Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 59 for the week of March 19th. This week I do not have Alex with me.

I have a special guest host, Misha Deniso. Misha, can you introduce yourself? Hi, Misha Danisso. I'm the CISO with Intel Secure. Very excited to be here.

I've been a big fan of this podcast for a long time and really appreciate what you and Alex do here. Thanks a lot. Appreciate it. We'll get diving through some news here pretty fast. I have a couple of announcements first.

We have some shoutouts. We started a Patreon campaign a couple of weeks ago and we've already had 4 folks sign up to support us. Really appreciate that. We called out a couple of them last week. 2 new ones this week.

Trish McGinty. Trish, thanks so much for your support. And we have an anonymous supporter. He doesn't, he doesn't want to be named, but we really do appreciate your support. Thank you very much for doing that.

Um, speaking of sponsorship, kind of out of the blue, we had 2 corporate sponsors, uh, reach out and ask to sponsor us. So, uh, big thanks to Swimlane, uh, for, for reaching out, Cody. We appreciate that very much. And also, um, Digital Globe. We, uh, we got hooked up with some folks over there.

Thanks to Chris Martinez, who's a CISO there, for, uh, for helping us out. So you guys, we appreciate the sponsorship. That'll keep us going, pay for the microphones and the, the sass that you guys keep getting from the podcast. With that, I do want to also remind you that we have a Slack channel. We're well over 350 people in the channel now.

We have a March Madness bracket going right now. Misha, I believe you're in second place. I'm in second place temporarily, I believe. I believe that the team that I've got going all the way got knocked out really quickly by the good folks over at University of Maryland Baltimore County. So the Retrievers.

Yeah, nobody expected the Retrievers to take out Virginia like that, but shout out to Retrievers because that was very impressive. I believe I am second from the bottom right now, but I do have the potential as long as my teams, my 2 finalist teams are still in there. And I got Texas Tech going to the finals, which no one else does. Good luck with that. Yeah, that certainly beats my favorite pick.

I was gonna go with Murray State to go all the way. You know, I don't even know what Murray State's mascot is. I'm thinking like a corned beef sandwich or something. But it's a, you know, it's always fun. Remember, the tournament's not about how you start, it's how you finish.

There you go. All right, so let's dive into the news. First bit of news this week is that Facebook has signed a lease at Union Station for 23,000 square feet. They're gonna have a big office down there. Yeah, that is a big office.

It's actually a really nice place. I've been in that building several times. I know that ReadyTalk is in that building. And what's interesting about it though is that seems like a pretty significant event here in Denver, and everyone is just mum about it. Well, so 20,000, 23,000 square feet sounds like a lot to me.

I looked it up and it sounds like that's only about 120 or so people's workspaces. I don't know, I guess the people get a lot of space per person. I didn't know that. Yeah, no, I think so. But what's interesting about that though is that what they're doing right now is they're working out of a shared work facility.

I believe it's the Thrive. Oh, is that right? And so to me, that seems like a pretty significant expansion. The thing to watch would be what kind of job postings start to go up around Facebook. Well, hopefully we get a couple security jobs here in town.

Yeah, they have been posting for engineers. Oh, there you go. So next story. So next story is how Denver ranks as a city for working women. I found this fairly interesting.

Denver turns out to be number 4 in this poll that was brought out, so which is very, very impressive, I think, and bodes well. What I did find fairly interesting about that, however, was as I delve further into the article is that Denver still lags behind somewhat with women regarding STEM positions. Yeah. And particularly in the tech industry. Yeah.

So STEM, you know, science, technology, engineering, and math, um, of course firmly where we sit here in security, right? It's interesting that we're doing really well in, in overall employment for women, but in technology, uh, really lagging behind. Yeah, I think that's true. And one of the challenges I think within technology is I find that When— I think this is in general— when you come into a kind of a position in which you are now the representative for your group, whatever it be, I think it's very difficult because you end up with a lot more pressure not just to succeed at your position, but then you're representing some sort of group, as it were. So if you're a woman in technology, when you succeed or when you don't succeed, oftentimes people will cast aspersions on how that represents your group.

And I think that's incredibly unfair, and figuring out a way to fix that is going to be one of our big challenges. Yeah, so if Misha or Robb does a bad job, it's, you know, it's not that all white guys are no good at their job, right? It's that Misha or Robb is bad at their job. Yeah, nobody will point out if, you know, if Misha or Robb gets appointed, no one says, hey, white man gets appointed to this position, or white man succeeds in this position. That's not news.

Yeah. And so I think the fact that you do have such a lack of representation of women makes it very, very difficult for women to even being qualified to get into these positions and succeed. They have a lot more pressure than we do. Yeah, and of course there's, there's a lot of different ways that we're gonna try and fix this problem. We know that, you know, there are professional organizations like the one we're gonna talk about next, the Women Who Code, and of course Women in Security Denver, and who are really addressing the adult or, or nearly adult women to try and get them more involved with technology.

But there's also groups like, like Cyber Girls and Cyber Patriots that are really focused, you know, in grade, grade school girls and junior high and maybe even high school girls, trying to get them interested in technology earlier on and, and help with the pipeline of females in technology. So there are lots of things we're trying to do to solve it. It's just, it's just not a short-term problem. It's definitely not a short-term problem, and I think it's gonna take time. And that's why that next article about Women Who Code I found was so interesting.

Specifically because of the growth that we're starting to see in groups like this, where Women Who Code— I believe when they were starting out, there was about 50 people involved in the organization. Now we're talking about 3,500 women involved. Yeah, which is phenomenal. It's incredible growth, but that's still just a drop in the bucket compared to what we need from a pipeline perspective to add a lot more women to fill out these jobs that are going to be available in cybersecurity. Yeah, but we need to be publicizing the success of these groups, and the more we talk about them, the more well-known we make them, the more people are going to join, and the more girls are gonna see it and see that there is a, you know, a path forward into technology and that they're not gonna be having to blaze a trail to do that.

Yeah, no, I hope that we get to a point where it just doesn't really matter whether it's a man or a woman. It's just the person. Yeah, that's ultimately what we're looking for. So, you know, kind of going further into the embedding kids, or this with kids earlier, there's a school district down in Southern Colorado, excuse me, that's really incentivizing and paying their teachers to go get get learned up on cybersecurity at the Gen Cyber Colorado 2018 program and then take that back to the kids so they can teach them about security. Yeah, I think that's a wonderful thing that they're doing there.

