#318 - SailPoint Navigate 2024 - SSF, CAEP, RISC, and SCIM Events with SailPoint’s Mike Kiser

I kind of disagree with that. I think much better is kind of a a network of informed actors all sharing information, right? Do you have risk? Yes. Do you have a risk assessment? Yes. Do you have an idea of what's dangerous or not? You do as well. And so let's share information, kind of like dolphins saying, hey, the fish are coming to talk about dangerous actions or identities that aren't trusted anymore or people aren't using trusted devices or whatever

else. And saying whoever is listing, we're broadcasting this information out so that you, another component in my client's infrastructure, can take the appropriate informed action. Now, just like the dolphins and the Fisher people, the dolphins give the signal. The Fisher people don't have to throw their Nets. They have complete volition. They have complete control, right? They can just sit there and do

nothing if they want. Shared signals is a way of sharing information about identity context that let gives that freedom to the receiver of the information. This is identity at the center if it has anything to do with IAM. This is the go to podcast now your hosts Jim McDonald and Jeff Steadman. Welcome to the Identity of the Center podcast. I'm Jeff, and that's Jim. Hey, Jim. Hey, Jeff, how are you? Not so bad yourself.

I'm doing good, man. I've got all my beverages lined up. I've got coffee, Pepsi, water. I'm all set. You got a. Primary, a secondary and a tertiary beverage. Yes, in terms of caffeine order. OK, and this is a crinkly water bottle that's going to drive me crazy when you try to open that later. Oh, yeah. Oh, yeah. That's. You see, Jeff, I do things to drive you crazy. Yeah. I think all of the listeners and viewers know that by now. Yeah, I think it's an accurate

statement, yeah. So in for those of you who are watching on YouTube, you'll see I'm wearing my white jacket with black lapel. So it's a, it's like a white tuxedo jacket. And Ian Singh made a comment on one of the pictures of us from the Authenticate conference that said, I've never seen Jim and Jeff wearing the same jacket. And that's because I'm kind of known for wearing silly jackets. It's actually not silly. It's just a nice jacket.

But, you know, it's kind of like within the spectrum. It's off the spectrum in terms of, you know, bold style. It is definitely a bold style choice or as I am, more of a traditional, you know, blue spore coat. I love the blue, the the blue polo. This is my my jam. So I'm happy when I don't have to wear a jacket or anything like that. You like to do it Me now, I'd rather be cool temperature wise before I'm not going to give you that opening to get out.

I'd rather be cool. So we're here at Sale Point

navigate 2024 in Orlando, which, you know, is my favorite place in the world. Yeah, exactly. When it's 70°, you're hot. Yeah, it was last night. It was 70° and it was like, I think 146% humidity. So there was like, you know, water. What are we just forming in the air? But yeah, most of the time we're spent indoors in air

conditioning, so that's good. Yeah. And The thing is like the allergy, you know, people don't tune into the podcast here about the allergies, allergy forecast in Orlando. So we can probably cut right to the good stuff. I will say that one of the requests I got from a person named Rainer was a navigate discount code. By the time this airs, it's going to be too late for that to for this information to be

valuable. But what I will commit to is that I'm going to keep that in mind thinking about international conferences and getting discount codes. But I think that's one of the reasons people listen to the podcast, right, is that we're able to get these special discount codes, put them all in one place. And what we always commit to is that we won't publish a discount code unless it's the best one that's out there. Yeah. We don't want to be in

competition with better codes. That's a losing argument for us. So I do keep them on our website. So if you go to our website, idacpodcast.com, you Scroll down a little bit, you'll see whatever the current discount codes are. So I have them in there. Identity Week actually gave us discount codes from around the world. So when they had their Europe, the America and the Asia conference that that same code

work for all that. But yeah, we, we will keep that in mind and try to get as many as it can. Doesn't cost anything for us, doesn't cost anything for, you know, the person who uses it. And if somebody wants to partner with us to promote their conference or whatever and shoot us a discount code. You know, it does cost money as us getting here. It does does cost money to get here. So thanks to sale points and thanks to RSM for bringing us out here and sponsoring this.

So we're we're upping our video games slightly. We've got ARSM logo on that one. When we get to our guests, you'll see an RSM thing logo for that. So that is our day job that Jim and I do and we are actually sponsors here at Navigate. So Full disclosure, right, We're part of that Sale Point ecosystem when it comes to integration, things like that. So yes, thank you to Sale Point RSM. And then before we get to our guests, we're going to talk about Gartner.

Yeah. So the Gartner I am Summit is coming up. It's December. What is that 6th through 9th? I don't know. I don't want to start like a disinformation campaign as someone shows up in the Grapevine, TX area and there's no conference. So check the it's in early December and we have a discount code IDAC 375. Guess how much that saves you? I'm. Going to guess $375. That's a good guess. I know I'm just a savant when it comes to those numbers.

