Panel | Best Practices to integrate AI in Identity Access

Thank you so much for being here today. We're happy to have you live in Munich, although you're not here in presence to begin. I'd love to do a quick round of introductions. And so if you could each give yeah. A brief idea of, you know, your role, how you're connected to AI and I am, and why you're sitting here on a panel today with me, that would be great. So let's begin with Tobias Unmute the microphone, the classical one. Thank you very much for having me here. My name is Tobias and currently I'm at CGI. A senior AI consultant. CGI is a kind of a hidden champion.

We are very huge around about 80,000 employees worldwide, but the most of the people didn't know us, don't know us and we are specialized in technical consulting. And my special area is artificial intelligence. And I have to admit, I really love this topic because sometimes it's so complex. We heard from the audience, it starts with the question, what is the AI? The other people say it's statistics. The other people know that already AI, but I'm really looking forward also to talk about this. The next one, I am also involved in the local group or regarding the German AI association.

And I'm leading this local group in Martin Berg. And the last thing I'm really excited about our open source project, it's called AI collaboration. And maybe we can talk about later on about this. Fantastic.

Thank you, Tobias. And then FA please, can you give us an introduction?

Thank you, Definitely. Hi everyone. And first of all, I would've loved to be physically here. I really tried, but coming from Switzerland, it is still the struggle. Our numbers are increasing again with COVID. So I felt that it would be some somehow insensitive to travel now to Germany. Some really, really, sorry. I know that it's always something else.

If, if, if, if I would have attended physically, so hopefully next time. So as I, as, as introduced, my name is I'm working for Microsoft. I'm a data and AI principle for the public sector. And I came rather from academic side into AI. I was heavily researching computer vision systems and also in the connection of privacy. And this is also how I came to this topic. So rather from the other side, other way around, right, how can we actually make those systems more privacy aware?

And you will see that this is actually in my opinion, very, very important also to consider for applications of access management and well more today. I don't wanna wanna spoil everything right now. Glad to be here.

However, looking forward to, to, to your questions as well. Yeah. Fantastic. So another big thank you that you both are here. So then just to, yeah.

Tobias, as you, as you rightly said, the definitions here are always very fluid. And so perhaps it's good that we establish our topic and why AI in, you know, all of its ambiguity, how AI and IAM are well suited for each other and where you see the future going here.

Yeah, sure. I can give you insight.

Yeah, please. But I have to go a step back before and really clarify, what does it mean AI and bot does it mean I am, for me, it's very important just to give a quick insights about my daily life. And most often for company I talk about in front of companies and also in these companies, they have a different meaning between this definition.

So in, I would recommend to have this definition clarified. For example, AI is automation of intelligent behavior and machine learning. That's normally my definition. We also have this in our company. The second definition is with IM that is to manage identities and also more important to, to regulate the user access.

And we, the future, I think we have a lot of possibilities in my daily life. We have huge amounts of use cases. For example, we can talk about later on of about detection. For example, always when we gather some data regarding the excess, which user access from which locations we can apply. Also some algorithm on algorithms on that, the most important thing is to choose the correct algorithm.

And for me, it's also very important that I don't implement AI so we can have AI the use case and the benefit should be on, on the first place, because if we can also make something with a decision tree or with simple rules, it's much better to use this instead of AI. Yeah. Thanks for that perspective and fabri, I guess first we should establish, do we agree on these definitions or do you have another version to offer? I think I, I would agree in general, like as to be said, right.

Especially I think with identity access management, I can definitely live with this definition when it comes to AI. There are so many different definitions out there.

So it's, it's, I think it's really hard to, to accept and position on one. I mean, even, even in, in academia. So I studied at the university of sunga with lots of different courses also at EPHS right. And these were some point of time they were professors in the exact same department and they will go with different AI definitions.

So it's, it's really hard to, to, to agree on one definition. I, I guess so I propose, we just go with Tobis definition for, yeah, That sounds good.

And then, you know, how, in your opinion, how do you think AI and I am are well suited for each other? Brilliant question. Thank you very much.