It's fascinating that they're actually getting funding for this sort of thing. One of the big challenges I think also though with teachers in general is the fact that teachers are already strapped for time in a significant way. So even when you do have programs like this that are encouraging teachers to get certified or to learn more about this and to promote technology in general, going through the process of learning all this takes a good amount of time. So, uh, kudos first of all to the teachers who are getting involved in this because I think it's going to make a huge difference. But let's not forget that this is a significant investment beyond the normal workload of a teacher.

Fair point. So it is the St. Vrain Valley School District that's doing this and really supportive of this. And of course, if we can help in any way, we'd love to hear from those folks and let us know what we can do to help. And I'd love to see how this ends up going about a year out from now. I'd love to see how successful they are.

Maybe if you do a follow-up. Yeah, absolutely, that'd be great. Um, so next is InteliSecure news. Talk to me about the, the new news from you guys. Yeah, so InteliSecure made an announcement, uh, the other day that we're partnering up with Digital Guardian as well as Netskope, and I think it's actually a really interesting, uh, announcement that we've made.

I don't think it's a huge surprise, to be quite honest. We are very much— have always said that we're a vendor-agnostic solution, and so we're not trying to push someone's particular solution into all of our, into all of our clients. Really, we want to be able to be focused on what the clients need and what they are, which solution is going to fit them best. And so working with both Netscope and Digital Guardian are going to allow us to provide a wider range of services to the clients who are looking for things like a CASB solution that fits them properly, as well as a DLP solution that fits them properly as well. So are you guys doing this as a, as a service MSP, or you're reselling it, or both, or what?

It's both. What I would say is primarily we do everything as— we do professional services as well as MSP services. Yeah. And so both of these will fit into those offerings. Our primary goal is not the resale.

Our primary goal is helping organizations with the solutions that fit them. For some organizations, an MSP is the perfect solution. For other organizations, really what they're looking is help and implementation on this and looking for experts who will help them put together a great DLP program, or who will help them put together a great CASB program, help them run it and check in with them. So it really depends on the organization that we're serving. Okay, good stuff.

Um, looking next, we have an article from Cody— or excuse me, from, uh, Patrick Quinlan, the CEO and founder over at Conversant, um, on The Worst Thing You Can Do Is Nothing: The Case for Reactivity in the Workplace. And basically the idea here is, you know, the ideal state is that an organization is proactively getting, you know, putting a good culture in place and really having a top-down message around inclusion and ethical behavior in the workplace. But kind of then the next state is, okay, if you haven't already done that and you have an incident, what the worst thing you can do is nothing here, right? The next best thing is we'll start to react to it, start to figure out how to fix it. When you hear that these bad things are happening in the organization, don't ignore it.

At that point, start reacting and start trying to make things better. What I really liked about this article is that really this is something that we in the security community deal with all the time. So a big part of what we do is focused around incident management and how we handle— really, we have programs for being reactive. And what we're talking about here, however, is what happens when something comes in your organization and you don't have a program for it. How are you going to deal with that?

And we all know that as proactive as you want to be, you cannot get around the fact that something bad is going to go down, and how you handle that is appropriate. I once heard a great talk from, I believe it was the CEO of Vail Resorts, and he talked about how when issues like that come up, instead of being instantly reactive though, what he likes to do is take a step back, think about it, let it stew a little bit so that he can come up with an appropriate response. And I think that really depends on the situation that you're in. The case that Patrick gave in this article, which I thought was really interesting, was in a meeting, somebody using a disparaging term. And that was the kind of thing that he thought about it for a moment and realized, I can't let that go.

I cannot take time, go back and deal with that in a quiet way. If I don't say something right now and do it in a respectful way that doesn't embarrass anyone, which is exactly what he did, then he shows from a leadership standpoint that that is something that needs to be addressed and we will not tolerate that kind of attitude. Yeah, that's great. And I think, you know, as security leaders in our company, it may not be squarely on our side to do this, but there probably is no one else in the company who's really thinking about it, and there's an opportunity for us to, to be leaders outside of just the technology area. I'm always surprised as a security leader how much we have to deal with culture, and oftentimes culture seems to fall on our shoulders in a significant way because we are also the people who have the responsibility for making sure that governance rules are enforced within an organization, and that has a lot to do with our culture.

Yeah. All right. Well, moving, moving along here, we have a LogRhythm blog that's detailing the, the memcached DDoS attacks. Um, so these are, these attacks were a week or so ago against GitHub, right? That, um, they, we saw what's really the best amplification that any attack's ever had.

Memcached servers on the internet, if they're exposed, they have a 10,000 to 1 amplification rate. So you can send 1 bit to the server, it sends back 10,000 and really can quickly overwhelm Uh, those technologies. So LogRhythm blog here really talks through what this looks like, how to see if you're impacted with that on your own organization, and it just kind of gives the, the anatomy of these types of attacks. I think that's really fascinating. And what's interesting is that it really makes— anybody could potentially be vulnerable depending on to what degree that they interact with GitHub.

Uh, what'd be interesting to find out would be what GitHub itself is doing with regard to this. Yeah, it'd be— it would be interesting to know. I see— I, I believe that they have things running through Akamai to get the cloud DDoS protection. It used to be Prolexic, and Akamai bought it. And I guess they were able to ramp up and take that huge 1.5 terabyte attack.

But it's an interesting story for sure. Yeah. I'm very fascinated all the time as these things come up and how these organizations are able to respond to them. Last thing that I think we have on here with regards to the articles was about the Security Pursuit blog regarding GDPR. The Security Pursuit blog, I think, great as an introduction.

If you're thinking about GDPR, you haven't really put together a strategy for it, they're giving you some very good background on what it is that you're going to have to start thinking about. But we can go well, well deep into GDPR. It's a pretty significant law, and I've got the whole thing just all constantly on my desk. Yeah, it's certainly become a big topic for not only companies who are in Europe, but also those of us here in the States. Of course, take a look at that if you're not familiar with it.

