Identity and access management. Welcome to the identity of the center podcast I'm Jeff and that's Jim. Hey Jim hey Jeff. How's it going? I'm pretty good. How about yourself? Good. It sounds like you've got a new microphone that really improves your data. It's simple I think you should plug it, let everybody know about it. So Chris today I basically filters out your background noise or not a commercial. I think it's, you know, it's freeware.
Or it's free to start with anyway, not free, but you get 2 hours a week. I think is what their, what they start off with. But yeah, we don't, we don't currently have sponsors or commercials or anything like that. But yeah, like you said it's it's a pretty cool little program. Just runs a little app on Windows or Mac and seems to be do a pretty good job of reducing background noise and things like
that. You never want to be that person right on the on the zoom call, or teams or whatever it may be where you can kind of hear everything, right? In the background. So I thought was pretty cool. So, glad you're getting some juices out of. I've been that guy on our on our podcast for a long time. Where, you know, we set up rules around me which is keep your earpod case far away. So you can't click it and you know, don't squeak in your chair.
And so now I've got a good microphone, I've got the noise reduction software, I think I'm ready to go. There's so many layers of noise reduction, not even Sheriff. Pruitt, we're not even sure. Sometimes of like our voices will come out. All right. Exactly. So for today's topic we're going to talk about Fido and for those who aren't familiar, that's fast identity online, and there's no better person to talk about
that. Then and Russia are who is the executive director and chief marketing officer of the Fido Alliance. And we've got them today. We're very fortunate with for that. And thank you for joining. Welcome to the show. Andrew, and thank you. Thanks for having me guys. Really appreciate it. Great.
So, I know that Fido has really started to really kind of Of get a foothold out there but before we get to that one of the things that we like to start to talk about is when we have a guest on is their background in it and identity and access management. Can you tell us a bit about how you got into I am? Yeah sure so I'm not a practitioner per se but I know it was done a variety of kind of marketing and strategic development type roles in emerging technology.
And so I got into identity, I think before identity was All back in 2001. I went back to Sun Microsystems were previously, worked to help them launch, something called Liberty Alliance, and I'm sure many of your listeners are familiar with Liberty. This was the kind of first standards effort to standardize what became to be known as
Federated identity. So, a lot of the Liberty specs during into stable to specs and it was really interesting time to be in identity because frankly, it wasn't in the mainstream whatsoever. I'm a lot of my job at that point was to help me recruit the initial companies and Liberty Alliance. And so I defy, you know, around the world and talk to cxos and you my first part of the conversation would be, you know, what is identity, what does that
end? I mean, to your business, which side any means your employees, your customers, and is always kind of thought, provoking discussion with people hadn't, thought, about identity Beyond maybe for an identity. So, it really fun. To be get into that space, I subsequently then worked on Son's identity management, product set and did a lot of go-to-market work there as well.
So yeah, that's how I first got an identity as out of the space for a while, then I got back into it when I joined Fido lines around five years ago. And one thing that's kind of fun was to see that. A same concept, we're talking about the enter are relevant today. Be some of the standards actually, now being Used and seeing a lot of the people who have worked with back then are still in the space. In fact, a lot of them are
inside of Fido lines. So it's been nice to kind of reunite and get deeper in the identity Marketplace. That's great. Andrew. One of the things I think kind of the starting point we ought to start with, which is what is Fido, and why was it founded? Yeah, so if I do, Alliance was founded to address.
The data breach plague. You know, data breaches continue to grow and scale and a number of attackers are growing sophistication and tools and and the vast majority of data breaches are caused by passwords, right? So you two patterns being compromised stolen, Cask, passwords being stuffed, social engineering, taking password, go to someone stands up, Sports cars, you know, over 80% of data
breaches on an annual basis. And so, you know, passwords are very much acceptance of the spear to address. The database problem which is why the title is focused on that, right? So our mission is simply to reduce industry relies on passwords in favor as vital authentication. Fundamentally what Fido is doing is trying to shift the market and shipped industry. The way from being dependent on not as passwords.
