you get a bunch of stuff right out
of the gate, but it's never enough.
And it's designed not to be enough.
You gotta go typically and ask for more and so then the trick
is okay, how fast can I get that done, right.
If you're a developer that's working on a critical project
like I guarantee you got a, you have a lot of organizational
push behind you to get that access quickly, right.
It's like if it, you know, if it's a revenue facing project
and you know they need to get it done like they you will, they
will push and they will get a lot of backing you.
It's really hard to say, hey hold on, we got to figure out
our role structure. That's not going to work right.
You got to get access. That reminded me.
I actually have another customer example where they started using
better tools, right? And just having more insight
into what roles actually did can be extremely powerful even in
the provisioning process, right? So their problem was they had
Snowflake and they had developers that would come in
and actually ask for additional access to something.
It might be a table, it might be a database in Snowflake.
And so the challenge that they had and actually the
provisioning was done by the Snowflake team just for this
very reason because they were the only ones who sort of
understood the inner workings of snowflakes.
So the IT team couldn't do it right then.
So they actually had to take down on themselves.
Back to your other second part of your question is how does
this actually impact app owners and and and data owners.
They were actually the ones doing provisioning and more than
not because it was typically such a mission critical thing
that was time sensitive, They over permissioned right.
And that's the reality is like, well it's like gosh, I got all
these roles. I got like 80 roles.
I don't know which one gives access to this table.
Let me just give them the real, you know, let me give them the
good stuff. Let me you know, let me let me
give high level access. And So what they were able to do
when they actually had some tools that were that allowed
them to see what these roles actually did, like what did this
role actually give permissions to and had that that sort of
instant level of visibility, they were able to reduce that
down. So once they granted a new role,
they could really find the one that best conformed the least
privilege, right? They could find the one that
gave access to that table but as little else as possible.
And just by sort of implementing that, by having the tools around
visibility, they were able to reduce the total number of
permissions on Snowflake by 80%. That's what they told us.
I mean, so it's you can really see the effect of that.
It's not just, hey, does someone have access to Snowflake or not,
but what role do they have and is it enough for them to do
their job? This is least privileged at its
heart. All right.
One last question around authorization for wrap things
up, but it wouldn't be an Identity at the center podcast
without mentioning of AI at this point.
So what do you, how do you see AI impacting this space of
authorization? Yeah, I mean, I I think about
this a lot as everybody, everybody who listens to this
podcast does. And I think, you know, there's
certainly going to be a lot, some good stuff into like role
mining and cluster analysis. And I think there's a lot,
there's a lot of of goodness there.
And also, you know what we were talking about before, we're
getting to the human component. When you're doing things like
access reviews, which is almost always a component of any sort
of governance program around authorization, it's really
alleviating that that human burden.
And I think A, I can do a really good job there where A, I, A I
might not be able to do that, give you the full answer, but it
can at least guide you and say, hey, you probably don't need to
spend a lot of time on these. Here are the ones that really,
you know, look suspicious, right, or look like you should
give it a little more time. I think you were using it for in
those kind of those kind of situations are really great.
And you know, I think the best example I heard about the power
of a I was really, it's like having unlimited interns, right?
And so you can do things that are sort of like this, these
sort of relatively relatively menial tasks, but you could do
it really fast. You can do it really cheaply.
But there still are things where, you know, humans are
still better at doing the, you know, the, the outliers, right.
The, the really edge case things.
You've got to have some humans involved in a lot of those
cases. But A I can take a lot of the
burden there. The other component and the
other side of it is, you know, is what, you know, what's what's
going to be the bigger security concerns around authorization,
protecting a I programs, right. And so that's another
interesting one where you now see all these things around, you
know, the, you know, like like the weights like after the, you
know these training runs that some of these really large
frontier AIAI companies are doing.