We're not going to go into too much detail on it right now. Um, the last— I do have one more thing on the list. We have a blog from Ping this week that, that talks about how IAM can balance innovation and security. Um, it's what it was actually— I think that there's not a lot of places in security where we're able to help make the user experience better and help the business be faster, um, than other than like federation. Federation gives us the opportunity to get rid of lots of different usernames and really move more quickly.

This is a use case that kind of talks about that, and it really specifically talks about the implementation at TIA CREF. I think it's not, it's not CREF anymore, it's just TIA now. Um, talks about what they did there, and I love case studies, and it's good reading. So take a look at that if you're interested in it. I'm definitely going to check it out.

I do have one question for you, Misha. You know, I know InteliSecure had been doing the benchmark survey. Is that still open? Uh, maybe you could talk about that just a little bit. What, what is the benchmark survey about?

Absolutely. So, we have something that we're doing called the Critical Data Protection Benchmark Survey, and really we wanted to put something out there that we found would, we think, is going to benefit the entire community. We want to give people the ability to get an understanding, first of all, of where they sit vis-à-vis other companies and how they're going about protecting their critical data. I think a lot of executives, when they're talking to cybersecurity professionals as well, want to know, especially as we're putting together and making cases for, hey, we need to put in this solution, we need to put in that solution, they always want to know, well, what are other companies doing? Where do we sit vis-à-vis them?

And that's not always the best reason to put together why you're doing it, but it's definitely helpful to have that information available. And that's what we want to do. We want to get as many people putting as, as much information here as possible. So we're highly encouraging anybody to go to criticaldataprotection.com fill out the survey. Obviously, the more responses we get, the more statistically significant the results are going to be.

Sounds good. All right, let's jump over to trivia. We did not get a response for last week, so we'll move on to this week. The question is, who was Colorado's first official CISO? And you get bonus points if you can answer what has he or she been doing since then?

So who was Colorado's first CISO and what has he or she been doing since then? Send your response over to info@colorado-security.com, or you can ping us on the Slack channel as well. And thanks as always to Andre Gaeta, who is our trivia sponsor. Jumping over to events, as a reminder, we do have a calendar on our website that has all of the events going out here for the next several months. We're filling out up into July right now, starting off with the Lady Coders event.

So they have an event on the 20th, the Personal Branding: Branding Yourself for a Pivot. We also have on the 20th the CSA March chapter meeting. Yep. On the 21st, we have, uh, DENSEC doing their monthly meeting. Uh, that's going to be downtown now.

As a reminder, they're no longer doing the north-south meetings, they're just meeting downtown once a month. And the— on the 22nd, we have the ISSA Denver happy hour, which is always a fun time and great opportunity to network and meet some of your colleagues. And that's happening down in the south. I think it's actually within the within the Comedy Works space at Landmark. So a fun place to go as well.

On the 23rd, SecureSet has one of their capture the flag events. As a reminder, what they do for these is from 5 to 6, if you're brand new and you don't know how to do a capture the flag, show up, they'll give you an introduction so that when the real event starts at 6, you can participate and have a good time doing it. And then on the 27th, SecureSet also has the career conversations. The speaker on this one is going to be Karen Wuerstel. On the 27th, there is the GDPR meetup.

It's the GDPR and legal basis for processing. Is consent really required? Can I answer that? Go for it. Maybe they don't have to go to the meeting if they listen to your answer.

No, that's actually— it's a really fascinating topic around consent, and I think that that would be definitely something worth going to. It's one of the challenges, depending on the situation that you're in, that we're all dealing with. Last event on here is the ISSA Colorado Springs 5th Annual Cyber Focus Day. That's on the 29th. It's a full-day conference.

It's kind of not their big conference, which is in August, but it is a neat event and a good chance to get some CPEs down in the Springs. Excellent. Well, that looks like a great opportunity. Let's— I do want to remind one something that's not coming up the next couple of weeks, but we did just post the next Women in Security event is on April 24th, and that'll be Um, the registration is open for that right now. You know, we've had such great turnout for those.

I want to recommend folks get signed up early, make sure you get yourself a spot. I, I assume that there is at some point going to be a sellout number, so try and get in there if you can. Yep. And of course, May 8th through 10th, we're all aware that Rocky Mountain ISC is coming up, and it's always a great event to get involved in and go and meet some of your vendors that you're dealing with, as well as hear from your colleagues. Yeah, should be, should be a lot of fun.

Uh, let's go ahead and jump over to jobs. Top job this week, um, Cognizant is hiring a director in their corporate security program focused on cybersecurity audit. I don't know if this reports into Matt Shufeld, who's the CISO for the healthcare side of stuff, or if it goes up to the audit area. Either way, it's really a growing company and a lot of fun to work over there from everything I hear. Yeah, one of the more interesting jobs that I saw on the list this time was the NBCUniversal broadcast cybersecurity security officer.

I love the fact that we're getting a cybersecurity officer focused on a business directive. Yeah. Within an organization. So that's a fascinating opportunity. Yeah.

It looks— it looked really interesting. I, I kind of— I wonder if that's a different job than the rest of us have, and I just don't know how. Right. Interesting. Uh, so LogRhythm is hiring a manager of compliance research.

Uh, you know, I assume that's working for James Carder up there. And, and compliance research, I don't know what that means. Let me know. It looks like we have a few Ping Identity jobs that you might be reporting into you. So how does that work?

Yeah, so I actually have 3 different positions posted here where we're hiring an infrastructure security specialist, someone ideally would have a good background in, in Linux and Macintosh infrastructure. Having any knowledge about AWS is great as well. Really someone who can help us with our corporate security work. We're also hiring a product security engineer, someone who has got Java development experience, web application experience, and security. That's, that's what we're looking for, for that.

And then the last one is a GRC analyst, and this is a more entry-level position. Someone with 0 to 2 years of experience, knowledge about ISO, SOC 2, GDPR, risk-based approaches to stuff. That would be, uh, that'd be a good mix of stuff we're looking for on those. Fantastic. Sounds like some great opportunities out there.

And it looks like Pearson is also going to be hiring a cyber cloud security engineer. Within their DevOps team. Yeah, so Pearson, a big education leader in the, in the South Denver area here. That'd be a good place to take a look at if you enjoy working in Southglenn area. That would be a great opportunity for you.