So we will have a link to the registration in the show notes.

And let's get on to today's main topic in our awesome guest who we I've been dying to get on this podcast for a long time. Yeah, I'm really surprised. This is the first time we've had him on the show. We're going to talk about SSF, We're going to talk about Cape, we're going to talk about risk, we're going to talk about skim events and a whole bunch of

other IAM acronyms. Let me welcome to the show for the first time, Mr. Mike Kyser. He's the director of Strategy and Standards at Sale Point. Welcome to Dining at the Center. Thanks for having me guys, pleasure to be here. This has been a long time coming. While we actually spent a lot of time last week for the Authenticate conference and that was great. I want to talk about that. And then you're going to speak

here tomorrow in real time. So today for us is Tuesday, October 22nd, but you're actually speaking tomorrow and this episode is not going to come out till middle November ish. Just the way things kind of work out. But I want to get into that. But tradition, first time you're on the show, we always like to find out our identity backstories. How did you get into the world of identity? Is it something that you chose or did it choose you? Good question. I think like most people like

kind of chose me, right? I started out in my early days, back in ancient history, looking to be a physicist, astrophysicist, astronaut, politician. There's a whole a whole thing there, a real Renaissance man. You. Know or drunk for a thirst for power or something, right? Eventually though, I did some some stuff in in those arenas. Not the politics stuff, but the

physics and astrophysics. But eventually wound up graduating from the glorious University of Texas gym with a computer science degree and then looked around for kind of hard problems. And one of those was security. And so kind of thinking, thinking about how to make sure people had the right access, but more from a authorization authentication perspective. And then kind of did different things with IBM for about 16 years and wound up at sale

point. So it wound up combining multiple streams of what I've done over the years, the technology side, but also the culture impact to what's called normal people side. I love things that combine different areas and different angles on the same problem because it it just helps people understand it and grasp it. And I like questions that have no real straight up solid answers. So I. Think you have the job where a lot of people are like, I wanted

to do that. I want to spend all my time working on standards and getting on stage and speaking at conferences like how does somebody become Mike Kaiser? How does somebody work their way into a role like? That First off, that's a terrible idea to become Mike Kaiser. I, I think that you always see the surface level of everything. So I think while speaking and writing is very visible, unless you're doing something of substance on the back end, it's kind of all for naughty, right?

I grew up with a father who is in public relations. And so I grew up speaking and writing. And then I also had the technical side. But I've always tried to to find things that kind of combine those, right? Putting things in ways that people can understand and grasp and, and use and talk about the next dinner party and not bore the entire room, right?

That's all kinds of things. So having substance working on something either as standards or developing products or educating people, whatever it is, and then doing the other things on top of it is possibly the way to go. I've got to figure that there's a lot of like doing the extracurricular right? Because I'm, I'm trying to get for somebody who's trying to figure out the path to become in the position or the type position that you're in. It's, this is my belief is that

it's working a lot of overtime. Not overtime, like for a job, but volunteering to be part of these groups, the Kantara initiative, things like that and getting in the know, but meeting people, networking, things like that. Yeah. And there there's a place for everybody, I would say. I think it's one of the things that ID Pro does really well is it gives that community where you can come in and say how does this work?

Where is my place? Your place might be standards or it might be doing technical stuff, might be architecture or consulting or implementation. It might be education, writing. The danger is saying, oh, I want to be like that person, so I have to be exactly like that person. That's not really true. If you look at most of the people in our industry who people know, most of them didn't start outgoing into identity. They kind of took a random path.

I think that random path kind of like you're implying Jim pays off right. If you're interested, if you're curious about lots of different things, then I think that that pays off in in the longer term, right? Because now you're more well-rounded person. You see different angles, you see the implications for for usage and everyday and and that kind of thing. So. But that's identity, right? I mean, identity is made-up of a whole bunch of different backgrounds, people, experience, etcetera.

So all of those contribute really to the success of the industry itself is we need those viewpoints. Because if you get into your little bubble, you start to design only for your little bubble, and it falls apart very quickly when you hit the real world where you have all those other parameters you have to account for. Yeah, completely, completely agree. So you were at Authenticate last week with us.

You gave a fantastic presentation that's I don't even know how to describe it. I want you to describe it because it was a Sonic presentation and it included bolero and graphics that you made. We were geeking out about After Effects earlier. Take people through who who weren't there, haven't seen this. Tell us about that presentation. Sure. It's I wanted to talk about a is

impact on authentication and authenticity and culture, right. And so I had heard about in talking about doing homework, I'm always listening for ideas and stories. There's a writer named Michael Korost who writes for Wire magazine. And a couple of years ago, he, he posted an article talking about how he had a hearing deficiency, had hearing aids from a young age, but he loved Bolero and he could, he had had difficulty enjoying music except

for this one piece. And Bolero is repetitive and it's clear and it's easy to grasp and it's got a clear message. And he heard it when he was 15, loved it, became part of his kind of authentic identity. In 2001, within 4 hours, he went completely deaf. He couldn't hear anything anymore. And he went and got cochlear implants. And when he did that, he turned on Bolero again.