You know it costs like a billion dollars to run some of these
training things. And so that you know the weights
that file that records all the essentially the results of that
training that is incredibly valuable intellectual property,
right, you know, perhaps bigger than anything we've ever seen in
history. And so and then you have nation
states that have stated goals around becoming a I leaders and
that combination of having these treasure troves.
I think it's going to be a, you know, it's going to really bring
security to a whole new level because the value of the thing
that we're trying to protect is so large and it's going to be
way beyond even customer data and credit card numbers.
And so I think what we'll see is it's really going to force
security providers and identity, identity people, identity teams
to think about securing this stuff beyond just typical IT
level security, but really break, you know, bringing it up
to physical security, getting it closer, closer with a lot of
sort of the three letter agencies that are actually
protecting it. I think there's going to be a
lot of more crossover between typical espionage scenarios and
risk profiles and what's normally been IT security, not
having to worry as much about physical security.
I think those things are really going to converge around a I.
And I feel like we're headed to a future where an organization's
a I become sort of like their OS and is their secret sauce
hopefully not as bad as like I robot goes a little bit nuts has
your definition of a I changed within the last couple of years
because I feel like mine has and I've talked about this before
where pre you know ChatGPT pre large language model being
available to the general public. I thought of AI as okay.
That's cool. It's it's like machine learning
and pattern matching and stuff like that.
And then you get something like, you know, ChatGPT or similar,
you know, functionality where now it's available to the public
and it's this conversational interface.
I find myself using it more and more and more for important
things and not important things. And my thought process now is
that's AI. I don't think of AI as
necessarily just machine learning and padding matching.
And I'm curious if if if you've thought about this from a
definition standpoint of, OK, you know, what is AI?
Because they feel like no offense.
You know, a lot of vendors have thrown the word AI on the box of
their product for years now. And now we're going to the point
is like, oh, OK, well that's interesting.
You know, what is, what do you mean by AI?
I'm just curious if your definition has changed since the
advent and the availability of these things.
Yeah, I I think it has. And certainly the way I think
about it, you know, I think before ChatGPT, the ChatGPT sort
of evolution, you know, I was just, you know, I was always
felt embarrassed about using the term A I that's what that's what
it felt like it was marketing. It felt like it was you know
something in the future and not here yet where ML sounded you
know much more reasonable and like yes, that's a much more
precise term. I think now I feel very
comfortable using the term a I and I think maybe it it's just
that it's still so new and still revolutionary that it feels very
very different and you know and that's I've I've seen that quote
before where it's you know AI is anything that's just new and and
not in the current capability set.
And it it feels like we're still getting our heads around what
this really implies. And really I mean it's it is
mind blowing even though it's a, you know it, you know a next
word prediction model. It feels like so much more and
it and it looks like so much more from every every angle.
It looks startlingly like you know an intelligence behind it.
So it certainly has changed the way that that I I treat things
and I talk about it. We're going to start to wrap
things up here and I guess kind of going on the lines of when I
think of AI and where things are going as well.
I think about the word longevity because I could see a point
where you know, everyone's got their their own AI and maybe
there is a. You know, Jeff, A I at some
point in the future, that list that you know exists long after
I'm gone, right. And it's this, you know,
facsimile of what, you know, my personality is like or whatever
it may be. What's one of the most important
things that you think you've learned about longevity?
Yeah, I think it's, you know, my, I know we talked about this
before. This has definitely been a
passionate of mine to to think about this and and and learn
about it. And I think it's really, you
know, in the end longevity is important and longevity is
great. But you know what really matters
is what you do with that time, right?
It's like it's not about just living longer, but it's like you
you've got to put it to some use, you got to put it to some
value. And I think it's that, that
perspective combined with the fact that, you know, if you look
into there are few, you know, very simple worms out there that
actually don't have programmed cellular death, right.
And so you look at this, he's like how can that be?