And, uh, and Lee Worthman— I think Lee is probably the boss over this area, and Lee's a good local guy, he's a friend, um, so I think he'd be a good guy to work for. CHI, Catholic Health Initiatives, is hiring an enterprise architect focused on security. That'd be a good opportunity for a massive company here in Denver. Absolutely. And then, uh, last on the list here is Swimlane.

SwimLade is looking for a sales development rep, and SwimLade is a great local company here that has really in the last 4 years put together a product that I think is really making waves. Yeah, so SDR, sales development reps, it's kind of an entry-level position in the sales organization. There's a lot of, you know, get beating the bushes to find opportunities that you'd hand off to the account executives. It's a good way for you to get into a company, learn how things work, and presumably, you know, move on from there within the company. I think that's it for the, for the news this week.

Any final comments before we send it over to the feature interview? Uh, no final comments for me other than the fact that I wish you very well in your brackets, and I hope that you do well, uh, with, uh, Texas Tech going all the way. All right, they need to lose to Xavier in the finals. That's what I, that's what I'm rooting for. Uh, all right, so, uh, we did have this week Andre Durand, who is, you know, my boss, is the CEO and founder over at Ping Identity.

He was interviewed by Alex. I decided that it would be better for someone who doesn't know him so well to do the interview. So Alex gets to learn about, you know, where Andre came from, how Ping came to be, and, and what the future of identity and access management looks like. All right guys, have a good one. We'll talk to you soon.

So long. Hi, this is Debbi Blyth. I'm the CISO for the state of Colorado. Welcome to Colorado Equals Security, for Colorado security professionals by Colorado security professionals.

So this is Alex Wood, and this is our feature interview segment. I am here with Andre Duran, CEO of Ping Identity. Welcome, Andre. Thank you, Alex. I appreciate you taking some time to talk with us.

I think as most people know, you know, my co-host Robb Reck also works at Ping Identity, so we're happy to finally get you on the show. I think Robb wanted to make sure that we had a clear and impartial interview, so he had me do it instead of him sitting down with you. But really appreciate you taking time to talk with us. Thank you. Robb's brought security to Ping, and we've brought identity to Robb.

Awesome. It's been a good match. I think it's a great combo, right? So I think, like we do with most of our interviews, I just want to start with hearing about you and your background, kind of where you started in security or maybe even before that if it's important, and then, you know, kind of how your path got you to where you are today. Sure.

So I'm a third-time software entrepreneur. I started in 1993 with bulletin board software. Yeah. And we created the first kind of photograph database for bulletin boards in the DOS era. Wow.

And then followed it up kind of 1994, '95. We, we wrote a Windows, kind of the first Windows NT client-server bulletin board. We kind of referred to it as AOL in the box. You know, probably most people won't even recognize that, you know, today. That is pretty cool because when I think of bulletin boards in 1993, I think of, you know, text-only chat rooms and all that kind of stuff.

So I'm sure that was pretty revolutionary. Look, I mean, I mean, viewing a photograph in DOS when dialed up to a bulletin board used to be really complicated. You used to download an image, shell out from your terminal program, open up a GIF viewer, look at the image, shell out of that, go back to your— and so, you know, those were fun times. In 1998, I sold that company to a company here in Denver, moved here. Took over, moved to Denver, took over for product for this company for a few years, and then I had, I had a new brainchild, and I wrote a business plan called NDrive, which was essentially Dropbox.

The notion of internet-connected storage. A man before his time. Well, you know, what I didn't realize is that, you know, it'd be like starting an electric car company when there wasn't a lithium battery, right? Right. We didn't have bandwidth to pull that one off.

So I was, you know, good. It wasn't until DSL hit at a consumer level, right, that there was enough bandwidth to actually pull that one off at a consumer level. But, you know, I remember one Christmas, it was— I'd written the business plan, I was gonna raise some money doing that, and I talked to the CEO of the company that acquired my first company, and he essentially convinced me to stay. And he said, do whatever you want. And I had been researching and working with this little open-source startup called Jabber that was— had a vision around interoperable instant messaging.

And I said, okay, I'll do Jabber. And so I partnered with the founder, Jeremy Miller, and his crew of open-source developers, and we built this commercial company around that open source that ended up selling to Cisco and becoming the instant messaging platform for Cisco for a number of years. And now, as I've discovered, has become the platform for IoT for Cisco. It's now the messaging infrastructure for Cisco's entire IoT strategy. Wow.

Which is cool. 2002, I took a break after 10 years, and longer story, but went and spent some time on my friend's sailboat in the Caribbean and had a lot of time to blog. It was the first time blogging had just started. Yeah, it was 2001 timeframe. Blogging back then was writing something on my laptop, putting it on a 144 floppy, taking a raft to the pier, and then a bike from the pier to the center of town where there was an internet cafe.

And putting your floppy in and uploading your blog post. That's awesome. So I blogged, and really I blogged about observations, big observations that I had had in kind of compute networking. And I remember they were all kind of business ideas built around trends. And I remember waking up on the 3rd day, something was bothering me, and I said, I said, you know, these are interesting ideas, but they— but there's something missing.

And that something was there was no notion of who a user was on the internet. It was anonymous by default. And I said, we need a better notion of identity on the internet. And that was really the aha moment that started Ping. So told my friend, and he said, well, you know, how are you going to make money?

And I said, well, as best I can tell, everything on the internet has a server. We have FTP servers and email servers and web servers. And so I said, but where's the identity server? So we're going to build an identity server. And that was 2002, January.

Wow. Wow. And so then did you just sort of overnight decide, okay, we're going to do this? Or did it take some time? Yeah.

So I actually cut my trip on the boat short by probably 6 weeks. And I said— because I had taken a 3-month sabbatical from Jabber. I said, I'll go back and write a business plan, and if I raise $500,000, we'll start the company, and if I don't, you know, I have a job. And I came back and raised $500,000, and on January 4th, 2002, moved my computer from one office across the kitchen to a bunch of blank offices they had given me in an office, kind enough to do that. And I remember sitting there on day 1, and, you know, first thing you need to do is get your email, right, going.

