#333- Navigating Identity in the Automotive Industry with Andrew Cameron

Every second that when you hit that button on the app to say start my vehicle, unlock my door, call for help, right, Whatever it may be. That is all mission critical things where you cannot have identity be the slowest link in the chain. How do you tackle speed when it comes to make it secure but make it fast?

Yeah, that's, that's part of the process of bringing things to production to make sure that you have the, the performance, the response, the, the, the, the least latency involved when making. So there's in all of the best practices that need to be brought to bear when it comes to

edge computing, right? To be able to make calls to an API services layer that can respond and, and recognize that a a user is authenticated and have authenticated with MFA and that we can process this request versus yeah, this doesn't look right. Let's reject the request. Let's cancel this session because they've been compromised, right? We get a threat signal that says that the user may be compromised, right. So those are things that have to be taken into account.

But yeah, at our scale and, and to be able to have a response time when you start your vehicle of a couple of seconds is, is something that is AI think it's the highest level of of distributed system engineering at our level that to be able to get that done. And it's there's a lot involved.

Like you just said, there's, there's so many systems, so many interactions that happen that the customer never sees right, but that we have to get involved with to make sure there's policies that get touched, that get triggered so many points along the way. This is identity at the center. If it has anything to do with IAM, this is the go to podcast now your hosts Jim McDonald and Jeff Steadman.

Welcome to the Identical Center podcast. I'm Jeff, and that's Jim. Hey, Jim. Hey, Jeff, how are you? Oh, not so bad yourself. Good guess what I'm thinking about but. Yeah, I mean. Wrong. Wrong. This is a safer word podcast, so I don't know what what are you thinking about?

Well, I was thinking about ID Pro. I was on, you know, I was in the Slack channel and it's just so full of treasures. So I was just scrolling through the general post and Hannah Souter had a post out there that was about demonstration of proof of possession. I'd never really write up on that. And someone posted an article that broke it down into like the one O 1 level. And I was like this. This is why I'm a member of ID Pro.

And I would encourage anybody who's listening to this podcast through you found the wrong podcast or you should be a member of ID Pro. Yeah, it's worth the I think it's, I think it's 150 bucks and it is well worth it just for the Slack channels alone. But you get so much more with it too, right? You get access to a bunch of resources and just cool people, nice people, friendly people. This is why I like the identity space.

But yeah, big fan of ID Pro. There's also, I think it got posted maybe in the last couple days or so, there are some board positions open up. So for people who aren't aware, that's something, if they're interested in giving back, there is, I'm not sure how many one, maybe 2 board spots open, but go check out the ID Pro website if that's something you're interested. And then of course ID Pro has a big presence of things like Identifer and and so forth.

Yeah, I mean, they're they're dedicated to the education within the industry. I would also say it's like, you know, Hannah made that post. She's a very advanced identity practitioner. Anybody sitting out there listening is like, yeah, I, I don't even know what that is. And feeling intimidated. You could be a total beginner first year or two in the industry and post a question. Nobody's going to judge you negatively. You can be a total expert and I do just not have had the

experience on that. That's fine too. Yeah, yeah. I found myself posting questions sometimes the I wonder if people are going to think this is a dumb question, but I shouldn't have that thought because I don't think people look at it that way. They're excited. People are excited if they have an opportunity to kind of give back and respond to some of those questions. Yeah. I mean, look, yeah, This is why I got into consulting was when I was in, you know, the real world of I am.

You really only know what you work on, and the opportunity to get into other areas that your organization doesn't do is generally not going to happen. So there are lots of people who are focused, like, for example, IGA, privilege, access management. Maybe they're just a funnication they work at just in Microsoft, right? There's so much to learn, so much to know. You will never know at all. Jim, you and I have been doing this for what, 2025 years each. Our guests have been doing it

for a long time. There's just too much to learn at any, you know, at a very expert level. It's very difficult to do. Plus, there's always something new coming up. I mean, remember when self sovereign identity was like the thing that was going to change the world? Still waiting for it, you know, a couple years later, but there's always something new coming up. Now you've got AI that's going

to change things. So ask the questions, go research it, and you'll find that ID Pro Select Channel is an awesome place to get answers. How do you prove Slack channel and then this podcast, because a lot of times when you brought up the that that topic, we a lot of times get guests on, you know, say David Motti or something and he'll talk about something like machine identities. It's like, yeah, nobody's

talking about that. Two years later, it's like everybody's talking about machine identities and not human identities. And so, you know, we keep pushing ourselves, like, all right, let's bring a guest on who's going to talk about something that we don't know a whole lot about, but we're good at asking questions. Yeah, I mean, you can explain that to to us, to dummies, hopefully other people who are way smarter than us and pick it up over audio or video from a podcast standpoint.

Exactly. You know another great source here. Here's my tricky lead. And another great source for learning is conferences.

We happen to have discount codes galore. Yeah, that that was a pro Segway, I got to say. So yeah, conferences, we've got a bunch of them. The one that is coming up next is going to be London, the Gartner I am Summit there. So that's March 24th and 25th. If you use the code IDAC 425, that will save you 425. I think we settled on EUR 425 of some currency off of that. But that's a great one to go with time, especially, you know, for for folks that are maybe in the London area or maybe Europe

at large. We won't be there, but we will probably be at the one later this year in the USI have to imagine we've kind of gone for the last several years, but they were nice enough to extend that. So we're passing along. And you don't have to remember any of these. They'll always be on our website. If you go to idacpodcast.com and just Scroll down, you'll see all the different conference discounts that we've got or any other things we have going on. I kind of fight there real

easily. So there's that one and then the one you and I are pretty excited about. Yeah, this is Berlin. I just booked my flight yesterday, or maybe it was the day before. So May 6th to the 9th, It's in Berlin, it's the Cooper, your coal, European identity and cloud conference. If you use the code ID AC25 MKO you get 25% off. So Jim, you and I are going to be there very excited. All I have booked right now is a flight into Germany and a hotel.