It really all server-side shared secrets and server side authentication in favor of an approach that leverages public-key cryptography and takes advantage of devices that are in use your scans every day, right. So our tagline is simpler stronger authentication, so it's stronger. Authentication using the public key cryptography, but also simpler because any side authentication activity is done with a single single gesture.
So whether that's touching my finger to a phone touching, a security key in certain security key, using face, ID, or Windows, hello. This is all just one gesture for me to authenticate myself. And I think that's really important because as we've all seen, If a second you know if if security is too hard, will won't use it. The option rates, go down especially with consumers.
Often rates for second Factor authentication, go down, the more complex, it is. So we think that, you know, decreasing friction while increasing security is the approach. We need to take to get people, to actually adopt stronger communication. Now, one other note, I want to make As I said all shared secrets on the sermon, right? So while any form of MFA or two, if a any second factor for authentication, is better than passwords loan and will protect people against scalable tax,
frankly. Anything on a server can will be stolen, so that includes otps. Otps are still shared secret, they're still on a server. I'll be it for a much shorter period of time, but they can be manipulated through a man in the middle attack. That replay attack and things like that. You know, that's how you know, a lot of spearfishing. It attacks are successful, people think are protected, but they're really not.
So, you know, half those are good at their jobs which is why over 40% of phishing attempts are successful. So we need to put tools in the hands of users, that help protect them from the bad guys and also from themselves because it's very easy to get fished, frankly, there's no shame in it because you're dealing with professionals. So we need to Implement fight authentication to help people, prevent prevent people from getting their cows, taking over other nefarious, things happening.
What I'd like to add to that. I think you should only really good point about phishing attacks. As you know, we run into the phishing attack. Where you think gosh person must be stupid to fall for those but I've seen some, you know, especially videos and Conference presentations from like black hat where these phishing attack, some of them are extremely sophisticated. They'll poses a site like Google have you log in and provide a one-time. Word really?
They're taking that then and in the background authenticating you and then, you know, changing your password while you're in the site and it's like I can see how people can can get duped into those. Now those are the more sophisticated ones is not your everyday phishing attack but you know when the risk is high it certainly there. Yeah. I mean I just want to come back the data point as a Google statistic 40% of well-designed
phishing attacks are successful. Arthur you had like you said, we're not talking about a Nigerian prince, you know, sloppy emails. But these are in a well-designed phishing attacks of a 40% success rate. Now, the click rate success rate, which is a staggering number which you know, it shows that fishing pays it really starts to outline the depth of this problem. At 40% is an astronomical number considering that usually, that kind of attack is, is talking about single digit success,
right? So if you can, I mean, that is just crazy. How many people fall for it, and sometimes it's, you know, obviously user education plays, a big part in to it. But, you know, even the best can get fooled. And, you know, we saw what recently happened with Twitter, right, where they got socially engineered and someone got in and you did some things. I'm thankful. IE.
They only care about Bitcoin but they could have done a world of damage like literally just based off of that that social engineering attack and then getting access to the inside tool. So I think it's important to understand that even though you have education, you need to back end it with good, strong methods to enforce and reinforce the security message. You're putting out there which
is why MFA is so important. So I'm glad your em not to get off track on the, on the, the direction I want to take this, but I'm glad You raised Twitter because I think you know what needs to be clear is that, that attack could not have happened. If those administrators were using Fido Securities.
Grab the social engineering attack, could not have been successful if those never gab menswear you who are obviously, you know, smart top of users, if they were using fight a Securities that that would not have been successful. It's probably one of the bigger things you could do in an organization. It still shocks me when when Jim and I are working with folks out there that MFA is not kind of standardized. I think, what's becoming more
prevalent? Is that MFA is put in place for what they consider privileged access typically but they're still not protecting normal users right from that kind of thing. So, I think at this point, you know, even Gartner think mentioned it. I don't know if his last year year before that MFA is Baseline at this point, password is not good enough and The easier you can make MFA the better experience it is.
You know, the easier Spears is going to be for the user, which means that your security increases and makes it a lot lot better for everybody. So that's why I think that Fido is is great because I can see the usability benefits of it. And you know some of the challenges that it typically solves around some of the more Legacy approaches to MFA.