Well, I believe that AI is, can make identity, access management more effective and also more efficient in my opinion, depending on the use case, right? If you, if you, if you think again of this camera and where I'm, and it usually coming from is recognizing a lot of different people and mapping such a person to a single identity in a set of different images is probably not even possible at scale without using artificial intelligence. I would argue looking for other opinions as well, if, if someone would like to challenge that, but I feel quite hard about it.

And to me, it's, it's, it wouldn't be possible. However, now the question is, is artificial intelligence always the good choice?

And what, what I saw at Microsoft for, for lots of different companies is if I do not have a use case where I'm going to use this intelligent automation where I can actually not base my system on some, if else closes. So to say, then AI is usually a very good idea.

However, I've seen so much hype around this technology where we used an AI computer vision instance, for example, where the costs are just higher than the value delivered. So to me with actually any use case, right, that's not, that's not really specific to identity access management, but it's, it's, in my opinion, very important. The business case in the business value proposition of using artificial intelligence has to be clarified beforehand before actually arguing about the technology choice. It's much more important to have the business value clearly defined. Thank you for that.

And then jumping over to Tous. So you, as I understand, you're facing this question in your daily life as an AI consultant. And so how does the IAM question come up with your, with your clients or with your customers and how is AI impacting this for your customers?

Yeah, that's a good question. I have to a question I have to separate this on the, on the left side, there is this normal work. There's this configuration we have to ask before, are you using cloud? I IM or not something like this is normal configuration without AI, but we, on the, on the right side, we have also very exciting topics. For example, one client ask us, it is possible to use the voice and to identify the personality and not the, the person. And that is very interesting, not the case that this could happen. That is possible.

The, it is also very important to secure this because week later, this was very funny. A week later, I saw this article about how to clone our voice, for example, like hacking. And that is also very important. If you introduce a new feature, for example, you can, now you can identify with an AI on the, on the smartphone, for example, only with your, with your voice. It is also important to, to secure it by prevented that you, someone see your identity. Absolutely.

And the security question was of course, the, the subject of the panel, which was just here in the room before both of you came on stage and it's really, it's, it's sprawling in so many different directions, but of course, covering this idea that if you implement AI in your organization, how is that in particular secured? And so then that, that leads to a follow up question. Are you seeing particular areas of AI in relation to an IAM implementation that need particular attention on the security front Tobi you're taking a deep breath.

Does that mean you have an answer or shall I throw that to the brief? Yes. And the answer is most important every time you are dealing with first of all identities. And the second one is with, with data that is very private, for example, a bank account that you can, you can identify yourself with your, with your voice.

That is, that is very important. The other thing is for the questions for the question, when is AI really important or not?

I, I had this idea when we last year had this project on our cloud idea management identity management. And the question was how we can secure this. And the answer was not AI at all. This was simple automation and that was automation.

We, we had the script running and it will connect to the, to the API measure and ask, are the disc encrypted? Yes or no. And the situation before the, the client gave us acceler list round about 8,000 lines, and we had to check each line manually.

And that, that was not, not good and not the case. And in this case, it was not, was AI, not the answer. The answer was simple automation, but the goal was to secure regarding our, this 8,000 lines of very important security guidelines. Fantastic. And I think there was a nice bridge, what you said earlier about privacy to maybe what Fabre can weigh in on if I'm correct. Some of your academic career was really focusing on privacy. And so what, what connections do you see between this trifecta of AI, IAM and privacy? Yeah. Yeah. Thank you for your question.

May maybe I'll have to give a bit of background on actually my academic work that turned into a startup and is now being supported or really connected actually to Microsoft. So it's all connected in the end, but so what we tried to do in the academia world, but then eventually bridged to let's say the private economy is we wanted to understand if we can address privacy in camera systems from a hardware level.

So the question could be, how can we actually make sure people are not being identified and linked to a, to a unique identity component, such as a name or an address or as a financial bank statement as to be as said, right? And the, the reason why we wanted to address it from a hardware level is simply that there is a huge mistrust. So our biggest learning was probably that people just simply don't trust camera systems in general, due to misuse in the past, I can give you two very concrete examples.