I have not yet figured out what I'm going to do after that. My wife and I are still kind of planning post Berlin but I'm excited to be out there for the first time. Never actually been in Germany other than the Frankfurt Airport on my way to China. India so. Yeah, and getting outside of the airport will be great. Yes. Yes, I will.

And I'm going the week before, I'm going to be in Oslo the week before and we're doing an identity beer and already have at least four people signed up for that and hopefully that list extends further. So if you're a practitioner involved in identity in some way or at least interested enough to listen to this podcast, and you can be in Oslo the week before or live there, reach out to me on LinkedIn and love to get you involved in that identity beer. Yeah, We haven't picked the

exact date yet. Those are all I, I have. I don't think I've ever been to one. But you'll be out there touring the countryside, beer identity, beer in hand, I guess. I had a couple people reach out to me on LinkedIn, you know, graciously being, you know, offering to like show me around and things like that. I don't know where I will end up yet. So I apologize if I don't get back to everybody or if I don't

hit your city. There's just too much to do in in one week that I have between Berlin and trying to trying to get back to the US. So. Hopefully this isn't the last time we go to. No, I think hopefully we can turn this into an annual pilgrimage or something, maybe for IDC to head out to to the cooker. No conference after that's done, vacation a little bit and then Las Vegas for Ideniverse, that one is June 3rd to the 6th. Again, you and I are going to be

doing some stuff there. I don't think we're quite ready to announce some of the fun things we've got lined up, but we're still coordinating on how that exactly will work. But it will be a very fun, another type of thing that we have done in the past that we're excited to bring to Ideniverse. I'll just leave it there. Probably not a probably not very good. I, I, I probably didn't obfuscate that enough. So people will be able to figure

that out. But June 3rd or 6th IDV 25-I D AC2525 percent off and you'll be able to take advantage of that. And that's, and that stacks up the discounts as well. So you definitely want to take a look at that. Yeah. So, Jeff, between those two conferences, are you going to get any work done this summer? I have to because I have clients so they're going to be expecting work to get done. So yeah, I will be working things in between editing, broadcasting, publishing,

working, all that good stuff. And hopefully I'll be able to unplug a little bit and while I'm in Europe to to check out the sites. Exactly. Yeah, enjoy yourself a little bit for sure. Yeah. The other thing that we wanted to mention was we don't have the discount code for it yet, but we've been going to the Fido Authenticate conference for I don't know what is it in three or four years now in a row. And we've been doing something there, will probably do

something again this year. We just haven't gotten that far with our planning yet. The conferences in October, but if you want to be a speaker, if you have an idea for a paper to submit to present on that deadline's coming up. March 3rd, 2025 is the deadline. Go to authenticatecon.com. We can figure out the navigation then to submit a paper, and I would definitely recommend that. I think our discount code's usually pretty good, but I don't think speakers have to pay to

get into the conference town. But if I say that and that's not true. Andrew's probably like shaking his fist at the at the radio right now. Oh yeah, yeah, he's turn up the heart if you're listening and to turn apart and stop listening to this. So no. But if you're interested in presenting our, that's the deadline. OK, that's enough babbling from us again. Check out the website that'll have the discount codes. I'm excited to welcome our guests on.

He has been in the identity space for a very long time. He is Andrew Cameron, he's a technical fellow in identity and access management at General Motors. And before we go any further, Andrew, I don't want to say hi yet. I got to make a disclaimer, right? These are your views. The views expressed on this podcast by Andrew are his and not General Motors. So we're going to make that very clear. So I'm I'm going to swear you in Andrew, do you agree? No, that's fine.

Yes, I agree 100%. Welcome officially Andrew to the show. We're very excited to have you here. Gentlemen, I am honored and privileged. You can't be in the identity industry and not know about this podcast, and so I'm excited to be here. Well, we're happy to have you here. People still discover it. So you know that's it's always great when you have new listeners and new guests on the show.

We have tradition. First time anyone comes on the show, we ask them for their identity background. You've been doing this for a long time, not to age you, right, but you've been doing this for a long time. Tell us something about how you got into the identity space. Was it something that you chose or did it choose you? I feel like it chose me. I started off in app dev, you know, doing all of the early Microsoft development

technologies. And even in my early years at at GM, I was a application architect that I was my primary responsibility and one of my early roles was an, an architect lead on the deployment of an, a, our employee portal, right? So this is a pretty massive undertaking, you know, hundreds of thousands employees. This is going to be the face of of IT for our employee population, right?

And so there was a lot of effort that went into not only kind of what was built around in the portal, but we also position this portal to be in a way to access applications in throughout the enterprise, right? And so where most of the discussions ended up happening was, well, how do we secure access to application A once somebody logs into the portal, right?

And so that typically always involved LDAP directories, access control list and all of those legacy ways of securing things that we did back in the early 2000s. And so I being involved in that so much, I ended up being on a directory team, right? And so we were known as the LDAP team and, and our big deal was to socialize SSO across the enterprise, right? That was actually a thing in the

early days. And so that really kind of kicked off my, my learnings around identity and I ended up meeting, you know, all the luminaries that guys that have been on this podcast previously. I mean, I remember we were deploying a product called open SSO in the in the early years, that was a sun product. And we had a trainer come in and train us on, on how to deploy open SSO. And that trainer was Alan Foster, right? And that's, that's a guy that you guys had on not too long

ago. And, you know, those are relationships that have endured over the past 20 years, right? People, folks like Ian Glaser, somebody who's been on 100 times on this podcast that have helped kind of guide me in terms of being embraced in the community. And, and, and when things like ID pro came along and there, you know, you guys promoted ID pro and, and, and Jim's example is, is 100% accurate in terms of the

value. Because you know, it's typically you don't have that kind of an engaged community to be able to bring issues and topics to and be able to get that kind of rich response, right. Typically, you know, out on the Internet, you're just a dog, right? So it, it's, it's really great to see how ID pro and the community has grown in, in the years that since it's been