Right things like tokens and you know, SMS which are easy to Oops, relatively speaking, you know, from a security standpoint you know e.l. one-time passwords like all use all the stuff that you said around it being stored somewhere in a server, write that kind of thing. But also just the usability aspect of it is huge. Jeff. I'd also add to that, you know, that is the other angle.
So when you think about the statement passwords are dead or pastors should be dead, passwords are dinosaurs, it's not just the security aspect. It's also the usability aspect and for me, that's a big reason. Why Fido is so important and room wondering, if you could kind of talk about the usability angle and why that's so important? Yeah, fully. So, you know, as I mentioned before, you invited tagline is simpler stronger,
authentication. And I think their part and parcel, you know, if it's not easy, people use it and it needs to be easy for Mass adoption. So, if itís focused on a single gesture strong user authentication. So, let's take a different lean on this and look at traditional means of an effect. All right, so that multi-factor authentication is to a phase is not new. But it's had some challenges, right? And they have both security and usability challenges, all right.
So the traditional means, you know, what going way back is having like a token dedicated token with totp on it but a dedicated piece of hardware for Easter. So say you have I also talked about that he's ability for a second. One, is you have to know if you're doing a lot of sensitive work, you have multiple tokens. We have the token keychain problem to you need to literally juggle, you know, devices to enter in the code. Code to verify yourself with it with two new system.
Now compare that to find him, we're everything the tokens that you have. So, you're using external security key. But we call Roman authenticator, you know, that can support multiple services. And again, all you need to do is touch it or insert it is. All you're doing is proving possession of the advice. So there's a good example right there of how. If I do provides a superior user experience over the traditional token-based means the multi-factor Authentication.
Ocean. Additionally, if I do obviously supports Biometrics, which brings the same benefits of security and privacy at Fidos, public key cryptography, underlying architecture but you can use biometric to prove possession and to verify yourself also and that's even easier, right? Where you just literally again touching a device or you're looking at a camera, right? So, Any of our users, any of your listeners who use Windows? Hello. Are you seeing this every day?
But I logged into my PC looking at my camera I mean it doesn't get much easier than that or by touching my personal favorite are brain scanner or using a local pin. Now the key thing is that all this is local on the device and all very user-friendly single action to you know do things that are traditionally associated with a locking devices. Are now being used with Fido to
log me in, right? So that's kind of the smaller Little League. We need people to take is that unlock means login and the same easy mechanism you have for. That is actually doing a highly secure authentication process through the same exact action. I'm a big fan of Windows. Hello. I have been for years and, you know, I think Jim is mentioned before, but I'm kind of a tech geek tech nerd, some kind of on The Cutting Edge of the technology usually and you know, I saw Windows.
Hello several years back when it was first rolling out and I couldn't wait for that Hardware to become more prevalent in the Enterprise because typically Enterprise Hardware Cycles are somewhere in the two to four year range. You know if not longer and you know, it's going to be a couple of years before. The fingerprint reader. The, you know, the IR camera is standard Hardware right on most
Enterprise devices. So I'm excited to see that becoming more of an option in the Enterprise and I'm really excited to hear that Apple join the fight Alliance relative recently. Think it was maybe a couple months ago at this point and I'm hopeful that things like touch ID and the rumored face ID on the Mac books. For example, that might be coming out in the future, might be taking advantage of that and I know that you've got a lot of big Heavy Hitters in the industry.
Maybe In talk a little bit about folks like Microsoft and Apple and other organizations Google that. That might be part of the alliance and what that brings to the table. Yeah, absolutely. And so, Apple did join photos board of directors in January of this year and it's been really great. And I think once you have makes 50 unique and I've done a number of Standards, I mentioned, Liberty Alliance, I've done. Other kind of multi stakeholder organizations in my career.