For example, in Switzerland, there was a huge negative press when one of the leading retailers was found surveying the behavior of customers without informing the shoppers, right? So the people are just fundamentally suspicious when it comes to using such camera systems because you cannot well, a company can tell you, no, we are not going to process your data, but they still have the power to do so. And same thing happened with, with an insurance company, right?

They installed camera systems in the, in the cafeteria where they wanted to connect people who are eating all by themselves with some peers, right? So actually in principle, a really nice system that should boost the satisfaction of your employees.

But again, people were discouraged and the, it was a huge negative influence on the, in the CIO department because people were not being informed and what the data, where the data is going to be stored if they do have access to the data. And if they are in charge of managing the data points now with, when you give clients the explicit verification that they're not being surveyed, that they cannot be linked to a single identity. This make helps making them much more comfortable with such technologies. And we are seeing this with our startup time and time.

Again, as soon as you compare a camera system, that is not, let's say privacy aware, not from a hardware level where you can see, okay, no way that this camera system could identify myself. People are just much more comfortable in such environments where we set the cameras up and we interviewed hundreds of people around it and find the same answer time and time again, that it's simply you to mistrust in not only private companies, right? It's it's could be also about government.

And this mistrust is in my opinion, something that we have to explicitly tackle much, much more in such in such projects at the very beginning. And this comes also back to the, to the previous panel, right? Why this is important, this, this holistic approach to AI projects. So it's not about only security. It's not only about the business value. It's also about human factors. For example, whatever you try to design, you have to, you have to interview your users, the people that are being surveyed, potentially you have to get their feedback. You have to train them so that they feel involved.

And if you include your ordinance very early in such projects, this, this accelerates the trust in their, in your system that you are designing. And I think that is the most important lesson for AI in identity access management, please, please, please respect the human factors, involve them very early on. And I promise you, your project has much higher chances of being a win and being successful.

Yeah, thanks for that. And then at a, at a practical level, or I guess to, to back up for a moment, we often talk about wanting to democratize AI, especially for developments in, in business, use it so that you can have other stakeholders weighing in on a problem. So that hopefully outcomes are less biased.

There are, there's more respect for end users in perhaps different situations. So what you're saying here is bringing that democratization down to the users and involving them more directly. Yeah. Do you have any best practices or advice that you've seen from your own experiences on how to do that? Absolutely.

And it's, it's really great because some of you might think, oh, this guy is actually talking from a company perspective that hosts all our data, right? So how are you going to demo criticize our data points? And this is a challenge that Microsoft faced, not only Microsoft, but also Amazon and Google, of course, auto cloud providers sort to say.

And the, the movement that I see in the product development teams is that they start to make the cloud much more accessible, use much more encryption. And even though you host data in the data center of Microsoft that Microsoft or Amazon or Google that they do not have access directly to your data points. Right.

And I, I believe that this is not only a company decision in the future, even though it is because it's, there's such a high demand for that, especially in the banking sector, especially in the pharma sector where you're dealing with sensitive data. But I do believe that at some point compliance will also kick in and force the us, the big tech providers in, in keeping sensitive data to give it the access system to management control, to individuals or to the company that actually owns the data. Absolutely.

And then over to utopias, do you have any best practices that you've come across in your work and your work with clients that you'd like to share? Yeah, sure. Not all the situation of the companies are the same. So several for me is very important that I structure myself my own work. And I give you a quick insight what, how it looks like, how it looks like when I start and help a company to introduce AI. And first of all, for me, it's very important. What's the current status. For example, one company has already AI introduced a huge, a huge center of excellence.

And therefore it's very important that we are using these existing ideas, these existing ideas and use cases from the employees and help them to priorit prioritize them because the best ideas in my opinion, came from the employee employees directly and they know their daily job, they know how to optimize. And the only thing, sometimes they don't know what exactly AI is and what AI can do. And I help them given rough overview about the possibilities of AI, for example, what is machine learning? What is NLP, natural language processing, what is computer vision and how we can use them?

