The 61st Edition of the Identity Jedi Newslette

WHAT’S HAPPENING THIS WEEK

Zero trust = identity first

Ok so are we over the Zero Trust buzzword yet? I think we are, because we are actually starting to talk about what it means to make this a reality. Organizations are starting to take a hard look at what it means to build an identity-centric program.

New flash: It’s more than just one product.

Not great for your budget, but it’s the truth. I often remind people to go back to the nexus of this whole Zero Trust movement. The BeyondCorp whitepaper by Google.

The premise is this: There is not trusted network, not trusted identity, so we will verify everything. ( I’m paraphrasing, but you get the point).

A simple and small statement, but a BIG fundamental change to how we architect and implement systems. AND how we operate as a business.

Here’s my favorite quote from the article

I couldn’t agree more. Identity-centric, identity first, zero trust, whatever you want to call it, is a shift in how we operate. A shift in what tools we use. Better said, it’s changed. So we have to become agents of change and that means understanding what’s currently there, and providing support for getting to where we want to go. It’s more than just buying XYZ vendor.

Change is hard. Yes. Change is necessary. Yes. But it’s also fun and rewarding. So…let’s go make some changes.

The Case for Authorization

I’ve had several insightful conversations over the last two weeks that have led me to spend several hours thinking and writing about where we are as an industry and what’s next.

Externalized authorization has been a monster that we have tried to slay several times now, and it turns out much like Atheon in the original Vault of Glass, it’s a tough one to bring down.

But I’m encouraged that they are some really smart people taking a crack at solving this problem. At the core of truly making identity a first-class citizen in security architectures, we have to be able to grant and enforce authorization at a granular level. And not just once, but multiple times, because context changes everything. But we can’t do that if authorization logic is trapped in the application and subject to a production update. We need to be able to make decisions in real-time based on the information that’s available to us and have the right to progressively change our minds.

I don’t think we can accomplish this without some standards. When we look at what OIDC, and OAuth did for authentication, we can have a similar impact on authorization.

It’s a wide-open field where we could use innovative thoughts and behind.

Shout out to Sarah Cecchetti for launching a substack all about authorization. You can check it out here

Question of the Week

Do entry-level IAM positions actually exist? If they do what do they look like? What does an entry-level IAM person do?