The 72nd Edition of The Identity Jedi Newsletter

WHAT’S HAPPENING THIS WEEK

Delinea enters the chat

I’ve said it once, I’ll say it again. Welcome to the Platform Wars!! For those of you who have been following this newsletter for a while, you’ve heard me refer to the Platform Wars several times. Consolidation is here to stay as every major identity vendor has made some acquisitions to create a platform of identity services. Rounding out the list is Delinea with their recent announcement to acquire Fastpath.

Quick rundown: Delinea is a PAM vendor, and part of the Uncle Tommy B portfolio ( Thoma Bravo for those new around here) Delinea itself is made up of an acquisition of Thycotic and Centrify.

FastPath - A GRC-rooted company that specializes in SOD, who last year purchased Ideiio who specialized in IGA.

So now, Delinea has become the latest vendor to offer a platform of services around identity. So now customers have to measure these companies not just on how well the deliver an individual service, but how they deliver as a platform. I think Deliinea has the farthest to go with this as it’s multiple products they have to integrate ( It’s possible Fastpath is still getting the Ideiio tech stack integrated, but it will be fun to watch. )

Are we ready for a Chief Identity Office?

So recently, a conversation started around the role of a Chief Identity Officer. It’s been a conversation that has been brewing for a while in the Identity industry,and while I’m all for it. ( Biased, clearly..) I’m also really concerned about whether or not we are ready for that type of position. I looked at the CISO position, and I have to ask: have we got that right? Does the CISO position actually work, and have we put them in a position to win? Because if we haven’t, what makes us think that we will do any better with a Chief Identity Officer?

Also what value would a CIDO bring to the business at the executive level? ( I’m legitimately asking) Have we figured out how to communicate the value of identity to a business?

I’ll be the first one to jump on the hill and scream that someone needs to own identity across the entire organization, but let’s make sure we put them in the best position to win.

What are your thoughts?

Let’s talk about NIST ba-by…

Ok, NIST dropped the long-awaited CSF 2.0 framework. It’s meant to provide a framework for every level of organization to help organize their business around cybersecurity. The day it dropped, I spent the entire night reading through it to understand what the framework is.

Here are my initial thoughts:

1. It’s extremely flexible. You can build it to meet your organizations needs, HOWEVER it does require a fair amount of effort to do so.

2. It’s not very straightforward. They mention it’s meant for any level of business and you don’t need to really be a deep cybersecurity person. I don’t think that’s true.

3. Barely covers identity. Not enough love for identity in here, however the framework is flexible enough to build some identity related tasks around it.

4. Overall it’s an excellent way to think about your approach to cybersecurity. I LOVE the pillars of Govern, Identity, Protect, Detect, Respond, Recover.

5. I would have liked to see a clear example of how to apply measurements so organizations can see where they are.

I encourage all of you to read it. You don’t have to read the full thing, but it’s a good thing to peruse.

Become a paying subscriber of Premium to get access to this post and other subscriber-only content.

Already a paying subscriber? Sign In.

A subscription gets you:

• • Blogs
• • Expert Interviews
• • Expanded Commentary
• • Early Access to Identity Show content