So I had an email address in the first couple of hours, and I just remember, you know, it was lunchtime and I had zero emails, which makes sense, right? New company, new email address, nobody knows it. And I just remember sitting there going, okay, well, I guess it's lunchtime, and And of course, you know, I've got no— you go from 100 emails and 1,000 miles an hour to zero. And I said, what did I get myself into? You know, and you just really appreciate what it means to have nothing and know nothing about what you— it's just a full-on leap into the void.

And it was fond memories, right, of going back to zero. Yeah. And so I'm sure at that point also You had this brilliant idea that we needed identity, which I think has proven to be a great idea. But at that time, I'm sure you didn't know a whole lot about identity and digital identities and that sort of thing. So, so how did you start moving into that space?

What are the first few moves? So 2 things kind of manifest out of this. One is you do what everyone does, which, you know, Google had found its way into our lives at that time. And so you search for digital identity on Google. Yeah.

And I remember coming up with absolutely nothing except for one what looked like doctoral thesis written in another language, but whose title was Digital Identity that I could recognize. Yeah. You know, even in another language. And so I remember calling up my first investors, this is maybe a couple months into it, Phil, who had put in, literally written the first check of that half million. And I said, Phil, we've got a problem.

He says, what is it? I said, I think we just started a company in an industry that doesn't exist. And he goes, well, what do you mean? I goes, well, if I type digital identity in Google, the only thing I find is one doctoral thesis written in another language. I mean, there literally is nothing else.

I said, but don't worry, I reserved digitalidworld.com. You put in $5,000, I'll put in $5,000, and we'll start the industry conference. Yeah, so that's one of the things, you know, that we did to start the conversation. Second thing that happened that was kind of seminal was I got involved with an individual who had built a company around web access management, kind of 1.0, sold the company to RSA, became RSA's access management product, happened to be a local person, super smart, and, you know, the CTO of that first company. And we went to coffee and I asked him, I said, you know, is there one of all the, of all the benefit of what you sold back in the day, I said, was there one use case that was just the 80/20 rule?

Like 20% of the functionality garnered 80% of the utility? Without even hesitating, he said, yep, single sign-on. He goes, we did all these fancy things, but at the end of the day, people really appreciated the single sign-on.

And having had experience in the importance of a single use case or killer app to start, especially when something is as large as the problem set, I immediately said, I said, that's it. That's where we will focus. We will focus on single sign-on. And it turns out it was the right time to focus on that because Microsoft had, prior to this announced Passport, which was this notion that a Microsoft account is what— is all you would need to access the internet. And coming off the Windows desktop domination, the world wasn't ready, and the internet was this new thing to let Microsoft create a choke point called the Microsoft Passport.

And so there was this whole effort led by Sun and McNealy at the time that was called the Liberty Alliance Project, which was basically saying, we like We like the concept of an internet identity where you can just log in once and go anywhere on the internet. We just don't like it to be dominated by one vendor, right? And so how can we build an open standard around this? And having worked in the standards effort at Jabber to create the XMPP messaging and presence standard, I immediately gravitated onto this effort, if you will, to create a standard. Standard.

And we were actually the first ones to develop some open source toolkits around the Liberty Alliance standard. My first customer was American Express to implement the open source toolkits, and that was all pre-SAML for single sign-on. This was the precursor to that. So did that become SAML, or is that— Became SAML. Basically, ultimately kind of merged in with other efforts by the vendors and became SAML.

Yeah, that's pretty cool. Yeah. So, all right, so you're building a little momentum. You've got a use case, which is a great use case, by the way, 'cause I think we all know in security, even still today, nobody wants to do security. So even if you're doing security, you need to build it as a use case that is something else, like single sign-on is a productivity use case.

So then what happened next? Yes, and so, We had a small modicum of success between 2002, frankly, probably 2006. And keep in mind, we were focused on standards-based single sign-on. We had single sign-on, but it was proprietary. You would buy a web access management product, you'd create essentially one domain, and that domain would have the equivalent of a token that gets shared, and the token would maintain session, and that domain.

And what we were talking about was how do you maintain session and user identity between 2 completely separate domains? How do we federate 2 security domains, right, so that an authenticated user with a valid session in one domain could just magically appear and have a valid session in the second domain? Yep. And that could be between companies, that could be between Oracle and SAP, or between SAP and IBM or between IBM and CA, right? And so we were— the notion of how do you connect identity between the domains through a single sign-on federated standards-based use case, that was a new concept.

But it didn't— outside of a large enterprise that had a lot of different vendor products that didn't talk, so they might have single sign-on with Oracle or single sign-on within CA, but they didn't single sign-on between Oracle and CA, right? That was its own federation, if that makes sense. But the real breakout for our use case happened when Salesforce introduced the concept of SaaS. And now all of a sudden there's an application outside the firewall that is disconnected from the enterprise identity behind the firewall, uh, that you would want to authenticate your users to the corporate network or to your corporate identity, but then have them magically access SaaS. And so 2006, when the applications started to move beyond the firewall, that was the beginning of a real driver.

The second major driver for us was about the same time the iPhone appeared, and now the device and the user— it was not a corporate-issued device and not on the corporate-issued network— the user was outside the firewall on their own device, created the BYOD problem. The application was in the cloud with a separate user ID and password that bypassed all the IT security controls around identity. And so it just— things begin to fragment, and the perimeter started to mean less in the new world where the user, the device, and the app and the data were outside of corporate control. That was a real driver for federation. So our business really started to take off.

We followed the single sign-on use case in the global 2,000 to 5,000 very successfully for the better part of a decade. That first product, we created a commercial product beyond the toolkit, we introduced it in, like, I want to say 2004, 2005, Ping Federate, and it just became the gold standard for federation. Amongst enterprises. The product will be a billion-dollar product. I mean, it's well beyond the halfway point now.

It's awesome. Yeah, so, so speaking of that, you know, you guys have been around since, you know, 2000, early 2000s. Yep. Um, I think a lot of people, uh, think of you guys as, as a startup still, and we were just talking, um, you know, before we started recording about know, your sales kickoff, the number of folks that were there. Do you still feel like you guys are a startup?