What makes 50 unique is that there isn't really an alternative standards Effort right. There is no betamax our VHS not to date myself, but if you're interested in standards based authentication, it's really quite oh and apple joining at the beginning of year really unified the industry around side of authentication. So I think it's really important but amongst our members, we have 250 something members in the alliance include have board
around 40 companies. And I think, what's really cool about our board of directors is a It has the right composition accompany the right composition companies to address this password problem. So first we have kind of loosely described these companies as device manufacturers. So people who are creating the devices and platforms that we use everyday. So companies on a ship's outside like Garnet Intel and Finney and groups like that but the
platform's right? So Microsoft Google Apple device manufacturers like Samsung Lenovo right? All these companies are involved with Fido making sure these platforms and devices support fight authentication. Secondly, we have experts in security and Biometrics so both stalwarts long time stalwarts like RSA and groups like that and once fan but also you know, emerging companies are really driving a lot of innovation and the authentication space like
you would go and hyper. And Knock-Knock and groups like that, what you're really getting a lot of traction. And last but not least, we have the service providers, grab these are the companies whose businesses are dependent upon their ability to deliver High Assurance services to billions of users worldwide on daily basis for estimating. They are dependent on Fido being successful or else you have to go in and on standards Direction.
And so these are the, you know, the big social networking companies like Facebook and groups like that. Converse companies, like Amazon payments, networks MasterCard, Visa American Express big banks. These are the companies that are helping steer Fido lines. So I think when you look at that kind of breadth of membership that we have at the top, which is also reflected throughout the rest of our membership, you know, I think it gives us a really good starting point to
help us be successful. In doing the three things that finalized does, which is a bill technical specifications based on Market. He's be, we Grant a certification programming building a really diverse ecosystem of products that are quite a certified, which companies can use to deploy fighter with indication the last. But not least, you know, develop best practices and help people be successful in understanding and driving adoption if I do authentication.
So, yeah, cover the question starting with the Apple, but I think it's really important to look at the full range of members that we have. Driving 50 Ford. Yeah, absolutely. I think that was a great overview. You know, one thing that I didn't really understand this until I started doing more research is what is the difference between Fido and Fido too? Yeah, well, so let's back up and talk about photos specification than 50 architecture. At a high level, but specifications.
So, as I mentioned previously, if I do authentication leverages public key cryptography, user-friendly public key cryptography, High vertical, be called pki evolved. But the key thing that we're doing is introducing, the concept of an authenticator. An authenticator is both a saying, in a concept, its base Ali where the private key stored. And so, instead of having being dependent on passwords on a server and study using public key cryptography, you have a unique key pair for each Fido
account. The private key saves the authenticator secure on the user's device and a public key sits on the server instead of a password as we all know public Keys, have no material value, the can't be reused. So when, if and when I do, you know, Happens. One thing it's not stolen is password, right? Which starts to break that credentials that cycle, which is plaguing so many companies. But if I do specifications, So the first intifada specifications are came out.
There are two. One is focused on a biometric use case. I've just called 50 uaf out a universal authentication framework. And a second one was based on a second Factor, use case you to F, which is popularized by gimmicky and all the other companies. Now making biosecurity keys, both of those have the same approach to underline with. Again, if I do public key cryptography, underlying architecture Supporting both to the differences. With uaf is basically password replacement.
The biometric and u2f it was using activating the private Key by verifying possession. That device Again by inserting your touching and interactions with security key. Whereas back in a second with uaf, use a biometric to verify yourself so that the private key could be activated. Those are the the first steps in spite of specifications. We saw strong take up with both uaf and you. Laughs, you two have had strong pickups a inside of Google and
is attached to Google services. It still supports Google services uaf was underpinning. A lot of native apps for I said to the average user uaf looks no different than if you have you a UF app on your iPhone, it look no different than your usual Touch ID experience but is using all the benefits of fight authentication, rather than just doing a kind of a password cut and paste, which is what the native. Biometric would do typically with with Touch ID.
