WEBVTT 00:00:00.000 --> 00:00:18.700 Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth. 00:00:18.700 --> 00:00:25.000 I'm an advisor and analyst with KuppingerCole Analysts. My guest today is the principal 00:00:25.400 --> 00:00:27.804 of KuppingerCole and one of the founders of 00:00:27.804 --> 00:00:30.600 KuppingerCole Analysts. Welcome, Martin Kuppinger. 00:00:30.600 --> 00:00:33.817 Hi. Welcome, Matthias. Pleasure to be back 00:00:33.817 --> 00:00:37.800 here. Great to have you back. And this is an episode 00:00:37.800 --> 00:00:40.745 around the topic of the identity fabric. Of 00:00:40.745 --> 00:00:44.100 course, we've mentioned that in earlier episodes, 00:00:44.100 --> 00:00:47.750 we are running up to the Identity Fabric Impact 00:00:47.750 --> 00:00:51.400 Day in September in Munich. But we want to talk 00:00:51.400 --> 00:00:54.988 about a different angle on the Identity Fabric. 00:00:54.988 --> 00:00:58.500 First of all, the Identity Fabric is something 00:00:58.500 --> 00:01:01.178 that is around for quite a while. It started as 00:01:01.178 --> 00:01:03.800 visualization to help people better understand 00:01:03.800 --> 00:01:07.841 things. But currently, it's not only a conceptual 00:01:07.841 --> 00:01:11.800 model. It has turned into a foundational toolkit 00:01:11.800 --> 00:01:15.123 for designing, implementing, and operating 00:01:15.123 --> 00:01:19.000 modern IAM. Can you talk a bit about the history, 00:01:19.800 --> 00:01:26.500 how the Identity Fabric came into being? Yeah. So, sure. We brought this concept up. 00:01:28.200 --> 00:01:35.400 I think it was around 2017, 2018 or so. So, really a couple of years ago. And 00:01:37.300 --> 00:01:42.400 basically, I think it started all with stepping back and asking a simple question, 00:01:43.400 --> 00:01:49.100 which was, what is the purpose of identity management or identity and access management? 00:01:49.800 --> 00:01:53.000 And the purpose of identity and access management, at the end of the day, is 00:01:53.700 --> 00:02:02.200 to provide seamless yet secured access to what someone or something needs for everyone, 00:02:02.200 --> 00:02:05.136 for everything. So, this is where it all 00:02:05.136 --> 00:02:09.100 started. So, which types of identities do we have? And 00:02:09.100 --> 00:02:12.547 when you look at the graphics of the Identity 00:02:12.547 --> 00:02:16.300 Fabric, left-hand side are all the identity types 00:02:16.300 --> 00:02:20.240 to the services and what is needed in between, so 00:02:20.240 --> 00:02:24.100 that everyone, everything, it's not just humans. 00:02:24.100 --> 00:02:26.440 We're, from the very beginning, sort of 00:02:26.440 --> 00:02:29.500 beyond humans, even while there was no term such as 00:02:29.500 --> 00:02:33.358 machine identity or non-human identity around, 00:02:33.358 --> 00:02:37.300 to all services. And identity management is the 00:02:37.300 --> 00:02:40.148 enabler for this access, for a controlled 00:02:40.148 --> 00:02:43.900 access. And that was the starting point. And then from 00:02:43.900 --> 00:02:47.950 there, we thought about, what does it need in 00:02:47.950 --> 00:02:52.000 there? How to come there? Also, in that time, 00:02:52.000 --> 00:02:58.600 I think what also was driving that entire thinking when I go back was, we saw consumer 00:02:58.600 --> 00:03:03.900 identity management emerging. We saw B2B identity management emerging and so on. 00:03:03.900 --> 00:03:07.152 And from the very beginning, I think, not only my, 00:03:07.152 --> 00:03:10.600 but also, for instance, you and others' perspectives, 00:03:11.300 --> 00:03:15.009 was, it doesn't make sense to have a separate 00:03:15.009 --> 00:03:18.800 identity management for every use case. So, we 00:03:18.800 --> 00:03:21.490 need to think about how can we, at least from 00:03:21.490 --> 00:03:24.300 a conceptual perspective, bring things together 00:03:25.000 --> 00:03:28.838 and look at what are sort of capabilities that are 00:03:28.838 --> 00:03:32.600 needed for multiple use cases that can be reused. 