The 39th Edition of the Identity Jedi Newsletter

Perfect PAM Primer

Don’t you love literations? 🤓 As we continue to mature the identity industry into an active player in the security world, we can’t forget the fundamentals. In fact, we have to master them. It’s the basis for which we can build everything else. Just ask Nikola Jokic ( sorry, another basketball reference). This article from the folks over at Integral Partners does a fantastic job of breaking down the complexities of PAM, from the definition to the implementation to the nuances of this niche.

The Journey from Identity to Security

While researching this week’s newsletter and I saw the phrase “ Identity Security” A LOT. It’s the new shiny marketing buzzword. So much, in fact, everyone is clamoring to be “The Identity Security” company. But I question whether or not we ( the industry) have stopped to really consider what that means. ( Queue Ian Malcolm)

What does it mean to be an identity security company? What does it mean to be an identity security practitioner? Are we just slapping a label on something because we want to sell more things? ( Probably)

Don’t get me wrong; I’m all for the new labeling. I’ve always believed that identity is a central part of security. However, we haven’t treated it that way in practice. Is current identity personnel ready to be active in an organization’s defense? To date, most identity practitioners are either on the dev or administration sides. What does the process look like when they are now in the security “workflow”? We’ve talked about how having identity in the kill chain of security incidents will make it tougher for the “bad guys” to be successful, but what does that look like for identity practitioners? It’s more than catchphrases and technology. It’s a process…a journey….a way.

Agree? Disagree? Let me know

Cloud Security Awards

Ok, this was just interesting to me. Never heard of this organization, nor half of these companies, but hey doesn’t mean they aren’t legit. Buuuut I’ve got questions..lol.

Mostly where did this company come from and what are the criteria for some of these awards? Seems kinda pay to playish but….who knows

Besides that, though, I did find an interesting company among these. (Full disclosure I’ve yet to dig into each of these companies, I may come back in the following weeks a do a deeper dive on them). The specific company that won “Best IAM/SSO”.

Three guesses who the winner was….Ready…

Set….

GO!!!

Give up?

Ok, it was VEZA

An “Identity Security” company focusing on Privileged Access Monitoring, Access Reviews, and Authorization. ( According to their website)

Speaking my language so far…

The thing I find most interesting is their approach to understanding access. Specifically diving into the relationship of identity to resource and all the many pathways in between. ( Check out this video here showcasing their product view).

THIS is golden and very much on the path I think we should be on as an industry. The biggest gap with last-generation IAM tools is that they have no concept of what entitlements actually touch in an organization.

Kudos VEZA team, I see the vision. Not sure if that warrants the best IAM/SSO product. ( Their website mentions nothing about SSO) but I like the foundation.

RSA Conference Talk

The talks from RSA are live and floating around YouTube. Here is my now infamous and apparently controversial Web3 talk from RSA.

Enjoy!

Or hate, I guess.

Become a paying subscriber of Premium to get access to this post and other subscriber-only content.

Already a paying subscriber? Sign In.

A subscription gets you:

• • Blogs
• • Expert Interviews
• • Expanded Commentary
• • Early Access to Identity Show content