created. And you know, I've been privileged to be part of it, privileged to be around this community for so long because it's something that's it's giving me a career, it's giving me a focus. So you've been in this game for a while. How many years do you or how many rings on the tree do you want to claim as being an identity? Yeah, 20 years this year actually. So I don't know if there's any kind of celebration that I have planned, but it's, it's really interesting to see how things

have evolved. Because when we were early on, it was, you know, we were trying literally to go to other organizations within GM just to get them to on board to our enterprise LDAP environment, right? Like we, we didn't even own Active Directory, right? It was come to our enterprise LDAP environment and we can give you single sign on, right? And then the amount of time that went into debating things like password strength, it seems silly now, right? We were, we're heading into

actually password list, right? We're, we're literally rolling out password less capabilities today. And so to think of how far we've come from a lot of the things that started off that kind of was the foundation of the identity and access management discipline. You know, some things haven't changed as much as they need to. I think IGA is somewhere that is, is kind of begging for some, some innovation, I think, but there have been a lot of other

exciting areas. Customer identity is 1 area that I've seen a lot of innovation and a lot of definition and then that aspect of the market in recent years. And so yeah, it, it's just, you know, 20 years in, still passionate about it, still excited about it. So we're we're really looking forward to it.

Is there something that you kind of look back and say that was a game changer or identity? Is it something like, it could be something as simple, I don't know if it's simple, but hey, we've got standards now, SAML, Open ID Connect or you know, whatever before that, or maybe it was the advent of single sign on. Is there something that you might in your mind that like jumps out? It's like, oh, like that's that's it. I think what really kicked the things off was the adoption of

standards. I think things early on like the adoption of SAML and eventually O auth and Open ID connect. Really, because that was, you know, most companies want to, you know, align on that and then, you know, everyone interacts with other companies in some way or another. And that gave you a language, it gave you a protocol on how you could allow external parties to come and authenticate to your enterprise and give them access to things.

Right. And so we started really early on in a partnership with Sun and Microsoft where we were evolving the SAML standard early on. And then we just we promoted the fact that we were part of the Liberty Alliance and then we were, you know, promoting what, you know, making products from Sun and Microsoft work. And this is in 2007, 2008, right, where that kind of thing was relatively unheard of.

So, you know, those are things early on, I think the adoption of standards and, and, and the fact that standards like SAML and O auth and open ID connect have really endured, right? And, and that's what's so exciting about things like pass keys where, you know, that has gotten industry adoption at a rate that that we haven't really seen before, right?

It seemed like it was probably a year or two where we started hearing about Pass keys to everyone is supporting it, all the big names are supporting it. And now you know, we're as implementers, we're really trying to catch up to kind of bring that feature set and to bring the all of the goodness of what Pass keys are to our to our users and our customers.

So I know G miss, you know, obviously a very big company and I've always been curious about this adoption of pass keys because they feel like the groundwork was laid a couple years ago. But just because it's like, hey, we had this new thing. It takes time to adopt those sorts of things and get them into plans, etcetera. What was it that was like, OK, now is the time where GM is looking at this and say, hey, let's do let's do passkeys.

What was the the key to that? A desire to get away from passwords. Just an overall recognition. We had adopted kind of 0 trust principles and practices formally probably 3 years ago. And the desire to move the authentication level to kind of raise the floor in terms of authentication levels that we would be willing to accept to do things like privilege operations is really, kind of really what kick things off and be perfectly honest.

Pass keys prevents a user experience benefit that we really haven't seen to this point, right? So you're being able to move away from passwords to kind of increase that? That base level of security when we're accessing things within the enterprise and you make everybody happy by not having to enter passwords, not having to do, you know, less secure MFA steps as a second action to get access to things really ends up being pretty much a, a, a win

overall. There's there's effort to get there and there's a lot of kind of turning of the battleship when you're dealing with enterprises of our size in order to not only get users configured and set up correctly so they can take advantage of the stronger authentication methods.

But there's a, there's a lot of cross boarding of applications in a lot of situations to make sure that they're leveraging modern authentication in order to take advantage of the single sign on that comes with leveraging modern auth in the cloud and things like that. So it's, it's not a turning of a switch and just make everybody work.

There's a lot of internal, you know, collaboration that happens across a whole lot of teams to be able to bring an enterprise of our size, to be able to take advantage of password as technologies. And it never moves as fast as, you know, we in the identity space want it to move, right? There's all. But this is the reality of especially a larger enterprise where like you said, you know, turning the battleship takes time, right?

Where or if you want to use a training or whatever analogy, you're right of a big thing that needs to shift direction or speed. It does take a lot of time and a lot of planning too, because you're, you're dealing with, you know, not just the technical aspect of it, but the change management aspect of it from a business process perspective, which can make or break how successful something like that might be, right? No, and you have to prepare to

over communicate. You have to prepare to make sure that you give all of the guidance necessary. So you know, are you going to be force feeding some of these changes or are you going to make them self-service, right? Are you going to encourage people to go in and set up their account to take advantage of password lists? Those are decisions that have to be made pretty early on. And over communicate is my highest recommendation.

And everything that we've done is that you don't want to make people have to pick up a phone or call somebody or, or, you know, fire up a, a slack session. You want to make sure that they have all the information available to them to be able to, to make the decisions needed to get switched when they have to. And so, you know, the lessons

are learned, right? You, you on our side of it as implementers, we're, we want to rush these changes in and say, Hey, we won, we did it. And it's not quite that simple in our size and scale. It's never that simple and it's never right quick, right? And so it's a process, the change management like you said is a huge aspect of it. And yeah, I mean, we, we started we're, we're probably over a year in to transitioning the, the enterprise completely.

And it involves users, apps, devices, data. It's it's a full, full level transition.