You know, you've grown a lot, you're fairly large in size now, but, you know— I described ourselves as a startup probably well beyond the period of time in which we were one in reality, largely because I like the idea that you're always building. You're never static. There's always an unknown future to go create, if that makes sense. And the concept of a startup is, is, it's a— it's like meeting a person who is up there in years but is clearly enjoying life as if they were a child, a kid, right? And there's something magical about that.

I don't know whether or not Jeff whether or not Bezos sees it the same way when he talks about day 1 and day 2, but there's something to that, right? So I don't think in the traditional sense, I don't think that we're a startup anymore. But the truth is we're pioneering into new spaces all the time, into new business models all the time. And anytime you make one of those moves, some of those moves are pretty significant. It feels like a startup again, and a lot of things that you thought you knew, which you probably did know at one time, all of a sudden now are meaningless in this new world, and you have to reinvent yourself.

Yeah, yeah, I think that, that, that's definitely true, and I think thinking about it in that way helps keep you agile and nimble and and especially moving into those new markets, seeing things change kind of resets and grounds you again. I have a simple mantra: you're either growing or dying. There's no homeostasis. And the more successful you are, the more things will change, frankly. And I really appreciate, you know, the concept in Crossing the Chasm and the— where everything that made you successful at one moment in time, now all of a sudden has to be flipped on its head, right?

And you have to do almost completely the opposite. Boy, I've experienced that over time. And so when you, when you start to see the cycle of change and how success drives even more change over time, you just, at some point, you just choose to embrace it. Then it needs to become part of your culture and part of the norm, just always pushing and always growing, always changing. The notion of growth and improvement, if you don't embed it in your culture, it will really catch you flat-footed.

There will be a moment in time where either through your own success or through success of a competitor, you've got to respond and change very, very quickly. And I find that if you don't have it in the DNA of the organization to do that on regular and consistent basis to go from homeostasis now to changing, right? I hate to say it, but a lot of times the critical path there is just the attitude of the people who resist it, right? Everything's been great, why do you want to change it? Well, we didn't change it, right?

You know, the market changed. Yeah, and if you don't have that culture of change, you're either gonna have to make some, some wholesale changes to move in a different direction do different things, or are you gonna be held back? That's the way the world works. Yep. So, so when you started, I think it was kind of a blank slate, but I think you probably had some goals of what you wanted Ping to achieve.

Do you feel at this point that you guys have achieved those goals? Obviously, you know, you're just talking about growing or dying. You still want to be growing, so maybe there have been some other goals, but do think that you've, you've gotten where you wanted to be?

I would say that your goals evolve.

I would say that some of the— many of the early goals of Ping probably have been achieved, but along the way, the understanding of what problems we're solving has become obviously more sophisticated with more knowledge about the space. And as a result, the goals became loftier along the way. And so I didn't have— if you went back in 2002, by the way, I found, I found one of my first business plans. It was at the bottom of a, bottom of a drawer with sriracha. All over it, right, that had tipped over.

And, and, you know, it's important— the Sriracha is important to keep in your drawer. But, you know, I was looking at, uh, you know, I was looking at the plan, say, what did I know back in April of 2002? And surprisingly, a lot, a lot was right back then. I mean, Ping is today kind of what I largely envisioned back at the time. But what I didn't know at the time is I hadn't connected identity with security.

They're two halves of the same coin. You do identity to get at better security. And I also didn't appreciate how hard some of the— what we would assume to be simple things are. For example, authenticating a user and keeping the user experience to minimal friction. Turns out that's really hard to do.

And enabling the right people to have access, just enough access at just the right time, right? Turns out that's really hard to do at scale. And so we're still chasing that. I actually do think we're going to achieve that in the next couple of years, and then we will build new goals. Yeah.

Yeah. So to achieve those, those goals, are there things you guys are working on specifically? Is it, you know, waiting on additional technology, you know, maybe outside of the ecosystem? How is it that you're going to get to those, those places that you just talked about? Well, who did I— I forget who I heard this from, but they they were describing that progress is all about— that the process of progress is all about removing speed bumps.

And there's a very Zen-like philosophy around this, and it's around the concept that the river wants to flow. All you have to do is identify the rocks that are keeping the river from flowing. Meaning the river is not a static state. Water wants to flow. You have to go find the impediments to it flowing.

In our particular case, you look at— if you look at what are the roadblocks to the things we are trying to achieve, a better authentication experience, real-time access control, there are a few big items that appear very, very quickly when you ask the right questions. From an authentication point of view, The breakthrough, I think, here was the mobile device. We were not carrying around essentially a supercomputer that was always connected and had lots of sensors embedded that could be used to authenticate us in a passive or invisible manner. We do now. Yep.

So I think that the vision is now achievable, but it would not have been achievable less the mobile phone. I mean, we weren't, we weren't going to achieve frictionless authentication with RSA one-time password tokens, right, on our keychain, right? Right. Lots and lots of friction there. It was nonlinear to turn that OTP device into an authentication device that would achieve what we want to achieve and make it economically feasible, right?

Maybe it was achievable, but not economically feasible. Economically feasible. So I think, you know, the big roadblock in that one has now emerged. The next one, when you get to real-time access control and you say, how do we, how do we control access today in identity world? Well, we assigned users to groups and we assigned resources to groups, and when the two match and you're provisioned in an account, you have access, and when you don't, you don't.

And we audit that and we generate reports on a periodic basis. That's a very static notion of access control. And we might write policies, or tens of thousands of policies actually, that try to get at who should have access to the right things.

It's still very manual today. So by— if you're an organization of 100,000 people, you have 10,000 groups, you know, and any number, order of magnitude write policies around who should have access to things at certain times. So you've got to overcome the scale and the manual issue, and I think the only way to do that is through intelligence. I think that we have to find ways in which both machine learning and AI over time can make our identity infrastructure more intelligent so that we can get at the real-time nature. And even when we do that, you know, as I'm discovering as we research this, there— we could have— we could design systems in such a way that simply makes it too expensive to make a decision every second whether or not you should get in or not, right?