And you look across all these different species and
organizations and I've actually come to the personal perspective
and I've never really heard it stated this way but that, you
know, that a limited lifespan is is actually a it's a it's a
feature, not a bug. And it's actually something that
we've evolved. And so you know and you can, you
know, you can look at it from an evolutionary standpoint, it
makes perfect sense. It's like you know you got to
make room for the new the new era for the new folks, for the
young people. And and so I that's that's come
and that's been a that's a bit of a shock to say like wow.
I'm sort of you know thinking about myself is supposed to have
a limited shelf life and I think it just puts a a finer point on
on that. You know like if we if we all
knew we were going to live forever would we really get get
anything done what we needed to get done today Like if like well
I can always do it tomorrow. I think it's it's really, you
know, thinking about it that way, I think, I think makes you,
you know makes you use your time that you that you have better
and I think that's it. That's a good perspective from
from my my point of view. Well, time's one of the only
resources that you can't make more of.
Really, right? Everyone's got a only scarce
resource. This time.
Yeah, that's right. And I think, you know, it's one
of those things I think is, you know, as I get older, right, I
think about how much time do I have left?
Am I going to get all the things accomplished that I want?
And you're right, if I live forever and I would just keep
kicking that can down the curb, right?
And, you know, play video games all day or, you know, I don't
know, set up evil portals, whatever it may be.
Jim, what do you think about longevity?
Well, I. I really enjoyed listening to
what Rich had to say, because I think perspective about
longevity is so important. I think it changes over time
too. You know, I have in my mind I'd
like to live to about 80, feel like that's where the human body
wears out. But on my 80th birthday, am I
going to say, well, I'd like to die tomorrow?
Heck no. I'm going to set a new goal.
I'm going to find new reasons why, a new ways to find meaning
out of my life. But I will say.
You know had a a passing away happen in my family recently and
it got me onto a YouTube worm which was watching or rabbit
hole watching these videos. They were frontline videos.
Frontline has like some really great content on YouTube, but it
was you know about the aging process and going into like you
know when people die if they don't have a living will like.
Someone can decide, like keep this person alive for as long as
possible, and they're, they're a vegetable in a bed for five,
five years or whatever until there's nothing that can be done
to keep them alive anymore. So I know I don't want to be
there, right? I don't.
I also see, like, people in the nursing homes that just like
staring off into space. I don't want to be there.
So I want to live life to the point where I'm enjoying life.
And I think everybody has to kind of like assign to assign
meeting to like, yes, that's the kind of life I want to live or I
don't want to live that kind of life.
I don't know. But leave it to me to take the
lighter note and bring it there, Jeff.
Yeah, you're you're you're a real expert at that.
I was going to say I could pull a Seinfeld and like, you know,
grab the pillow And when you say it's ready, okay.
You know, put it over the face like, all right, we had a good
run, Jim. Years and one day.
I'm like, I set my calendar now. All right, here's a bonus
question. Let's see if we can try to
revive the lighter part of it. There's a lot of different items
out there where people are trying to live longer and with
the expectation that something in the future might help them.
And I'm thinking specifically on things like cryogenics, right?
There's, I don't know, Arizona or something like there's a a
warehouse full of people who have been frozen.
With the hopes that it's someday they'll be able to be woken up
to cure whatever, you know, issue that they had.
Some people, it's their entire body.
Some people, it's just the head, which I find kind of creepy and
very Futurama to some degree. Would you consider that?
I don't. I don't think I would.
I mean it's it's those things where again it's it.
Maybe it'll work. That's possible.
But you know, well, I guess maybe another good question is
like, yeah, would you upload your consciousness if you could,
Would you upload that into the computer?
Or just, you know, just save it as a backup somewhere?
Maybe I would do that somehow. That seems a little less creepy,
but when I think about it, it's probably just equally creepy.
Jim would you freeze yourself or I was thinking personally too
like that the you know the the Jeff A I right, the backing up
your personality somehow right where it's it's good but.
Would you? I wouldn't do that, but I I want
to. Store a few things out there,
some some such a an expert on this topic.