Instead of hearing his beloved melody, he heard nothing but kind of distorted static, the signals coming to his brain. The way cochlear implants work as they bypass your outer ear and go right into your brain directly, your brain can't really handle the change and the side effects of technology adoption. Easy translation to AI, right? We're rushing to adopt AI, in particular generative AI, and we're dealing with the side effects as a culture. It's kind of eroding authenticity.

You combine Cross Story with the story of Bolero, which pits technology with a rhythm section and a recurring melody for 18 long minutes. It builds up into this conflict with you in the middle trying to decide what's going to win. You know, classic late afternoon thriller. Is technology going to destroy humanity or is humanity going to survive? Right. Listen to the song. It's pretty great. I think. Jeff, you did recently that poses the same questions we should be asking yourself.

What is being ceded to AI and technology and these kinds of things. So I was raising some of those issues from claiming authorship versus using AI as a tool to wholly ceding control. There's a a mayoral candidate in Cheyenne, WY you can vote for Who's Day chatbot literally or dealing with grief and loss through AI creations.

It's all those questions we need to ask what's being seated technology and then the end the end of The thing is I've totally ruined my whole talk is that cochlear patients actually they remember their brains remember what the truth was that they knew the sound to be and so the signals eventually get remapped

in their brain to that truth. And so my argument was we need to remember our authentic humanity and embrace those use cases, whether it's a personal assessment of what we do or using ethics canvases to guide our use of AI or supporting data provenance efforts through things like watermarking and, and the like, or combating disinformation campaigns.

Or the closest one in my heart right now is the death and digital estate with the Open ID Foundation, where we're trying to give people volition over their digital life and their digital identity, even after they're gone, how they're represented, how they're preserved or not, how to get their to their controls or the resources, all that kind of stuff. And so like I said, I wasn't trying to say, hey, here's the easy solution because I don't think there's necessarily an easy solution.

It's more of a let's think about this and as a collective, as a community, have these discussions so that we can try and safeguard as much of what I would consider to be authentic humanity as we could so. It was a really good presentation. And you gave homework at the end. I did.

And if we have time at the end of the show, I want to get back into that homework because I shared with you kind of before we hit record, here's kind of what I thought, but I'm curious to see and have that kind of recreate that, that discussion. And you're, you're here at sale point navigate just like obviously we are and you're going to give a conversation tomorrow around Cape risk and skin events. Give us a preview of what we can expect to see for that.

Yeah. So with that talk, I'm starting from kind of the ground up with the shared signals framework and, and what that implies for all of us as practitioners. Since this isn't going out till later. I can tell you what I'm basically I'm talking about

dolphins. The reason I'm talking about dolphins in South America, there is a pod, pod of dolphins, pod of dolphins, OK, nailed it. Pod of dolphins that cooperates with Fisher people on the coast to the point where the dolphins swim up. People with Nets are waiting on the shore. The dolphin gives a signal. Fishermen cast their net, the the dolphins drive the school of fish in the Nets descend, they get they catch fish as they do, dolphins come in and take a couple fish and everybody's

happy. Scientific paper released this year early last year shows that that cooperation makes people catch more fish, makes a dolphin survive longer because they're not caught up in other fishing mechanisms. So mutual cooperation is the name of the game and benefits both. Combine that with the idea that the dolphins are giving a signal, saying hey, you need to know the fish are coming and they take action on that is a great stand in for shared signals.

Because the whole idea is to say for far too long we've been isolated in our knowledge base. Vendors tend to say we have all the information you need, just buy from us or our suite of products and we'll solve every problem you have. I kind of disagree with that. I think much better is kind of a a network of informed actors all sharing information, right? Do you have risk? Yes. Do you have a risk assessment? Yes. Do you have an idea of what's dangerous or not?

You do as well. And so let's share information, kind of like dolphins saying, hey, the fish are coming to talk about dangerous actions or identities that aren't trusted anymore or people aren't using trusted devices or whatever else. And saying whoever is listing, we're broadcasting this information out so that you, another component in my client's infrastructure, can take the appropriate informed action. Now, just like the dolphins and the Fisher people, the dolphins give the signal.

The Fisher people don't have to throw their Nets. They have complete volition. They have complete control, right? They can just sit there and do nothing if they want. Shared signals is a way of sharing information about identity context that let gives that freedom to the receiver of the information. It's it's not prescriptive, it's descriptive. This is going on heads up, you choose what you want to do right? And that's important and important to the success of the standard.