And that's the first one, if an existing setup. And the second one is if there is no, no, no AI except ideas. For example, we want to make AI. Then it's very important to clarify. When does it really make sense? And that's the main message for today for, for my side, please think about, does it really make sense to use AI and what is really your goal? Your it is not, it would be not so good is your, if your goal is we want to introduce AI because I just read the manager magazine or something like this very important is we want to, for example, increase the stability or increase the security.

And therefore we looking for, for example, security guidelines or a secure security, sorry, I had another thought that's much important. I will, I will, I will use this before explainable AI. That is also very important. I had this in this session before because explainable AI, it's also very important that as Fabre also told, if people involved in algorithms and this would be happened in future much more often, it is very important.

Why, for example, you can't get this bank credit or why you, I don't have any access to any systems and so forth. It's in my opinion, it's very important to, to have this explainable AI, for example, in a platform that everyone can access and have details about the algorithms I, the company will use. Absolutely. Yeah. Feris do you have any comments on that?

Or if not, I can throw in the last question. Well, maybe just one comment. Yeah. It's I do believe that that's, that sounds mine. There might be a little bit contr. Right. But I do believe also that there have been bad AI use cases in the past, you know, where AI doesn't really make sense, but there was still value in it. And what I'm referring to is rather, if you haven't dealt with AI in your organization at all, haven't built up any capabilities. I do believe that having a sandbox environment where you test the use case, even though it's not the best use case, just the low hanging fruit.

So to say there is value because costs, especially if you are using a cloud provider costs are really, really low for a, for a small proof of concept. So I do believe don't overthink as well. Right. Just get going as well and, and, and play around with the technology, because then you will ultimately also learn where it will be applicable and where it's rather less applicable. Yeah. And that's a great bridge to the, to the final question that I have in order to wrap up the session today is what are well, there's a caveat to that.

That, of course, every organization has a very unique situation and very different needs and also different data that they have available to them in order to support a project. But with that, are there really compelling use cases that you see for AI and IAM that are clear across the board? No questions asked. We have a volunteer to answer first.

I, yeah. I mean, I can, I can answer that. So maybe also in the context of particular use case right in the was really interesting to me as well, because it, it was actually for a bank, right. A retail bank that has physical offices still let's say, and, and for them obviously robbery, it was in a, in a developing country. So robbery was still an issue.

So bank robberies, and to them, it was actually important that you can use system that kind can pre-identify people before even entering the, the, the physical branch and flagging the person, if he has been suspicious, if there is a police record in the past, right. And such a system to me, I don't think it would be practical to use it without AI. If you have so many different data points and factors that you have to, to introduce, you need something at scale that can automate this intelligence to flag a person based on various factors. Right.

It doesn't, those all only have to be police records. So to say, and for such use cases, I do believe it is important to, to, to use AI. Yeah. Fantastic. And Tobias, what comments do you have?

Yeah, to be honest, I really like the use case you mentioned for, and you also mentioned before that it's really important that it goes hand in hand between AI and the human. And I highly recommend this, that there is no automation, for example, in this case, if someone enter the bank and AI accidentally reflect someone as a, as a, someone who want to steal something and, and prevent the entry of the, the, so you cannot enter for me, it's very important that the human can see, for example, a recommendation.

And based on this AI recommendation, the human can at the end, decide it is, is really case in this true positive, or it is not the case. And I, I can have also the last decision that I can also correct this prediction. Fantastic. Then a big, thank you to both of you. Unfortunately, you're not in the room with us, but I have, in my hand, the, the comments from both the virtual and the, the present audience, and it was really interesting. They loved it. So the comments are coming in. So a big thank you to both of you for being here today. Thank you. Thank you very much.

And hope to see you in the future. Yes. Thank you very much, Everyone. The next day I see is just around the corner. So we hope to see you there. Byebye Speaking forward, both your audience. Bye bye.