I know there's so much we want to get to, but I got to ask what is like been the common question maybe that you've gotten from end users about this whole pass key, you know, password list type of approach. Is there something that is out there? Because I'm sure people out there listening, it's like, all right, what should I be thinking about from a deployment standpoint for this? But has there been anything common that you've noticed?

Not, not quite yet. I think that the biggest adoption that is still surprisingly that it's so much of an adoption challenge is, you know, and typically in, in enterprise platforms, there's the authenticator app, there's the ability to use some password less mechanism to confirm an

authentication flow. And those are things that people, you know, they typically think they wouldn't, they're already either using their own, they want to bring in and use or, you know, they're suspect about using it on a personal

device. And those are things that we have to kind of coax through through policy and then making sure that they're aware that there's no, no personal information involved in, on those devices that you're tapping a, a push notification is, is there's no private information that goes that gets involved in that. So those are kind of the main questions that we get when we transition a lot of our activity to use in things like an authenticator app. But the user experience benefits

are pretty significant. So they usually, once they get used to that in their flow, they literally forget their password, right? They literally haven't used it in so long that they end up when, when they actually ever get something that requires and they enter a password, they forget it and have to end up resetting it. So that's a good thing. And then and hopefully we'll get to the point where they'll never need it. Yeah, well, just write it down and just stick it on your

keyboard. That's the. Same thing. So much work to get away from that. But yeah, those were the days.

I introduced you as a technical fellow. I don't think we've ever had a technical fellow on our show before. What the heck does that even mean? And was it? What is the day-to-day like for a technical fellow? Yeah. So I, when I complete like, like when I sign up for a webinar and it'll ask for my title, I just put identity guy because in, in my role and it is, it's pretty much a, a technical specialist at an enterprise level. And it kind of recognizes that I've been doing it for a while.

And so my role is, is pretty much to guide all things related to implementing identity and access management technology, right. And so whether it's on the enterprise side, whether it's on the customer identity side, all of the projects that we run throughout the enterprise, I'm responsible for making sure that there is a level of quality in. And then every integration point is, is doing what it should be in that we're meeting the needs of our business stakeholders,

right? Those are things that typically, you know, my whole engagement in getting into customer and ID and access management started with a, a phone call. It was like, hey, what do you guys know about customer identity, right? Because they knew that we were, at the time we were, we were primarily responsible for enterprise identity, workforce identity. And we really didn't own that part of the environment.

And it was a single phone call that got me involved to say, let's see where we can help here. And ended up with suggesting a product, implementing the product and getting it deployed. And you know, there were by the time we actually got it deployed, there were hundreds of

people involved. You know, 456 organizations across the enterprise were involved in it ended up being a really big deal and we actually did it over COVID while we were actually realizing they were about to be shut down through COVID as when when this deployment actually happened so and. You're going to be at Ideniverse, right? So I think we're going to be maybe even on the same panel. I think our friend Sean is putting something together. But give us a preview of what to

expect at ideniverse. So Sean and I are putting together a continuous identity workshop. So we're really excited to really get into some of the futures of kind of where we think identity is headed. And so there's a lot of activity and you guys were at the most recent Gardner conference and I authenticate as well where there's a, there was a, an interrupt that they hosted that brought a lot of companies together who are supporting Cape and the shared signals framework specification.

And there's just a lot of real benefit when it comes to being able to be completely dynamic in terms of how we apply policy around access control and being able to integrate multiple security products is, is really a huge benefit over taking advantage of the shared signals framework. And so we're going to host a workshop that kind of gets folks immersed in, in what's involved to be able to take advantage of

that. And so that's I, you know, I, he didn't bring me along kicking and screaming. You know, Sean is so excited about it. You can't, you can't deny his enthusiasm around this topic. So I'll just come along for the ride. You know, Andrew, I figure with the technical fellow, it would be like, who's who's this Andrew Cameron again? Oh, he's the technical fellow down the down the hall there. I hear that that's a, that's a piece of comedy gets thrown my

way once in a while. But yeah, yeah, I just, it's easier to just talk about it as I'm the guy, I'm the identity guy at GM. If there's something going on with identity and access management at GM, probably I'm aware of it. I'm definitely interested in

this customer. I am topic because I imagine you've got a ton of complexity and I could probably, you know, talk to your ear off for an hour or ask you question or all day and ask you questions. So I picked a few that I think that you can probably really speak to. I would imagine that you guys have a pretty wide mix of legacy systems, modern systems and everything in between. And that changes over time, like the mix of technologies that you're carrying on. You probably still have some

mainframes, to be honest. Sure, maybe not. OK, not a not a shame to say that we do, yes. And that makes it tougher to get an identity solution that works for everything, right? Yeah, Yeah, we when we initially kind of rolled out our customer identity strategy there are our biggest goal was to, you know, own the the features and functions that were most important for authenticating the

customer, right. And so that meant standing up an identity platform that was able to perform at scale for, you know, our 10s of millions of customers. And that also included things like taking profile management out of the hands of their applications, right? And providing a service that allowed our application teams to say, let's give can we look up the profile information for this customer and not have to replicate profile information

across application environments. Those are some of the, you know, simple goals, but it was important to establish that is it as part of our platform to be able to allow it to scale and to be able to allow other applications to come on board and they don't have to worry about how does authentication

work? As long as you're able to support a core standards Open ID Connect Oauth, you know your your application can plug into our environment and we can get you your customer authenticated and we get profile information available for the customer and that's for everyone who plugs into our platform. Yeah, and and something like profile information, it sounds so simple, right? We're just come on, applications don't keep the profile information and then it's like, OK, well, what is central

profile information? Is shipping address centralized, centralizable or does it matter what application they're using? So there's that technical complexity and there's also the complexity of do I want to give this up out of my application and you know, and done there. Was a lot of that there's a lot a lot of angst around that as well.

Yeah, it was you know, we wait you're going to you're going to remove these key customer attributes out of our application and put them somewhere essentially or what do we want to allow them to change it? Well, the customer go to one location where they manage profile and they can make that change there, right.

