Category: Conferences

Slides from Recent PAM Talk

This talk was originally given at RSA, but I was able to do an expanded version recently at IT Hot Topics. A few have asked for the slides, so here they are. I actually hope to write out the talk in full at some point as a blog post, but I have two more talks to write so probably not soon.

Deploying Identity Solutions – ‘Field of Dreams’ Doesn’t Work

(Note: this topic is background for a panel that I’m participating on June 20th at the Cloud Identity Summit, in Chicago, Illinois. I wrote this in hopes of informing some of the context around the panel, though I’m sure it will be revisited in some respect during our session.)

Knock, Knock: Identity is here. Identity Who? Exactly.

Tuesday, June 20th, 4:20pm, Chicago Ballroom IX

The genesis for this panel took place during dinner following the Ping Identify conference in New York. Rob Davis from TIAA & I were talking about some of our challenges in deploying identity solutions, especially ones where customer, stakeholder, or developer engagement are required. In other words, pretty much everything except directory synchronization. Even governance solutions, like certification or privileged access management, that had the benefit of the ‘stick’ approach to service adoption; seemed to lag in engagement even when doing so wasn’t necessarily voluntary. You could lead the horse to water (you knew there would be a horse analogy, right?), but you couldn’t make them drink.

The simple reality was, this is no ‘Field of Dreams’. We built it, but they didn’t come to participate. Password recovery and management solutions are probably the easiest one to point to as an example of this failure. Nearly every enterprise worth their salt has deployed a password management and recovery product and yet password recovery is perpetually listed as the number one reason users call the help desk!

Rob & I both agreed that this would be an excellent subject for a talk at CIS. So I commenced finding the right people that could both explain their own challenges in this space and hopefully offer up solutions that might help others, including myself, succeed in the future. Between Rob & I, we had both financial services and healthcare/life sciences covered, but I wanted diversity of perspective. Through some networking, I think we put together a really great breadth of knowledge and experience across many industries. In addition to yours truly, we also have:

Bernard Diwakar – Security & IAM Architect at Intuit

Frank Villavicencio – CPO, Security Management Services at ADP

Steve Hutchinson – Principal Identity Architect at GE

And finally, no panel is successful without an awesome moderator, so naturally I asked Ian Glazer of Salesforce, Kantara, & IDESG if he’d do the honors in spite of his incredible schedule at the conference. Some promise of bourbon may have been part of the exchange, but in the end I think we’ve got a killer lineup of identity pros that will share their wit, wisdom, and experience on this important subject.

But wait! Part of what will make this a successful session is great questions and shared experiences from the audience. So bring your own stories and let’s make this a conversation!

Unfortunately, the scheduling gods put Rob’s talk against the panel, so we had to go to the bullpen. See you in Chicago! If you can’t make it, follow the action using #CloudIDSummit tag on Twitter.

RSA Thoughts, Part 1

(photo credit: Brian Campbell)

I think teaching eviscerated my time for blogging. Going to try and put more energy in it this year. Naturally, I’m going big on this revival with a two part post about my experience at the RSA Conference, to the best of my knowledge the largest security conference on the planet (especially if you count their global adjuncts).

This was my first RSA, both as an attendee and speaker. I thought Oracle OpenWorld was huge. Good gravy. I think estimates had it at about 45,000 attendees. In spite of the size, kudos to RSA and their management vendor who run an incredibly tight conference for that scale.

On one hand it’s awesome that we have so many people, vendors, and speakers focused in the information security space. On the other, its a touch overwhelming and nearly impossible to get to all the content you want. Overall I think that’s a good problem to have, because this is a tough problem to solve. It was refreshing that they featured an identity track (a first, I believe) at the conference.

The good news is they make much of the content available online, including some videos of the sessions. Mine has audio but no video, which isn’t a loss, heh. It isn’t very technical, but has a solid foundation on some of the key elements and challenges that go into a Privileged Access Management program. I’ve delivered this talk at the Cloud Identity Summit, BSides Charlotte, and IT Hot Topics, but this was definitely the most mature version of the talk because of the time that has passed and the lessons learned.

My talk was on Thursday, which originally I loved because I thought it would give me more time to prepare. I was mistaken. This talk is by far the most mature of the ones I’ve developed so very little additional time was needed to update it for the conference. I don’t know necessarily that I would have wanted to go on Tuesday, as there were some serious heavyweights in the industry to compete against. My biggest concern was making sure I kept my energy balanced throughout the sessions, networking, and vendor parties so that I could be sharp as possible when it came time to take the stage. It required missing a few tracks, but I eventually achieved that.

I discovered in the hours leading up to my talk that seat reservations had reached a level that they created an overflow room in case demand exceeded capacity. That was extremely flattering, but I did my best not to make it bigger than it was. The talk wasn’t changing, or the stage. I was thrilled that so many people were interested in this area, because I think sometimes it gets lost in between the traditional domains of identity & access management and information security. Clearly others felt the same way given the number that turned up.

Overall, I couldn’t be more pleased with how the talk went. Even though the hall was a little dark so they could broadcast it to the overflow room, I could feel the engagement and energy from the audience. It showed when I finished, as the questions that emerged were insightful and thought provoking. Once we wrapped up, I went outside and answered even more questions, happily, for another 40 minutes. Such great conversation with such intelligent and thoughtful people! I retired to the speaker’s lounge to decompress a little and make some mental notes from some of the questions that were asked. (photo credit: Scott Bollinger)

I know I’m kind of working this post backwards, but the next chapter will have some of my takeaways from the conference, both in hallway conversations and some of the tracks and keynotes I attended.

I’m writing this post at the airport with a feeling of extreme gratitude for the opportunity that was presented to me, and all of the support that I’ve received from countless people to help make this conference a personal and professional success.

PS. Thanks to Ian Glazer for the support.