Just flat out, even if it's doable, the compute is too expensive to look at all the variables at a moment in time and decide, should I let them in? We're going in reverse now, right? Everyone now needs a supercomputer, you know, in the basement so you can decide who gets access to stuff, right? And to take all known variables at a moment in time and make an intelligent decision around, do I grant access or not, isn't it, depending on how you approach it, a very expensive compute environment? And so maybe on high-value transactions you do it, but you wouldn't do it 1,000 times an hour for every individual.

Right? There's still a barrier in the approach that will keep us from getting at the solution. So anyway, I'm just highlighting when you, when you ask the right questions about where you're going, it becomes pretty evident what the roadblocks are, and then you can start to tackle those items. Yeah, one other barrier that I see, and it's maybe not— barrier is maybe not the right word, but, you know, we're seeing more and more emphasis on privacy.

So obviously GDPR is a big deal in the EU right now. In order to enable some of those advanced pieces of analytics, you're gonna have to start tracking every single thing that a person does. Is that something that you guys take into the equation as well? Either, I'm sure Robb specifically is thinking about how do you protect the data that you have, But there are obviously some privacy implications to getting additional data about people, and do you take it? What do you do with it?

How do you protect that? All that sort of thing. I guess you've maybe stumbled upon the next major observation I've had, which is obviously for every action there's an equal and opposite. Right. Right.

And so with all of these emerging technologies, that make this possible, there's also the opportunity for great abuse as well as great power. Yeah, positive, for sure. And, uh, and within the possibility of doing great things but also great abuse, regulation arises to kind of counteract what is naturally occurring. So you're right, there is a general trend which through regulation is attempting to counteract for the right reasons, I think, some of the things that we're observing as an encroachment on privacy. But when you think about the entire nature of a modern society, which is everything about our way of life only occurs because we agree to work together, ultimate privacy is go live in a cave.

Right. You have no need for identity. If you have no interaction, trust does not need to be bestowed and transactions don't have risk. But the truth is, our society, increasingly so, our productivity is so tethered to us interacting at higher and higher frequency and hopefully higher and higher levels of trust that the entire concept of privacy as we originally think of it begins to butt up against the reality of how do we squeeze more productivity and maintain security when users are everywhere, going everywhere, trying to access everything, trying to get their job done, right? And so, look, there'll be a healthy balance here at some point between these 2 constructs.

This is not a statement of my own personal belief, but maybe a statement of observation, that I do think when personal privacy meets group security in a society, group security wins. Because otherwise, yes, we wouldn't be— otherwise, we choose not to live in a modern society, right? We don't survive. We don't survive. Or we can't continue to have better and better lives, right?

We're improving productivity. Our lives are improving by leaps and bounds, certainly over the last couple hundred years. So I think that, you know, it needs to find the balance. There are counterforces to what is naturally now being enabled through technology. I think it's all healthy at the end of the day, but it certainly is making things more complicated.

Yeah, I mean, look what's happening with with the cloud. The cloud was you shouldn't care where it is, just go use a cloud service, right? Guess what? You shouldn't care unless it's in the EU, right? But I mean, things aren't like that.

They're spreading to other locations too. Now all of a sudden they care a lot. Data residency matters. It's like, so if you're gonna go store identity information, it's got to be physically stored in a data center in-country, or we can't use it, right? Yes, that it starts to limit the possibilities that we have.

It's making— it's counteracting some of the simplicity that was originally envisioned in the cloud, and it's fragmenting it and making it a lot more complicated. Yeah, again, yeah. Do you see government regulation being able to— I guess this is sort of a trick question— do you see government regulation being able to keep up with this sort of change? Obviously we haven't in the past.

Boy, that's a bigger question than I feel qualified, frankly, to answer. I mean, in some areas I think it's anticipating some of the problems and attempting, you know what I mean, to address it. In other areas, I think the unintended consequences are pretty significant. We're only beginning to understand the unintended consequences. Yeah.

Um, so I'm going to shift topics slightly. I was at the, uh, the CTA Apex Awards this year where you received a Lifetime Achievement Award. Uh, you're clearly not old enough to get a Lifetime Achievement Award yet, um, but, uh, but, you know, they gave you one nonetheless. Um, it was interesting that the story that you were telling, um, about your, your birthday present and some of the stuff that, that you had done. Um, I wonder sort of more on a personal note, what are some cool experiences that, that you have had, um, you know, individually?

I thought some of the ones you explained, um, as part of that story were cool. What's the coolest thing that, that you have done personally? Well, so So for the audience, I'll share it. So for my 50th birthday, my wife arranged with 2 of my boot camp instructors, friends but former SEALs, and 5 adventures. And so this was like, show up at these coordinates at this time with a wetsuit, and then you'll see what happens.

And it was the best gift ever for a person who likes to adventure and kind of appreciates the unknown and frankly likes to keep pushing myself. These were well outside of my comfort zone sort of experiences, you know, that had a certain element of danger. Yeah, the first one was floating down the North Platte River for 3 miles in nothing but a wetsuit down rapids. Yeah, you know, and trying to survive the rapids. I think that one certainly— I think those— I only made it through 4 of and then I had an injury, so I'm still— we're still going to do the 5th.

But the story I, I, I shared, which probably was one of the coolest, was, uh, was adventure number 3, was just climbing the Flatirons up here in Boulder, which it's not a super challenging climb, um, but I hadn't climbed in 20 years, and it's a 10-pitch ascent, and certainly there's plenty of places where you could get hurt, and I reminded of that when I arrived and there's a picture of a young boy who recently died on the cliff climbing without ropes. But I was at 700, I was like on pitch number 7, so I'm a good 700 feet up. And it was literally a perfect day, 65 degrees, not a cloud in the sky. I mean, beautiful, perfect. And very few people were on the rock because it was kind of late in the season.

But I remember looking around for a moment thinking, you know what, this could be the last time. I mean, I'm not a professional rock climber. Yeah. You know, and actually I'd never done a 10-pitch ascent before that's 700 feet. I said, this could be it.

This could be the moment where I'm now 700 feet up on a rock and it's beautiful. I'm here getting it done and I don't think I'm gonna die. And right at that moment, you know, I turned around, I looked, and I just kind of soaked it in for a moment and appreciated the moment that it was.