And so those are well the concepts there early on that didn't didn't sell immediately, but that the benefits from my overall enterprise and platforms perspective were really kind of key to kind of getting that accelerated once we got it stood up. Everyone sees the value of it two years after it's implemented and they forget how hard it was to get there. But it takes somebody like yourself. I don't care. Don't miss an opportunity to remind them. I don't know. I know.

I mean, that to me though is like a big deal, like getting profile centralizes is different than just doing single sign on. And it's now you're starting to dig into what is built into each

and every application, which is this picture of an identity. Whereas, you know, let's take something like privacy information or communication preferences. You know, I don't want to receive a newsletter. So say I go into one application, I turned off newsletter and I keep getting newsletters because all the other applications I didn't go and turn it off in my profile there, right. The the customer experience

right there would be garbage. But if you can get all the applications to see that and save the better for the better. Good. It's let's centralized that now you not, but it takes somebody like yourself caring. And when I hear like, you know, I I've worked for large companies and you know, I've done a lot of the CIM stuff and you know, lasting somewhere 20 years, you go through you have to you have to have a little bit of a tough skin.

And then I'm also sure, Andrew, that you're in the role that you're mentoring people and encouraging them that like, look, sometimes you have to go through the grind and you're going to hit some lows. You ought to be able to bounce

off those lows. Can you talk about that a little bit? Yeah, I mean, there's, there's probably 1001 stories. I mean, there's a lot of, you know, you want to make sure that you're, you, you prove the desire to want to collaborate with people, right? You, you don't want to come in with AI know I'm right and you're wrong and this is how it's going to go. So being able to listen is always been really key, right?

To be able to provide some feedback to people that is, is not deprecating or demeaning in any way has been something that has worked for me, right? And it GM culture in, in the 2000 or in the early 2000s was very different than how it is now. And I was fortunate to be around leaders who, who didn't necessarily believe we needed to rule with a, an iron fist to be able to get things productive in an enterprise environment the size of GM and solo.

That's kind of what has allowed me to kind of lead in that way, right? I'm, I, I don't lead large team. I don't manage large teams as a individual contributor. I, I'm more focused on leading by example, by the example that I set. And so I, I don't get into trying to make sure that people know that I'm right. Consensus building is still something that is valuable and it makes people feel like they're included. And so that's something I've always tried to follow.

Yeah, I really love that, you know, So again, I have to kind of pick my topics because they could bend your ear all day.

But the last thing I wanted to talk about was I can imagine that you have a very, let's just call it complex, for lack of a better term, complex B to B environment where you've got obviously suppliers, you've got dealerships, you've got a global dealership network. You know, you've got to supply those dealers with the ability to order new cars.

You know, maybe you have also beyond dealers, you have like national accounts, like maybe a Hertz or a national, you know, car rental kind of company where they buy thousands of cars. Well, they're not maybe going to buy them from a dealer, but there's all those complexities within. But one of the things that I think from an identity standpoint, that becomes the hardest to manage and all that

is delegated administration. You know, so that you don't have to have like your help desk having phone calls come in like, you know, from a dealer in Toledo saying, hey, we just hired Nancy and she needs to have access to XY and Z systems and all that. Somebody in that Toledo dealership can go ahead and set up Nancy and then when Nancy no longer works there, take away her access. But that's one of the hardest things to solve. I think they talk about that a little bit.

No, it is probably one of the hardest in workforce identity. It's one of the hardest aspects to manage. And just think about even what you see in the industry, you don't even see that many products out there that are targeted towards external user management, right?

You, you know, the IGA tools can do it to some degree, but it, it's everyone's enterprise is so different that you really have to put in some effort into, you know, what you described was kind of the base level use case where yes, every organization, every dealership, every supplier company has a security coordinator, a someone responsible for onboarding their users. But as you might guess, they're, they're not exactly diligent in removing their access when

they're supposed to, right? And, and how do we handle that, right? And, and how do we work with those organizations when they have breaches in their environment, when they have security issues, right? All the things that we have a, we have a dedicated security organization in our, in our IT organization that focuses on 3rd party security, right? And making sure that our partners that we work with maintain a minimal level of, of

risk in their environment. And we have a, you know, some very important requirements or any partner that we interact with to allow them to access GM systems. And so those are things that when you start dealing with, you know, we have 10,000 dealerships globally. We have hundreds of, we have a supplier network that's multiple tiers where we have suppliers that manage suppliers that manage suppliers. And so it's very, very complex.

We have entirely dedicated infrastructures to to not only make the delegated admin piece happen, but I would even say that there's AB to B to C segment that comes in that is doesn't fall into being managed in our with our workforce identity infrastructure. But they're not exactly

customers, right? They fit into this little example that you brought up. The rental car companies that we deal with probably fall into that space where they, they have a need to be able to do things like self-service registration, sign up and get an account to have access to certain systems. And they don't need to have access to all of our enterprise systems, but there's a certain segment of systems that they can get access to in a self-service manner that we manage that that

they have a need for as well. And so that's a another segment of our external user population that we've, you know, had to manage and create additional solutions for in that matter.

I've got to imagine that the the global aspect of what you do is probably been around like the entire time that you've been involved. But that brings on the whole language issue. How many languages do you need to support? And I'm going to ask the question this way. What is what is the the harder thing to manage is that the languages or the different privacy laws that exist throughout the world. Wow. That's a great question.

I'd say that the complexity of privacy laws has been something that in recent years has really started to, to get attention, right, Because, you know, the fines in, in, in these regions are starting to get significant. So you don't want to get that wrong, right? And so especially when it comes to EU and, and how we handle location of personal data in those regions, it's really important.