But we've a tool originally talked about Cape at an Internet identity workshop. I was there, it was really great and he kind of launched this discussion. But as it's grown, I think those kinds of keys help with the ever present struggle within standards of incentives, right? What's the incentive for a vendor to support it or something to adopt the standard? It has to be mutually beneficial. And so I think that's that's really helpful if that makes sense.

So I love the analogy because that brings it to a level that I think everybody can understand. Like, OK, what are we aiming toward? What I want to talk about is the shared signals framework. So this framework, who are the actors in the framework? Who's providing the information? Is that applications, its infrastructure? Give us some examples. Who's receiving it? What are they doing with that information? And then from a framework standpoint, is this going to be

like an industry standard for? Is that how you see it playing out? Yeah. I think it's important to sense that a lot of times people conflate some of these terms. They combine them and think they mean the same thing. You'll hear Shared Signals framework, you'll hear Cape, which is Continuous Access Evaluation protocol. You'll hear RISK, which I don't remember what the actual expansion of that acronym is. Ranks risk and incident sharing and collaboration.

There's a lot. Of ands in that one right. And so you'll kind of hear those together, especially Cape and shared signal. So first thing I want to say is that shared signals is the transport layer kind of pub sub sender, transmitter, receiver kind of vibe. Cape is the one that focuses on some of the session based use cases, which is great because Pete, that's where as you're implying people say, OK, why do I need this? What is the OR some use cases that benefit me?

Some examples say there is a single sign on provider that knows that an identity has travelled impossibly or done something else, that they're going to take action now and they revoke all of that identity sessions within their their vision of the world. They send out a session revoked event, say to an IGA vendor. Now we get that event and we decide what to do based off of that, right?

We can say, well, we could just say this is a high risk user, you know, take a stereotypical case CFO or something and we're just going to suspend all of his identities. Throughout the enterprise, because we want to start a certification or do some other sanity checks or we can wait until we get multiple of those, right? And then we can kick off a workflow and start a certification or suspend or it really depends on each side.

The the event can be shared and then the actions on each side are best practice for that sphere of influence. So I think about traditionally your SSO vendors, anyone with a authorization Oauth token or single sign on or in play, but also additional people, people that know about the network or about the device. They're all kind of in play as a transmitter or a receiver now, depending on. Either one, right? Right.

And you can be both. And I think most likely in my ideal world, everyone's going to be a bit of both. In other words, it's like from an IGA perspective, just because that's because that's my world, right? If, if I I want information about devices, are you on now on an untrusted device, maybe I change your access. From an IGA perspective, maybe I lock you out from particularly applications because you need to be on a trusted device for that.

And the other way around too, if I suspend an identity, what happens? Well, I use my connectivity layer to go out and suspend accounts throughout. But even if I do that immediately, and that takes effect immediately, a lot of those identities have Oauth tokens or some kind of session token with a time to live. And until that expires, Jeff can happily be Jeff, even though he's no longer trusted by the enterprise, right?

And so it's those kinds of use cases where people are like, oh, we don't already have that today. And like you do in places with specific API, you know, endpoints and that kind of thing. And there are other movements as well, but there's a lot of motion to kind of to make these all work together. So, and it's not just the extreme use cases either.

You can change levels of access. If something changes in an attribute about a user changes, you can send out an event saying, hey, you probably want to re evaluate all the tokens for this user because their access has changed. And so moving to a continuous or event based to pick who you're talking to, right, The particular flavor of it, it's a continuous process of evaluation.

Every time I access something in an ideal world, I want the latest information, the latest attributes, the latest version of the policy, all of that to be evaluated. And that's kind of what this what this does. So it's the idea then to have essentially instead of a, a, you know, a vendor specific, this is what we do for security. And I think we're familiar with things like, you know, the impossible travel conditional assets, right?

Any authentication provider typically will have that sort of thing is let's open this up to really the identity ecosystem or security ecosystem and say, hey, we've collected this data, we have this thing and we're both a, a sender and a receiver of this information. So that leads me to believe that there is something that is sort of outside of a specific technology stack to collect all this information. That's how it works. It's a standard.

So if you were going to do this without shared signals, I would have to call up every vendor I wanted to integrate with. I have to say, what are your APIs? What are my APIs? My legal department would have to get involved. We all have to. It's a long road. And then anytime your API changed or my API changed, now we have to do it all over again, regression testing, etcetera, etcetera.

Using a standard to share this information means I can hook in really easily without that overhead, right? And so I, I don't think there's necessarily a, a centralized repository for this information. It's more like, hey, I know this, you might want to know. And the receiver signs up to say, Hey, these are optionally the, the users I'm interested in or the groups of users I'm interested in. And here are the event types I'm interested in.