So even though we have good uptake with both both two of those, what photo realizes up to gain scale, and to truly be in position position to address. A password problem, we needed to Target the platforms starting with the web, right? So if I do was working on something called the phyto 2.0,
web, apis inside the alliance. We made a strategic decision to Contribute. These to the w3c and that became the web authentication working group The Wave off and working group instead of w3c started in the beginning 2016 and that's how, you know, 50 decided to Target the web. Right. So in Coop and cooperation with w3c and it'll often working group got a lot of stakeholders and both Fido and w3c working on that. That's part of the fight, a to specification.
The other part of the part of to specification was an extension of u2f called CPAP clients authenticator protocol which you stand in the you to Fu stays to do a couple of things. One, it allows for pasture was Suffocation by enabling resident credentials in a security key but secondly it also extends the use case to allow devices to be authentic are so now your handset could be a security key in addition to security key. So that starts to broaden the address.
It'll basically users who can leverage provide authentication on the client side. Those two things together, web off then and CCAP comprised by De to. So you see a lot of talk wife, I do too because that's where a lot of Enterprises are starting to really move towards because phyto to is supported in the windows environment and in a lot of kind of Enterprise infrastructure. So that's one reason why there's a lot more adoption.
I think an Enterprise with photo to then May have seen with just u2f, but frankly, it's that kind of platform support and the web support. That's really reassuring in a huge wave of adoption for fight authentication. So specifically, if I do to supporting in a couple important platforms, one is the web graph so that benefit one of the benefits of working in w3c is that as soon as we want families done as part of the pilot to spec we had support out of the
box from leading web browsers. From Microsoft Mozilla and Google and later on Apple has been supporting about, then in Safari. So that's what that's a platform and of itself separately as we talked about earlier Windows, hello is if I do certified authenticator basically. So Windows 10, is it supports phototube inherently? So any built-in biometric on a Windows, 10 machine can be used in lieu of a password for your login on sites, that Part. Well I said well, identified Authentication.
So what some windows tenza is a fight, a certified environment. Additionally, Android is if I do certified environment. So any Android 7 or later, handset can support by do authentication and likewise use the local biometric instead of a password both for Native apps and for, for web based authentication. All right, so good example. This, for those of you who have an Android device, visit, ebay.com, and go to login with your Android device, and it will
prompt you. To use your biometric instead of using the password. And then most recently, Apple announced support for Fido and their update to iOS and Mac OS that will allow web Safari. Also explicitly, support, fight authentication with Native Biometrics on iPhones, and macros. So that really starts to extend
the addressable user base. So all told, you know, over the past year and a half, is you seen this platform has a If I do through phyto to you know there's billions of added devices that can Now consume 500 authentication. So I think that that expansion of the addressable Market by default is one reason why we're seeing so many companies now, ramp up their plans to support fighting. So, yes, you know, that is going back to your question that is
Phi 2 on those platforms. But ultimately, to us, you know, is I see it all as fight authentication because it all has the same exact benefits as the initial. So specifications brought to the table and, you know, but it's in general, it's good to see this ground movement to support many. What are some of the Fido or Fido to Enterprise?
Use cases that people should be thinking about if they're sitting in AC so chair or maybe as a member of an I am program or I am architect, because I know a lot of the, the focus is typically paid on the end user experience. What if I'm trying to implement something like this as, you know, Just a normal corporate environment. What are some of the things that you could offer to those types of folks? Well, I think talk about a
couple of things. So, one, you know, you need to think about your use case and your infrastructure. I said, no environments, every environments, little different. We talk about Microsoft support for Fido. Right? So if your Microsoft shop moving towards Fidos is somewhat straightforward. All right? So, add your ID, for example, has a lot of support for, for users and then, of course, the desktops all support, Fido as well.