And so, yeah, it, it's being able and, and actually being required to build solutions to allow our customers to do things like right, to remove and things like that. They've been. Part of what we do in recent years, and so I'd say that's been the biggest challenge, right, Being able to respond to the varying demands of privacy globally for an enterprise of our size has been something

that's really, really important. It's a struggle for everybody, I think, trying to this all together, but I think it underlines and sort of underscores the value that I am comes in maintaining compliance with a lot of this stuff. If you're doing good, I am stuff generally speaking, you're going to be that further ahead when it comes to compliance with regulations. At least that's that's my thought. Does that make sense or do you disagree? It makes perfect sense.

So if you're doing things like not making multiple copies of customer profile information everywhere, then when it's going. To sync it, it's fine. Yeah, yeah. See, that's the and that and that where, you know, that's where it sells itself, right? Where you don't have to, to be worried about how many copies of, of, of databases that have been, you know, thrown around the enterprise. That being able to satisfy private privacy requirements gets a a bit easier at least.

And it's not as complex as it could be, right? And so, yeah, now those are, those are things because that's real money, right? That's real. That's real cost that can get hit if you're not on top of, of all of the requirements. If you're not, if your solutions don't don't meet those requirements right, you can get a lot of trouble really quick. I'd like to take the

conversation more to the consumer side. I feel like a lot of people listening probably have a vehicle. And one of the things that I've noticed over the last several years is the rise of what I'll call like a, a car account, right? Whatever the manufacturer is, you know, GM is one of them. But Volvo, Tesla, Rivian, right, all you name it, tend to have an app and vehicles are moving now into almost like this cell phone on wheels type of thing, right? Software defined vehicles,

etcetera. Can you talk a little bit about how that works from an identity standpoint? Like what are the benefits of you know, having AGM account or maybe in, in the case of GMA, if it's a brand account, right, whether it's Chevrolet or Cadillac or whatever it may be.

It's probably the most exciting part of what I would say, although the customer identity space is the impact that we have on the user experience in that way, in that everything that the customer sees starts with what you do when you access your

product, right. And that's usually, you know, when you when as excited as you are, when you buy a vehicle out of the and you take it out of the dealership, the first thing you do is you log into whatever that mobile app is and check out all of the features that you can do through the mobile app,

right? And so it's really exciting that we have been able to impact, you know, the overall vehicle experience in that way and then be able to have, you know, not multiple accounts from that, multiple logins when it comes to kind of taking advantage of those experiences because, you know, we're bringing more and more services into the vehicle experience, right? So, you know, you're driving along the road and you and, and you come across Starbucks,

right? You can, you can order your Starbucks ahead of time and, and, and not do it through, you know, not do it through your mobile app. Those are things that are you can actually do through a head unit. And so it's important to be able to make the experience as seamless as possible and to bring a single identity into that experience. And so it should be as something as simple as here's an e-mail address and I sign up for an app and I can be secure in accessing

my vehicle features. And that's, that's a, that's a destination, right? And there's a, there's a lot of ways. And that's why kind of focusing on a single identity is so important because you don't want to, to add friction to the user experience by, you know, forcing them to poke in a password on the on the vehicle display, right? That's not, that's not the best

way to go about that, right? So those are things that we've been working really hard to make sure that we bring that best experience to the vehicle, vehicle customer. I feel like this is an area that is still ripe for conquest by audio manufacturer where you can personalize the vehicle. There's so much telemetry and so many things that you can now control in the vehicle through an app or AP is right through

the app. And those sorts of things where you know, if, if you're carrying your phone, for example, and you know, you're using maybe an ultra wide band for your, your mobile key, right? Or or some other Bluetooth proximity, whatever. Maybe in in some scenarios it knows that Jeff is getting in the car. So let me set the seat position to this. Let me log into, you know, my Spotify account or Apple Music

or whatever it may be, right? Set Google Maps and my direction based on a calendar entry, right? There's a lot of neat things that can happen, but you can't do that without the identity layer actually pulling that together, or this is an opportunity to connect those

experiences. Yeah, or delegate privileges to do things in the vehicle to your kids, right, To be able to, you know, work the work the display in the rear of the car to whatever they want to do and be able to have their preferences saved to a family set of preferences. All the things that are also part of the picture, right? And those are all huge, right? Those are those are selling points, right. When you're able to provide those that kind of granularity of features within the vehicle

experience. So yeah, I mean, that's, that's what's exciting about it, right? And that's it. It's really exciting to be able to see, not only to be able to enable those cool things, but from our perspective, we're trying to keep it secure, right? And so we're trying to, and I know you guys bring, you've had Andrew Shikiar on several times and I know that Fido has created an automotive working group

that's pretty exciting. And I can't announce anything, but I'm just keep in mind that we're looking at it, we're aware of it and, and, and we're excited to see how that progresses. I feel like this is an area that a lot of people struggle with, not people meaning auto, auto manufacturers, when it comes to really nailing that app

experience. I promised before we hit record that I would not get on my soapbox about the experience that I've had with one of my recent vehicles and the let's just still call it not barely passable grade that I would give it from an experience. Why is it so hard to get that right? Is that are there?

And you know, this is probably more of an app development question, but are there technical underpinnings from an identity perspective that make developing an app like that have those capabilities more difficult or thought process? Or is this like, hey, we've got the identity side, but there's still more work to do on maybe API management or other telemetry, you know, items that might be coming from the vehicle? Yeah, huge aspect in terms of

security to be able to have a consistent set of security controls that are end to end, right. So that you know, not only are you doing things like MFA and securing the account experience when the customer logs in, but to be able to maintain that context all the way back into

back end systems. And so it is important down to the developer level to be able to understand the differences of experience when you are showing a webview versus a native app experience and the differences of how that is perceived by the customer. Those I, I can't tell you the level of discussion that I have been involved in when it comes to making decisions around showing a, in a mobile app, whether you're showing something as simple as a webview versus a

native screen. And, and, and how people get very passionate about what's, what's, what's best versus what's most secure, right. And so the standards do have a play in that. And, and as standards evolve and as products evolve to be able to support those better