And so you subscribe, you basically set up a, a pipeline to call the stream basically saying I want all your these types of events for this class of users or just all these events period. And then they either get pushed or pulled across the across the pipe.

See, I think it opens up an opportunity for another part of the market and we're kind of infringing here now in the SIM space, right or other sort of event and logging and monitoring type tools where you know it is historically been well, let me send you my Windows logs or applications logs and it goes to the central spot. Now we've got a standard and say, OK, this is how technologies can interact very similar to like SAML, right? And this is how we want to

authenticate. Now we've got something to provide data around events that are taking place in a standardized way to say if I wanted to, I could build a product that is ASSF type product or maybe I'm a Splunk or some other, you know, SIM that someone I can think of as. Well, sure. Where I say, OK, we want to be able to, you know, pull those into our system because it's it's great to have it in one spot.

But I think the power here is what if we could leverage our IGA platform and our IDP and our privileged access and maybe even a non security platform like a work day maybe where our people data is. Let's pull that all together and have sort of like this overarching ecosystem and say here's Mike, Mike is in Orlando. We know that here's what IGA is going to do You guys do your own thing.

But by the way, if we know this about Mike, let's put this somewhere where people can, you know, receive that data and do other things with that. You, you will see, I do think you'll see a space pop up for transceivers, trans, you know, translators of some of these signals, relays, those types of things and architectural choices. I think that the impact I see is avoiding a single point of of this is where this is the keeper of the Kingdom.

Just to have some of that. If I were an identity practitioner, I want a team working together right now. Each of them are going to have a different perspective. IGA is going to have a different perspective than my SSO will, then my VPN will, then my HR system, then my sales force, whatever. You're relying party kind of application. But what it does is it provides

an event oriented, close to real time process for sharing information that didn't exist before. I'm sure people will suck it into a SIM, right? I mean, I feel like that's the natural inclination of a security team in an enterprise environment is we want all the data and we want to do something with it. Right, I think the I think the power to me, the usefulness right now is actually giving that real time response and control to all these individual distributed players.

I don't picture a centralized hub for controlling everything about identity and organization. I picture to use a, you know, lingo identity fabric kind of approach where there are deciders everywhere and informed understandings of thing everywhere, right. So it's, it's, it's more like

that. And then when you when you couple on things that aren't just session based, then you start to touch more and more, not just Cape which does continuous access evaluation, but more account level things and the risk stuff, suspending accounts, activating accounts. And then the more recent stuff, which I'm particularly about excited about, which is the skim events, which could optionally sit on top of this. And now you're starting to impact a broader and broader spectrum.

Yeah. So I want to back up to some of these that are, this is about developing a standard.

And I heard Heather Flanagan say there's two approaches to developing a standard. One is kind of got an ideal of how the technology should work, you can develop a standard. The other is there's all the, it's already been deployed, it's out in the wild. Everybody's doing it now. You're trying to pull it together into a standard. I think this is like the latter, right? This is trying to build a picture of what it should work like. Or is it the other way?

I think I, it's a good question up for debate. I think it's the first way actually, only because people were kind of doing this a little bit, but they're one off integration. So maybe that's not even up for the second way. But I think this was such a different way of saying, why don't we just straight up share this data and not hold on to it really tightly and say we're the

only option here. So in that sense, I feel like there was a lot of idealism in the original assessment, but the use case was so strong that your session needs to needs to change in in close to real time and share information about that, that it was powerful enough to to pull people in, I think. I think it gets to the question though is are these logs? Are these identity bits of data that we're collecting?

Is that secret sauce for a vendor, for example, or is it something that, yeah, a vendor is willing to share with others?

Obviously, you know, you're not sharing code, but you're sharing. You have, if you have an API connection or a standard to say, hey, this is what sale point is collecting and here's what we're going to do with it. But we have an API or we've got a shared signals framework that you can tap in to say if you want to do other things with it, with other things, be our guest. Right.

And I, what you're hearing me too, is that you're hearing me, the idealist talking because that's usually how I approach standards. It's not, you know, how can we, it's always like, oh, what if we could do this, wouldn't that be cool? And then I have to think about, well, how does this monetize itself? Right? I, I think you're right.

I think it's, it's the we're going to take this knowledge that we know and we are also trying to monetize internally as a vendor, as a vendor, and we're going to make that known for other people to use. And I think that's the only way for us to protect. I'd use identity to protect things in real time. So that's that even kind of rules out a little bit of the same, same kind of stuff because it's a little bit more after the fact.