And I turn back around and start climbing and I hear some voices and it's literally very nonchalant, just people having a conversation about school and classes and other things. And I look to my left and there's 3 climbers in their 20s with no ropes and it's like they're walking in the park. They're climbing up to the left. But the interesting thing is not that they had no ropes, they had no clothes.

Like to prove a point, right? I can climb. I don't even need clothes, much less ropes to climb this rock. I'm not encumbered by anything. No, I'm just climbing the rock.

So, you know, it was quite a visual, as you would imagine, quite a moment in time where I said, isn't this like life where, you know, you think you're doing okay and then somebody passes you with no ropes and no clothes, right? Right. So, you know, there's some lessons lessons in there. That was a pretty cool experience. That sounds really cool.

Yeah, it sounds really cool. Um, so switching back, um, what are some things, uh, what, what's the future of identity? So you guys have made some great progress. We've talked about a few things. What's something that's, that's way out that, that nobody's even thought about yet?

Well, I think it's a little bit of an unknown to what extent the notion of distributed ledger and personal identity, what that intersection might look like in the future, where attributes that describe interactions with us get written into a public ledger and are verifiable. So from the personal identity point of view, instinct says there's something really deep and intriguing there, and it's still a question as to how it will emerge. But it could flip a lot of things on its head in a super interesting way. I think that the future of identity— I don't think you have to look any further than nearly every movie coming out of Hollywood.

Like, if you pay attention to what identity looks like and feels like in sci-fi movies, I think they probably largely get it right, which is everything is identified and the identification is kind of auto-magic. Nobody's doing much to authenticate. I mean, right, on occasion you'll see the Mission: Impossible, you put your hand on a pad, right? And they're you walk through something and it scans you, or it watches your gait, right? So Mission: Impossible probably gets the ones where they explicitly pull identity authentication out into its own thing.

I actually don't think it will be that way. I think it will be largely invisible. Will be recognized, not authenticated, is the way to describe it.

And then I think that, I think that, things that we see as walls or barriers will automagically open for the right people at the right times and not for the wrong people. And that, I think, there's a lot of friction right now in all of our doors, if that makes sense. Like, yeah, we authenticate to doors and then they open or they don't open.

So yeah, so I think it becomes becomes part of a fabric that over time the goal is you don't see, but is there. What do you think about identity of non-humans? So we've been talking all about personal identity here. So you mentioned when we were talking about Jabber, you're talking about Internet of Things. So obviously there's going to be a lot of devices that have identities.

We also talked a little about artificial intelligence. Theoretically, someday artificial intelligence could be considered real things as opposed to machine learning or whatever you want to call it today. Where do you see identity in that space? Well, again, you've tiptoed into an area I feel wholly unqualified to even remotely comment on, at least on the AI side of that conversation, but with respect to identity of things, I would say it like this: anything worth communicating with is worth having a secure identity. Yeah.

And so I think that— and if you look at it in terms of numbers, obviously the things will outnumber the people by factors, right? So, yeah, so we don't yet have a secure identity of things, I think it's really important that we do develop it because we will want to communicate with and control those things, and those things will be communicating with other things and issuing instructions to those things. And we absolutely have to make sure that those instructions are verified, they're not coming from rogue identities. So I think it's a, it's a huge problem and a huge opportunity to get right on the cusp of this. Awesome.

So we're coming up close to our time here. I wanted to see if there was anything additional that you wanted to share that we didn't talk about. Otherwise, I think I have one more question for you. I think the aha moment that identity and traditional security are really kind of two halves of the same coin, and an observation that there is a DNA or a mindset that tends to gravitate towards one or the other. But to recognizing— to recognize that we're siblings, so to speak, I think is really important.

So I'm really kind of on a mission to build awareness of identity within security practitioners and security awareness within identity practitioners, because we are getting at the same thing. How do we keep the things that we are looking to protect, secure, and how do we enable appropriate access at the right time? It turns out the approach is very different, but the end result and the goal is the same. Therein I think is huge opportunity for individuals cut from different cloths who see the same world through a different filter to start to see the world the same. If a security practitioner wanted to get that education, what would you recommend to them?

Boy, and that is a $64,000 question. The identity industry is starting to, I'd say, formalize education and training. There's one of those efforts, IDPro, is a new kind of organization, if you will, that's designed to build training and ultimately certification around identity, you know, identity best practice, if that makes sense. Yeah, but it's early in its formation. I mean, security industry has had this down for decades, right?

Yeah, cool. All right, so one final question. Obviously, this is a Colorado-based security podcast. You've been in the Colorado community for a long time. I'm sure you could have picked up paying and moved to Silicon Valley or something like that.

But what do you think is special about Colorado and the community for startups or security or whatever it might be, and why is it that you've, you've stayed here? I would have answered that differently 5 years ago than, than I'll answer it now. Inertia, I would say, you know, I was in Colorado when I started Ping and, and certainly have built my life life and committed to the Denver community.

That was in the beginning, right? I would say now I appreciate something about both Denver and, you know, in general, I'll just kind of say the Midwest, if that makes sense, that is hard to obtain. And I'll call it a healthy balance. It's so hard to to maintain a healthy balance. Yeah, nearly everything is driving us to extreme positions, one end or the other.

And, and I would say that healthy balance is kind of disappearing in a sense. Denver has it. Yeah, I think that's really, really special. I do try to keep that not geographically, because while Ping is Denver-based, we are a multinational company now with offices all over the place. And so we do have a lot of different cultures, and, and some in some big cities, right, that are absolutely the rat race.

I think staying grounded as we grow up and get older and become more successful. I think staying humble. I think staying balanced. All of those things I think are well represented in Denver as well. I think it's in the DNA of Denver.

I do think it's changing. It's changing as more people come to Denver, as Denver becomes a bigger city, as housing prices and cost of living increases. It puts more pressure on people to move to the extreme. We're seeing it. You're seeing it.

I mean, Denver, been here close to 20 years. It was kind of unchanged for 15, and then in the last 3 or 4, you can feel it changing, you know, in a good way, but it's different. Yes, definitely different. Yeah, you know, pluses and minuses, but I think overall in a good way. Yes.

Well, cool. We are out of time. Thank you, Andre. Appreciate your time. This has been Colorado equals security, and we'll talk to you next episode.

Thanks.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado equals security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time. Remember, Colorado equals security.