But also, you know, another thing, I think that a lot of soot surgery are dealing with and security. Folks are worried about are the new entirely remote Workforce. You know, how these people accessing system resources? We were talking about fishing before you Fishers and are targeting new remote workers. And so you need to make sure that they're accessing systems as as securely as easily as
possible. So we encourage Just doesn't think about deploying security keys after the remote Workforce and get them moving that direction soon as possible or using other kind of device Biometrics either on device, or using a phone as a log in to protect their Workforce as well. So I think those are the key things to think about is what's your use case, it was for a sexier look like and there certainly are products that can be brought to bear to protect
you. The workers and system resources, alike somehow that something else that Fido Alliance is doing as a body. I mentioned before, you know, we do three things, one of those being establishing best practices, for implementations of fight authentication, we have a working group Focus, only exclusively on Enterprise deployment, use cases. So we just actually release the
white paper. Cxo considerations for moving to a patroclus Enterprise. It's actually going to be the first in a series of papers that get into more granular. Death on exactly how to implement if I do decide Enterprise. So I'd encourage people to check it out. Won't include some links as part of this podcast but can check out that serious. You get more details on these best practice recommendations which are being developed by actual Enterprise practitioners
inside if I do lines. So, Andrew, we talked a lot about the security benefits, the usability benefits, there's obvious benefits to the organization thinking of from the standpoint of the, the money people, you know, moving the, how does it? How does doing Fido move? The needle mean, I can think from a cost perspective, you know, there's avoidance of data breaches, but you know, can you kind of address that we're within an organization? And who cares? How do I get something like this
approved? And how do I show that? I can get an Roi and move the needle for the organization? Yeah. Yeah that's a great question and it's interesting that I think opinions on this have shifted a little better at least from gotten kind of broader. So initially you know all the focus is on cost avoidance. As you mentioned like avoiding a data breach like the cosmic data breach, first of all that's actually enough avoiding data
breach from a cost standpoint. Point and a reputation standpoint, and it should be a large enough imperative to move away from passwords and towards something like photo, but with other costs associated with in Enterprise associated, with not using fighter, having complex authentication, right? So password resets, you know, you see estimates for that ranging from 100 to 1000 dollars per reset. Once you factor in the cost of downtime and systems and things
like that. So, password resets are expensive. Lost productivity, bad. If someone can't get into a system or can access the system because it's too complex or they forgot a password or whatever it might be, you're losing that money being spent on employee. Not actually working the other costs are four different depending on token. So I so the actual hardware cloth associated with the in deploying. So many tokens, the more advanced tokens are very
expensive. So I think inside the Enterprise if I do a prevent data breaches Has b gets rid of password, resets and see makes it easier to log in Google did a case study. Couple of years ago, which is we site often because is you tens of thousand employees over a multi-year study using u2f security Keys, what they found. First of all, generally talk about the fact that the study found that not one of them got fished right?
Which is super important and goes to the core security message and the bottom line benefits associated with that. But other part that study points to the fact that call center support desk calls Way down and productivity went way up and the also got some sentimental feedback from people that they like that login experience better. So we're talking about there is you know those are three cops battery juice. Plus happy employees is beneficial to the company as well.
So I think there's a lot of ways to look at how Fido creates cost savings and those are just some of them. Additionally, there's Top Line benefits. So, for companies that are selling to Consumers, you know, around fast of shopping, cart abandonment, sardu to password issues, people can't log in. They can't do that impulse. Buy they decide not to buy. That's a huge opportunity cost. Additionally, we think that there's brand benefit associated with the better login experience.
So we've recently actually introduced a consumer logo that we anticipate service providers using or power bank account info button that we anticipate service providers using to express their consumers that they are providing a, you know, a industry blast, safer Superior simpler logging experience, we think there should be a halo effect associated with that, but even without the Fido, No, do you know a better logging experience is good for good, for one Springs.
Utah, so what are we saying before about? How I think that opinions have evolved on this is that whereas, initially, most of the focuses on cost avoidance, we're seeing a lot of companies have focus on usability escort service, this is better for my customers is making me have happier. Customers stick your customers and things like that. So a lot more Focus out from decision-makers on the top line benefits. In addition, To the bottom line across the widest. Yeah, I really like that idea.
So you have my stamp of approval on the powered by Fido logo or bad, just kind of like the Intel inside, but I wanted to go back to another point that you made, or maybe it was you agreeing with my point around the data breaches.
Because I think when, you know, Jeff and I were talking about data breaches, you know, five years ago It felt more to Executives like we were spreading fear and uncertainty and doubt and I just I feel like we've come a long way since then anybody who thinks that is just you know, not tuned in I mean the cost of a data breach, I think we saw a statistic recently that the constitute a breach at least in the u.s. is like over eight million dollars globally.