This is more right now. How can I share information for you so you can take a more informed choice. And if I know there's a danger, now everybody knows there's a danger. And that's got to be the way to go. Team sport would be my. On take and that's my I guess that's the key part here is this is a real time. This is a a quicker way to get

that information right. Because what we don't want to do is where we've been for the last 20-30 years is hey, there's data sitting in our SIM yeah, we didn't do anything about it because what is the average bridge takes like half a year to even discover right? The name of the game is speed. So yes, I want my IGA platform to detect this thing and I want it to move very quickly to mitigate risk that that event

might indicate. But the quicker that I can get it not just in my IJ platform, but into other platforms, right? How do I control my IDP? Do I prompt for an extra MFA? Do I shut down access to a privilege access management vault, Right? There's all kinds of stuff that can happen. And that orchestration really, I don't think can happen unless there is this standard to communicate that these events are even taking place, right? Totally, totally. And what you're also seeing in

the industry is a slow move to event based architectures, and this is a reflection of that as well, right? Are you going to use shared signals to do everything and every identity and every application? No, right. Because it's not worth it. There's right now it's not probably in your best interest because of speed and scale and other reasons to put event based architectures everywhere. Some applications, some portions of them. Yeah, I think it makes a lot of

sense. And so while you're seeing vendors in the Interop, right, I think you're going to see more and more relying parties and application owners and that kind of stuff adopted as well 'cause like, oh, that information is available to me, 'cause if you think about it, say, say skim events where you're updating information about the account, about the attributes, about the identity, right?

If you have that in place, well, now I've got a policy in my application that's only as good as the last update of that information, right? So it's like updating a policy information point saying, hey, the attributes about Jim have changed. Everyone needs to do this so that when you go make the decision, you're making the right choice, right? And so that is really powerful because now we're into the authorization space, we're into the policy space we're in. It's all of this working

together, right? The stuff that's going on in Oauth, the stuff that's going on in shared signals, stuff that's going on in Skim and, and all these various working groups kind of combining to. So, so Jeff made the point about having one place. I want to go even further and

say why? Because I think you're talking about within your enterprise, but why is, why couldn't there be one place that everybody goes to get these signals, right? Or maybe the maybe there's a commercial landscape where a couple companies focus on this and it's pulling signals from all the major ID PS social networks, you know, Microsoft and pick building 1 picture of, you know, these are the identities that look to be compromised.

Rather than it being kind of a competitive advantage, Why not all kind of row in the same direction? Because we're all trying to to solve the same problem, which is don't get compromised, right, right. And if everybody's contributing, everybody's pulling it, it seems maybe I'm being too idealistic. What do you? Think well, I think is a First off is a distributed approach, right. So we're not going to have necessarily one repo with all the stuff it's live events being

sent back and forth. So that kind of to have one repository kind of defeats a little bit of the, the way that the approach is done. Secondarily, not every vendor is going to buy in, not every app is going to buy in, right? And so to that end, there are major vendors that are not doing shared signals right now and they have their reasons and their incentives for doing so. The idealist in me is like, why don't we all do this and just set it up right?

And then as a practitioner, what am I doing? I'm looking at my environment and my business policy and saying this is really what I want to see. And then I'm setting up those relationships. The technology is secondary. The technologist enables me to do this and share information in near real time, right? But it's really the policy and what I want to have give people access to and updating that near real time. That's the, the key for me as a practitioner.

So just like single sign on, right is commoditized right now, right? I, the policies, I want access to these five things, SSO and SAML is just the technology that lying behind that, right? And so as a practitioner, I get to decide, I want these people groups, these identities, people groups, these identities and, and these events. And I want this to happen and that to happen. When I talk, people are like, well, what, what's going to happen when I do this? And I say, well, each end is

going to make their own choices. Each application and each vendor, whoever it is, it's going to say this is the default action. We see something happen, we're going to suspend you, we're going to send out these events, and then the other side takes it in and has probably a default approach. But again, if I'm an identity owner, I wouldn't control over what that actually looks like,

right? Just because you sold me a product that sends these massive alerts anytime anyone goes out and gets a Taco, maybe I don't want, you know, Trisha, you'll have to go get a Taco. I don't want to shut down your whole thing. So I'm. Talking events that I can get behind, I want to know. Where this Taco is so. Let me know how do I subscribe to? That event as an event, right? Tacos service. How about that? Yeah, there we go. So yeah, there's, there's,

there's balance there, right. I think there will people be people that suck all these things in and put them in a repository. I don't think that's really the idea because we're trying to move to a real time distributed kind of approach rather than let's build 1 big repository. And I think you can be an aggregator and keep it real time. And that was like, I guess I

live with that minor point. My bigger point was, you know, it feels to me like we need big tech to get behind this, to say, all right, we've got massive numbers of authentication events. We have this repository of what we think are compromised accounts I think. Some of that is secret sauce for those vendors. That's the. Service that people pay for, that's what I hate and and it it it, it, it, it does sound altruistic to say, hey, why don't we all do the same thing?