experiences, that's great. And I think Oauth and I think what's been exciting is kind of the version of Oauth that has near approval, the 2.1 version of Autumn is coming out that's addressing some of that actually keeping things more secure, but it's allowing more to be bring more native experiences to our

customers. And so that's something that's it's a help overall, but it's, it's huge to be able to make sure that there's consistency across the experiences in the, and not only from just the app itself, but to how interactions

get into your back office. And so things like WAFF and API gateways and you know, all of that plays a role when it comes to the customer, you know, authenticating, doing MFA and doing something as simple as hitting the button to start their vehicle that there's, there's an awful lot of interaction that happens. Attempt to secure that from end

to end. I feel like this is an area that maybe people aren't as aware of is the speed of all this needs to be like sub millisecond because you just, you just listed a whole bunch of like speed bumps, right? The laugh and API bouncing back and forth, micro services, etcetera. Every second that when you hit that button on the app to say, start my vehicle, unlock my door, call for help, right? Whatever it may be.

That is all mission critical things where you cannot have identity be the slowest link in the chain. How do you tackle speed when it comes to make it secure but make it fast? Yeah, that's, that's part of the process of bringing things to production to make sure that you have the, the, the performance, the response, the, the, the, the least latency involved when making.

So there's in all of the best practices that need to be brought to bear when it comes to edge computing, right, to be able to make calls to an API services layer that can respond and, and recognize that a a user is authenticated and have authenticated with MFA and that we can process this request versus yeah, this doesn't look right. Let's reject the request, let's cancel this session because

they've been compromised, right? We get a threat signal that says that the user may be compromised, right. So those are things that have to be taken into account. But yeah, at our scale and, and to be able to have a response time when you start your vehicle of a couple of seconds is, is something that is AI think it's the highest level of, of distributed system engineering at our level that to be able to

get that done. And it's, there's a lot involved, like you just said, there's, there's so many systems, so many interactions that happen that the customer never sees, right. But that we have to get involved with to make sure there's policies, they get touched, they get triggered so many points along the way. And that's what it's fun. That's what's made the whole journey of the fun, to be able to get into all of that.

I was going to say it's you sound like you're having fun with it. It's getting more and more fun as time goes on. You know, in addition to kind of the speed bumps that Jeff mentioned, and I think he was right on with that. The thought that I was having the whole time was, you know, you got to remember it's a car, there's all these things going on. It's got to be able to stop when it gets to that red light.

And if it's got to send an API and like, you know, it gets to the point where the technology can compromise safety especially, that would not fly. Those are just some background thoughts. So I'm not asking you to react to that because that's kind of obvious, right?

But you did bring up something about standards and I would think, you know, one of the hurdles would be that this is an area when it comes to technology in the cars that's going to be a real differentiator between car one and car 2. But the security piece of setting standards for security, to me, everybody's a long term winner if there is some standards work that's done together.

So is that your perspective that you bring when you're working with a group like Fido in terms of, you know, moving forward this this working group? And I know you didn't have an announcement, but I just wanted to know if that was your perspective. Yeah. So absolutely the the answer is yes, that when you consider that you know, as consumer technologies take off, so things like pass keys that people are adopting that their technology

platforms are adopting, right? You would think that they would be customers would be wet ready and willing to leverage those technologies with their in vehicle experiences, right. So using pass keys for payments might be something that people are interested in, right. And so to have those and to see the industry adoption at this point is an indicator that the customers would like to be able to continue to use these kind of features as they're made available.

So, yeah, I mean, again, we're aware of that and we want to make everyone's experience easier. So we'll be paying close attention to those as we as that evolves, right. So, yeah, we're really excited to to hear that. You know, I've talked to Andrew a number of times about this that the, the, the working group around Fido has kicked off for automotive. So that that we're expecting a lot of great things to come out

of that. As I'd say like some level talking, going back to that exciting feeling, it's like all of you only just like start your career over right now and like just see where things are going the next 20 or 30 years or whatever it's going to be that a career becomes after in in that time. But let's talk about AII mean

that's on the tip of everyone's tongue, right? That's it's almost scary to think right now, like if you're just starting out right now, like am I going to be obsolete 2030 years from now? I think it's more of an enable. I think it's AI is going to be built to serve humans and make life better. That's my optimistic perspective. What's your perspective on, you know, a couple of big things that are going to happen in your industry, in the automotive industry because of AI?

I think we're going to see a more at a larger proliferation of, of agent based AI that will interact with customers and to be able to give that first level of service and experience that is more responsive, you know, more accurate in terms of, you know, what you may have been able to get from the the, the chat bots that that kind of preceded agents today.

And so I think that's going to be kind of low hanging fruit to be able to take advantage of those kinds of experiences within the solutions that we build and deliver. I I think, you know, machine learning and AI has been used from a security perspective, right? Where we've been getting threat signals that have that have been based on AI for a number of years now, right?

And so, you know, things like password spray attacks, things like impossible travel, all of that is based on machine learning that the that the vendors are providing. So I think you'll see that evolve, right? And we, you know, enterprises of our size are building a pretty rich set of data around users and entitlements and the resources that they access. And so to be able to do all the things like automatic deprovisioning if you're not using a resource make a lot of sense, right?

You don't have to go through that manual effort of removing somebody through an access review. You have some kind of of of agent, you know, watching all of that activity and if they don't touch something for six months, then you must not need access to it. Let's take you out of it. So I think those are kind of things that are will start to make a lot of sense within the enterprise and things that touch customers.

I think you'll start to see some form of agentic AI in the vehicle eventually where you'll be able to do things. If you can do it within your home, you should be able to do a lot of those things within the vehicle. So I think you'll start to see a lot of that eventually. So I think that's probably a good spot or maybe we can leave

it for this week. I want to thank you because I told you before we hit record that we're going to take your brain and like splay it out and we can keep going on and on for this. I, I feel like this is an area that is like super exciting. I am, I'm I'm an EV fan. I think that's kind of on record at this point and the the identity experience is such a core part of that. I want to see you guys nail it, right?