It's over 3 million dollars and that's made up Of, you know, a lot of it is the companies have to run around and make good for the fact that they fumbled people's data right in that they now maybe the victims of identity fraud. So it's not fear, uncertainty and doubt and those numbers I threw out there. Those are averages, right? That includes a lot of a smaller pieces and you get hit by a really big breach, it can cost you much more in terms of
dollars as well. As what I think you pointed out in terms of brand reputation, which is a little hard to quantify. But it's not fear, uncertainty and doubt, and hopefully that message is is getting out there. No, it's quite real you know. And in this comes back to the question you asked earlier in Wi-Fi, do what's your Wi-Fi to exist? And this is what we're trying to solve, right? So we were trying to solve
database problem. So, you know, we're often Associated is rightly with the reducing Reliance on passwords. But we're doing that to solve a data breach problem because that is the, you know, those are expensive and problematic and it really just erodes the Integrity of the network economy itself and that's not good for anybody. Yeah, I think from a strategy standpoint, if your insecurities the two vectors that I would pay attention to and there are so many vectors right?
But the first one is the password and being able to get rid of that and secure it in a better way, right? Using Technologies like MFA which combined with Fido make it easier to use and then being able to mitigate against ransomware attacks and the news today is Canon, got hit by a ransomware jacket. So, you know, and that's, that's a pretty big one, right? And they're not sure if images.
Stolen. So that's adds another wrinkle to it. So having the appropriate stance toward security, not only making it available, making it easy to use. I think is critically important to the adoption and improving security as a whole because what you don't want to have is and you spend a bunch of money on and getting something in place. And if it's unusable, no one's going to use it, you know, what's the point? Yeah. Right. They're just going to find ways around it so, so I think I love
what's happening. If I do Oh, and I hope and pray that, you know, other organizations will start to kind of see the light and consider security as a end-user experience as much as possible. And by that, I mean taken to the fact that usability of it. So I think it's I think it's super important you know, on those lines. But you know, I think the changing that, you know, with with covid and everything. You know, this remote Workforce Your employees are not your consumers to, right?
So you even an Enterprise, you think, what? How are these employees going to log into systems securely and and your people will find workarounds first person for security, what when they can, you know, we're not everyone, but a lot of employees will taste want to log in. There is trying to do their job, you know? So you need to think about usable secure methodologies for granting. The remote access to systems and that's where I think another area.
We're 50 does. Yeah, and this is and that and that kind of stuff, right? Leads to things like, you know, forwarding emails to a personal email address. Well, I can't get to my baby, you know, regular work account or it's too hard or whatever it is, right? There's all kinds of excuses but it's, you know, it's they're solving a usability issue around that, right?
If you make it easy for people to do their work and make it secure, you start to eliminate some of those examples of reasons why people would try to look for ways around the security posture is it that people put in Place to make the organization more secure, you know, is that I'm in favor of it which is which is a great thing. And I know you mentioned that white paper, we definitely will have a link to that in our show notes I guess from a elevator pitch, right?
Why should someone read that white paper and what do you think they'll take a take away out of it in 30 seconds or less? Well, it's really this getting people started. I'm focusing on the Enterprise benefits of moving towards pastoralists authentication for users, right? So it's squarely focused on that. It's an Enterprise paper that, you know, from Cicero on down, in that organization can look at it as succinctly. Summarizes key considerations and the house and why why?
And how to be play Fido. And as I mentioned in the beginning of a series that will get into more and more deaf, in fact we'll have a blog post on this shortly.
Kind of starts to outline the series and of itself so people can see the key steps associated with deploying fight, own Enterprise One thing, this is a little inwardly focused I suppose, but one thing we realized our goal is to get people to move to Fido. All right, we're unique in the sense that we're a nonprofit organization working, not
pitching products. We're just trying to get people to use their application but we have a lot of good high level information on our website and we have some a lot of specs, you know, all the specs Europa and we have some very detailed white paper. Is what we're trying to find The Sweet Spot to make Final Act. Well for practitioners. So I think this series of papers will really be helpful though.