But the reality is there are different vendors that are paying that are they've done the work and they are trying to monetize that. They're saying, hey, if you join our IDP network, not only are you going to get this product, but we also have these other events and we can help do an internal sort of product specific thing around that. I'm with you. I wish there was more openness around that. And I think it's coming.

I think there are large enough people in the working group, large enough people in the Interop in December that I certain standards survive or die because of adoption, right? Look at SPML, may die in a dumpster fire forever, but Skim had a lot more success. Has it been 100% successful? Not at all right? But I think shared signals and the event types that sit on top of it Cape risk Skim events

someday. Like I think those have enough backing to pressure organizations to adopt and incentives, like I said, incentives matter, right? So I expect some vendors to say, no, we're not going to participate until enough large customers say no. We have to have this until analysts like Gartner at the last Interop in March said you need to demand this from your vendors. That helped tremendously, I

think, right. And so it's all a, a, a push together of paving the way technologically, paving the way politically, paving the way for demand, customer demand, right? So, and you can still keep your secret sauce, 'cause just because I tell you an account is compromised, it's not like I'm saying, and here's all the Intel I have and all the data. Now you get this event saying I have taken this action, you might want to do something about it.

And optional additional reasons or something, but you're not getting my internals. I've taken a section you do. You right, right. And instead of us, instead of me building this API based thing to go into your system and cause action, now I'm like, let's do this standards wise. And the person who owns both of our products will demand it.

They own both. So they can say you're going to do this and you're going to do this and you're going to like it or I'm going to walk away and take my money to another vendor, you know, or another offering is my is my ideal anyway. Well. I think the important thing

there is customers need to demand it. That's really who's going to drive the adoption. If you're listening to this and you are probably a customer of an identity solution or a security solution, that's where that's where the sport's going to come from. Put it in your RF PS and your RF fives, put it in your requests for whatever and say, hey, does your product support shared signals framework? How does IT support it? And and really that's, you know, it's, it's almost like a

grassroots campaign, right? You've got smart people who are really thinking about this. You mentioned a tool. There's Sean yourself other Yeah, exactly. So there's there's a lot of thought behind this. There's only so much creating the standard can do. People have to actually ask for it and desire it and want it. Right. Just like the fishing and the

dolphins, right? Both parties benefit, I think in the long term we all benefit from this level of cooperation because just like the dolphins gets more fish and the Fisher people do as well. The same thing is here is true here. If if our goal is securing the enterprise via identity, then let's cooperate and I think we all catch more fish or something. So we. Promised we'd get you out of here at a certain time. But they do have one more question. So we've had one of our most

popular episodes. We had several folks like yourself help us out with a question. So we've talked about what's the difference between I am and digital identity. But now this term identity

security has become popular. To me, this feels like it's the definition of identity security because it's taking the cybersecurity area and digital identity and combining it into a solution. Am I on the right track? How do you see it? Yeah, I think so. I think, you know, identity security is, is the idea that, you know, identity is the key, right? Identity is, is that the center? Yeah, it's the old working my way to you. I know my audience.

Yeah. So I I think that information becomes power and becomes the operational knowledge on which to take action or not, right. And so now we're saying I've got identity information, you've got identity information. Let's share it and and use it together. It's one aspect of that right now whether it fits into a particular market segment defined by someone or some of the other, sure, I think you'll see it in different places.

You'll see it in base platforms. I think in the long term, in the short term, you'll probably see it in more risk based or ITVR environments, that kind of stuff. Do I care where it exists? Not really. As long as we have it right. I, I want it, I want it in places and I want it pushed because I, I think the obvious statement that we've already made is obvious that identity is the new key. It's not just the network, it's

everything. And how you define identity becomes the second question of that right. Is it, does it include device? Does it include location? Does it include past action or past behavior? Does it include the weather in Caracas? It might, right? It depends on how you define the identity for that person, which by the way, was also part of my

talk at Authenticate as well. It's like how you define identity influences how your policy expresses itself, and ultimately how you safeguard all that kind of stuff.