One is I think from like a supplement perspective, should
be taking vitamin D3 every day and in concert with vitamin K2.
I also think that there is a supplement called N acetyl, L
cystine or N A/C for short. It's very cheap.
It's. It's one of the.
The great advances and great findings in the area of
longevity. So check those out.
Do a little research, Watch longevity videos.
Man, there's so much out there. But it is another rabbit hole.
We're not a medical show. I take my Col. system is cheap.
I don't think anybody's making a lot of money on that.
Yeah, I'll make my pitch for fish oil too.
Like I have a hard time eating enough fish.
I think that's that's one of the best.
Best researched and most clear advantages you know.
Get your get your Omega 3S, take a take a couple tablespoons.
It's good for you. Agree on that.
I want somebody to create the brownie sundae that is healthy,
that I can eat a lot of. Then I'll be a happy person.
Nice. So Jeff, do you want to be
frozen or what? I don't know if I would be
frozen, but this idea of being able to somehow come up with
sort of an AI intrigues me. I would do that.
I think that would be interesting.
I think I would like to do it while I'm still alive to see how
it would work and kind of tune it right.
I don't know what would go into it other than, you know, I mean
at some point I'm guessing somebody could take all these
episodes we've done 200 + 231 I think is this one.
That's a lot of audio content that kind of shows, Jim, you and
I are personality and at least with, you know, the one that we
put out on the podcast, somebody could very easily take that,
dump it into a large language model and.
Create a, you know, replica based on what it understands.
I'm sure you know. Obviously there'd be gaps and
stuff like that, but I don't think it's too far off where you
know you'll be able to talk to yourself or a famous person,
right? Or whatever it may be where
there is enough audio or written or visual content that can be
consumed to create something. Well, then you just need to ask
Alexa to start recording all your conversations.
And you'll have more. There'll be more data.
Isn't she already doing that? I don't know.
I guess I thought that was already par for the course.
All right, let's go ahead and wrap up for this week.
Rich, thank you so much for being part of this.
It was a great conversation. We're gonna have links in our
show notes to a whole bunch of different stuff.
We'll have links to Rich on LinkedIn so you can connect with
him. Ask him questions.
Compliment him on his radio pipes, you know, whatever it may
be, we'll have a link to vasa.com VEZ a.com so you can
learn more and more about what those guys are sold over there.
We'll have a whole bunch of links to all the different
conferences that Jim and I mentioned.
Identity Week America, Octane Authenticate Conference.
We've got a bunch of discount codes.
If you're planning on attending any of those, use our codes.
They should be the best. And it also shows support for
the show, that sort of thing. And you can find us on the
Internet. Idacpodcast.com We're on Twitter
or X or whatever at IDAC podcast We're on Mastodon at IDAC
Podcast at infosec dot exchange. Of course we're in all different
podcast stores, like subscribe, all that good stuff.
That's what it keeps. Jim and I encouraged to keep
Keep this thing running along. Share it with a friend, share it
with an enemy. Don't care.
As long as someone's listening, we'll keep doing our thing.
And Jim, I didn't tell you this yet, but I am working on
figuring out how we get on YouTube.
So YouTube has made some podcast announcements recently, and so
I'm starting to slowly upload hundreds of episodes when I get
time. To have them on YouTube at some
point as well. So not ready yet, but it's
coming. It's in the future.
And I did recently create find a way LinkedIn page for the show.
I think right now you and I are the only people on it, but I'm
starting to tag it and sort of build it out and figure out how
that all that stuff works. So there we go.
All right, we'll leave it there for this week.
Thanks everybody for listening. And we'll talk with everyone in
the next one. You've been listening to
Identity at the center. We hope you've enjoyed the show.
Make sure to like, rate and review and we'll be back soon.
But in the meantime, hit the website at
identity@thecenter.com and find us on Twitter at IDAC Podcast.
See you next time on identity at the center.