It's like I want to see everyone nail it because, you know, this is the experience you're having the vehicle. So I and I and I think of the future, right? Where is this going? OK, we're all connected vehicles and things got to be secure. What happens when vehicles start talking to each other and things get safer, whether it's self driving or even just shared signals maybe between vehicles which are devices to say hey, I'm slowing down or I'm accelerating. I mean, I just think of the

safety applications when our. Standards for that too. Yes. So I think it'll be super cool to get there. And you know, identity is going to be such a core component of that. And and as Jim mentioned, we can talk about this forever. So, but I want to talk about a couple things.

You're a Detroit guy. I want to first of all, and I'm a an Alliance fan. You can see on your shirt there I'm Bears fan. So I want to thank you first of all for Ben Johnson and having him come over. We're very excited to have him. I've kind of been on record with my friends as it's Ben Johnson or bust. We got the guy. So thank you for letting him come to us. I that being said, I was rooting for Detroit Lions in the play offs. I wanted to see them. Yeah, at least make the Super

Bowl, but that didn't happen. So I'm going to put you on the spot for Detroit Lions. Give me, give me a win total for next year because they had a great year this year. No, I think 12 wins is the floor, right. So, you know, we're bringing the cast back. We don't have our coordinators. So that's going to be interesting evolution of of how things happen. But yeah, twelve wins is the kind of the minimum that I would say. And yeah, let's get a home

playoff game. And, and and that's, that's, that's the lowest expectation at this point, right? And as a Lions fan, you know, after 60 years of 60 plus years of, of what we have realized, you know, what we've seen in the past couple years is been great, you know, so, you know, and that's regular season. You know, one of my most tremendous playoff disappointments was last year when we were at halftime of the NFC championship and thought we were in the bag and it didn't happen.

So yeah, we'll stick with it. We'll we'll keep the faith and I think, yeah, a minimum of 12 wins next year, get a home playoff game and we'll take it from there. OK, so we're going to put that on record. That's the that'll be on ESPN. 12 wins or bust for the Detroit Lions, courtesy of NFL analyst Andrew Cameron and also technical fellow. I am at GM. All right, another for Detroit thing, pizza. Are you a Detroit style, New York style or Chicago style

pizza? I am Chicago style primarily and we have a Chicago style pizza place here in Detroit called Pizzapolis. It's in downtown Detroit that has been a staple for decades and I would recommend anyone to hit that. It's it's as good as any Chicago deep dish that I've ever had. And I've been, I've had, you know, I've had George Donald and everything else from Chicago, but I'd say Pizza Papolis is probably our our best kind of deep dish Chicago style pizza and that's the one I've enjoyed

the most. It's the one thing I'm one of the things I miss living in North Carolina now is the pizza down here is nowhere near as good. It's the Chicago area, so I'm always. Looking for pizza? Spots to to hit up. OK, Jim, real quick, are you what, New York? Chicago or Detroit pizza? I've always been Detroit or you know, I used to work at the Renaissance Center, Andrew and. You know. Greektown. There's, there's, I don't know, I always felt like Detroit was

coming back. I was there around 2009 through 2012 and I felt like Detroit was really coming back. But what I really loved the most about the place was the pizza. And but given that I love New York style pizza, there's not many pizzas I don't like. So. But Detroit's my favorite, yeah. At the early stages of our, of our kind of the, the downtown rebirth was right around 2011, 2012. It's, it's a lot different even now than it was 1012 years ago. So it's it's pretty exciting

down there now. Yeah, I, I've always been rooting for Detroit to come back because I think it like, you know, it became like the thing that people would, would almost joke about is like, oh, it was a safe to joke about. Like, oh, Detroit is falling apart. And it's like, First off, that's it's not really funny. And 2nd off, it's really a good, a good city. And now I felt like it was coming back while I was there. Yeah, I've been here all the life.

I'm a lifelong Detroiter and I will, I can represent, you know, if you want to know the truth, talk to me. I'll give you the truth. Don't, don't, don't follow the Internet and what it's been saying from a downtown perspective, it's so totally different. And it's, if it's anyone that's, you know, the NFL draft that was here a couple of years ago, I think was an overwhelming example of us being able to host large events and people all having a great time when they're here.

So it's pretty cool. I've never been to Detroit other than the airport. That's pretty much it. One of the. One of the cities. In Midwest I haven't been to. Come, come, come one, Jeff. We'll, I'll give you the the Grand Tour anytime. You're welcome. All right, all right, that's probably a good spot. Well, I'm going to head up to

Detroit. We're going to get some pizza, and then I'm going to continue to take little slices of Andrew's brain and tear it out and put it on display for people in the podcast. So that's what we'll do. Andrew, thank you so much for being part of this. You're it's funny right now because you're using the virtual background and you've totally faded. It's almost like homework going. In Slime I. Think, yeah, the lighting just changed in my room, which is really interesting. But yeah.

If that's not a signal, it's a wrap up. There you go. All right, Andrew, thank you for being part of this. I'm going to have your LinkedIn profile on our show notes so people can reach out, whether it's, you know, about identity or maybe just better places to eat pizza in the Detroit area where you can have those conversations. You can find us on the web, IDC podcast.com. Again, we'll have all of our discounts for the conferences on our homepage.

Reach out to Jim and I and we get lots of great guests come on through word of mouth and networking and things like that. So let us know if you've got folks that'll be good for an episode like this. And yeah, like and subscribe. That always helps us out. Doesn't cost you anything. Hit that button. But it does help us out immensely. So with that, we'll go ahead and

leave it for this week. Andrew has almost completely faded into the Bush Lake Homer and thank everyone for watching and or listening and we'll talk with you all in the next one. Thanks guys. You've been listening to Identity at the Center. We hope you've enjoyed the show. Make sure to like, rate and review, and we'll be back soon. But in the meantime, hit the website at identity@thecenter.com. See you next time on Identity at the Center.