So I want to go back to the authenticate conference to close out the conversation you gave homework at the end, and then to listen to the whole 15 minutes of Bolero. And what did people get? Well, tell me what the homework was and I'll tell you what I got of it and we can have a conversation with it. So during the the presentation, the talk I was giving, I played snippets. It's 18 minutes long. I had a 25 minute slot. I couldn't play the whole song. Find a very long song and just

play that. It's like playing a movie when you're in school. Right. So I played some and I and I played the rhythm section, which represents technology and I played the melody, which represents humanity, and they get louder and they get basically opposing each other. And I described the ending of Bolero as amazing and crazy and brilliant and really fascinating

and shocking. And then I told them I wasn't going to play it for them to the audience, which people groaned, which is what I wanted them to do. But I said go home and find 18 minutes and carve out the space and just listen to it end to end. You know, I didn't say this, but you either love Bolero or you hate Bolero. But the homework I gave was, given my premise, just running with my premise that it's

technology versus humanity. These two different sections, half the orchestra, 1/2 the orchestra, the other. The ending, I feel like gives a particular point of view that Rebel has about which will win out. Will technology destroy humanity or humanity preserve itself against technology? And so I said go home and listen to it and see what you think, and then come back and find me and tell me what you think Ravel's point of view was. So I did it. I did the homework because I'm a

very good student. Good job A plus. A+ for me. Here's what I got of it was two things triumph and finality. So it Chris ends and ascends throughout this entire, you know, track essentially. And the way that I perceived it was humanity overcomes and it's triumphant at the end, but there's an abrupt end. It's final and we're done. And then you got me thinking earlier today, I was like, well, is the final because we lost? My thought was OK, We we won. It's triumphant.

Humankind has always risen up and somehow evolved or, you know, accommodated or figured out right how to survive. We've made it this far. And then there's that finality of it. Yeah, but. We're going to be final unless you lost. Well, that's, that's see, that's what that's the thinking part of it right too. Right. What what's really fascinating also about Valero is there's an article that came out a couple years ago. He and Edgar Allan Poe were contemporaries.

And this person thinks or argues that Ravel was influenced by Poe, who had written this piece about how you create a work of art. And Bolero mimics the Raven from Edgar Allan Poe, where there's 18 repetitions in each. There's the Raven saying never more, never more. And in Poe's poem and you have this rhythm section that is inevitable and just going to hunt you down like a dog, wherever you are. Whether or not that's true, I think it it gives insight. I don't think Poe was nursely an

upbeat kind of vibe. And so that kind of does. He's like the original goth, yeah. It kind of shades it shades how I think about it maybe, but the the ending of Bolero after 18 minutes of the same thing over and over again, building up it it's always in this one, the key of CI believe the whole time right near the end it changes to a a different key, which you're like, Oh, finally some change in this piece that's been beating me down. And then it the melody of the rhythm section.

But then, like you said, this is chaos at the end that like trombone's going to worm or worm and just noise and then all of a sudden it goes BAM and silence. So I feel like he's worried that the machines are winning or that they've they've won. I would, I was telling you earlier, I feel like if, if the humanity angle was winning, you'd have this like. Like a soft landing almost. I would feel relaxed at the end of Bolero and instead I feel myself holding onto the table.

So, Mike, what minute are we in right now? Of. Of like in humankind. What are we in 32? We are somewhere in the rising crescendo part of it. I think we're hearing more and more reverberations, right? I think culturally we're only beginning and technology always outstrips culture and our ethics. And I think that while AI and Gen. AI, it's neither good nor bad inherently, it's just technology. It's how people use that that influences things, right?

And I do think, as I said last week, that our authenticity is is suffering. It's not irretrievably lost. We will change as a result of this adoption of technology. Is that more of who we already were or is that because of the technology? I, I think it's more revealing just of who we already were and technology is just accelerating and adding to, but we're getting into deeper waters. I would. Say deep thoughts. I feel like this is this is just the cycle of humanity right now.

It's AI. Yeah. Before it was electricity, it was running water, it was cars, it was horses, it was Spears. Nang. Indoor plumbing, I don't trust it right? Well, as someone who was living it lives in Asheville area, indoor plumbing is very important and I'm happy to have my back. So all right, let's send on a high note here. Thank you so much for taking the

time with us. It was a fantastic conversation, both this but also again, just really well done to the authenticate conference. I hope actually you'll do it again so more people can experience it at some point. Is it on YouTube? Not. Yet I think it will end up probably in the authenticate. Somewhere of some sorts, yeah, it's still I think for attendees for a while, but if anyone wants to hear it again, I'm hoping to do it again, so. There we go.

All right, so we'll wrap it up there for this week. You can find us on the web idacpodcast.com. We're on YouTube, idacpodcast.tv. Gotta make sure to get that out for Jim this. Is very I'm I'm just here making sure that making sure we forget YouTube. Got our checklist, connect with us on LinkedIn. We'll have a link in our show notes for people to connect with Mike and to learn more about Sale Point if you're not familiar with Sale Point as

well. And yeah, don't forget to like subscribe, do all those fun social media things to help us continue to grow the show and get great guests like Mike. So thanks for joining us and thanks everyone for watching and or listening and we'll talk with you all in the next one. You've been listening to Identity at the Center. We hope you've enjoyed the show. Make sure to like, rate and review, and we'll be back soon. But in the meantime, hit the website at identity@thecenter.com.

See you next time on Identity at the Center.