I'll be around five pages. Each very actionable in lawsuit formation so I think that's what this paper signals and is a good starting points again so I'd like to beat a dead horse here we because I think everybody probably agrees that the passwords are not a good enough control but just as a practitioner myself I think to myself I'm relying on passwords that can be pretty. Be sure those passwords have already been hacked for a large number of users.
I had to sign up for a little league website the other day and create an account with a password. I thought there's no way through enough technology on the back end of this little league website to secure my password, remove, picking on Little League. I'm picking on all the hundreds of websites that we use every couple of years to create accounts and whether or not, you know, those of us The I am industry, use a password Locker,
that's fine. The average average Joe on the street doesn't and that's why you can be pretty sure that if you're, if you have a system that relies on, you know, email address and password age, going to get compromised Yeah, absolutely. Set up before password is not modern authentication. So that's all you're offering
your way behind already. Okay. So I think, you know, I'm looking forward to the next series of the papers and we'll put a link to the final Alliance website as part of the show notes Here. I like that. The, the one you just put out it is definitely an easy read and I think it's a good way for people to start to think about how to position the cell within your organization of why we should start to move towards that
direction. So, if You're interested in getting started with Fido or learning more about. I think that's I think you've hit it right on the nail and I had with that with that paper so definitely check that out. On the fight Owens website and also in the show notes that will have here which will have a direct link to it. Andrew certainly, appreciate your time and I know you're a busy guy. Any last words of wisdom that you want to throw out there for the folks who are listening?
I think we hit on all the key points, and I hope people, you know, enjoy enjoy listening to us today and, and take something away from this. Look for that paper. One other thing that we're doing, we have an industry conference that we were going to launch us here in person. We're going to be virtually virtually instead called authenticate. So this was going to be a two-day conference focused on all the ins and outs of authentication, not just Fido authentication best practices.
You know, we had maybe a dozen cases, Studies plans, some kind of case study track its technical track, the standards track, all that's being rolled up into a virtual event so you can find information on that on our website, but also on authenticate conduct Cam, that is going to be taking place in the middle of November. I strongly encourage people to sign up to attend that if they want to learn more as well and that's going to be free free to attend.
Great content was submitted for this paper, just a little anecdote on authenticate. Eight. We thought we're gonna have a hard time pulling together. The agenda we had around six times as many papers submitted as we had agenda slots, which may be super exciting because they help us put together awesome set of content. But also it shows that this is really gaining Traction in the
marketplace. We had submissions from all corners of the world talking about different implementations applications of Fido. So all that's being brought forward into this event. I strongly encourage people to to make sure to sign up to attend. That's great. Yeah, I'll definitely put a link to that it's for the website its aesthetic aesthetic. 8 con.com and I'll have a link in the show notes as well and I think that's
fantastic, isn't it, free? I think we saw a lot of good uptake with identifiers, for example, which I believe wrapped up last week or maybe it's wrapping up this week. It's weird because it's stretched out over several weeks, right? But yeah, I'm definitely going to be registering for that and looking forward to it. So so great deal Jim. Anything else that you want to close out with before we answer Ergo.
No, I just wanted to sit and drove really appreciate your time and knows the CEO of 500 that you are extremely busy person and just appreciate you taking the time to educate our listeners. Thank you for having me. How many people you could be talking to you? And I appreciate it and, you know, our goal is to get the word out and get people engaged and thank you for this opportunity. Great. Preciate it Andrew. And with that we're going to go ahead and close it out for this week.
Don't forget you can follow us on Twitter at idac podcasts and you can check us out on the web at identity at the center.com. We're in your favorite podcast app. So feel free to subscribe. Follow like whatever the thing is that your podcast app. Does that helps us immensely and helps us get great guests like Andrew in the future. So with that, we'll go ahead and close it out for this week and we'll be talking with you all in the next one.
Thanks for listening. You've been listening to the identity of the center podcast for more episodes of visit identity at the center.com.