00:03:33.400 --> 00:03:39.400 So that the complexity of the implementation of the tools landscape at the end of the day 00:03:40.200 --> 00:03:46.500 at least can be kept under control, even when there are new use cases. So, this is where 00:03:47.000 --> 00:03:52.000 everything started. As of now, it is something that we, you and I, and then the team 00:03:53.000 --> 00:03:59.600 use in many initial workshops for just, yeah, for telling the story, for making 00:03:59.600 --> 00:04:07.400 our peers understand and get to the same wording when it comes to talking and thinking 00:04:07.400 --> 00:04:13.100 identity management from left to right by means of going through the block in the middle. 00:04:13.800 --> 00:04:17.800 This is something that we, there are lots of podcasts and videos around that. So, that has 00:04:17.800 --> 00:04:22.200 been explained and we use it every time. It's 00:04:22.200 --> 00:04:26.600 really a useful tool for laying a foundation. 00:04:26.700 --> 00:04:33.800 And it's a powerful tool with all, I would say, positive and challenging aspects. 00:04:33.800 --> 00:04:38.900 True. Talking about the challenges, just recently you published a blog post where you 00:04:39.400 --> 00:04:43.000 proposed a simplified, a leaner version of the 00:04:43.000 --> 00:04:46.600 identity fabric. Why? Why did you do that? Why 00:04:46.600 --> 00:04:52.400 do we need a leaner version? Is it target audience? Is it the message? Why do we need to, 00:04:53.100 --> 00:04:58.800 or why do you suggest this leaner version? So, I think what triggered this was basically 00:05:00.200 --> 00:05:03.120 work of our colleague, Jonathan Kerr, who started 00:05:03.120 --> 00:05:06.100 around the European Identity Conference working on 00:05:06.100 --> 00:05:09.133 identity security fabric. And he looked at 00:05:09.133 --> 00:05:12.600 our graphics and he came up with a much simpler, 00:05:12.600 --> 00:05:19.400 even simpler than that graphic. And that triggered me to go back to the very first 00:05:20.000 --> 00:05:25.800 incarnations of the identity fabric. And they were way, way simpler. 00:05:25.800 --> 00:05:27.951 And I think at the end of the day, the point 00:05:27.951 --> 00:05:30.200 is, it depends on the audience. If you want to 00:05:30.200 --> 00:05:36.600 at a high level explain the idea, you need a relatively simple model. If you want to dig 00:05:36.600 --> 00:05:39.272 deeper into a concrete project in a workshop, 00:05:39.272 --> 00:05:42.300 you need a more sophisticated, more detailed model. 00:05:43.100 --> 00:05:45.451 If you look into the future, and that was what I 00:05:45.451 --> 00:05:47.900 talked about at my opening keynote at the European 00:05:47.900 --> 00:05:51.689 Identity Conference in Berlin this year in May, I 00:05:51.689 --> 00:05:55.400 talked about the identity fabrics for the 2040s, 00:05:55.400 --> 00:06:02.200 which then again is a different perspective. So, the basic paradigm is always the same. 00:06:02.200 --> 00:06:14.100 Identity fabric as a paradigm, as a concept for creating a comprehensive view of identity 00:06:14.100 --> 00:06:20.900 management. Being both, and fabric in English has multiple meanings, and one is the mesh. 00:06:21.600 --> 00:06:24.781 So, it connects everything. So, orchestration, 00:06:24.781 --> 00:06:28.100 things like that come into play. And it's fabric 00:06:28.100 --> 00:06:34.600 as in factory production, delivering the services. So, this is the same for every version. 00:06:34.600 --> 00:06:37.624 But what I think is from, depending on with 00:06:37.624 --> 00:06:41.000 whom you talk, whom you explain this concept to, 00:06:41.000 --> 00:06:47.800 we need to fly at different levels above the ground. So, sometimes it's more than 00:06:47.800 --> 00:06:55.300 whatever 30,000 feet perspective, sometimes it's very close to the ground perspective. 00:06:55.300 --> 00:07:03.600 And that was why I said all the same, but we can sort of zoom in. And I think what we need 00:07:04.200 --> 00:07:10.500 again, like in the early days, is sort of the 30,000 feet. 00:07:10.500 --> 00:07:13.599 Right. And you're absolutely right. As I said, 00:07:13.599 --> 00:07:16.900 we use that quite often and quite heavily when it 00:07:16.900 --> 00:07:19.730 comes to workshops. But showing this picture, 00:07:19.730 --> 00:07:23.000 just as we are depicting it right now, this takes at 00:07:23.000 --> 00:07:26.800 least, say, 15 to 20 minutes, if you are really 00:07:26.800 --> 00:07:30.600 fast, to get people to understand it. And there 00:07:30.600 --> 00:07:33.227 is this, I don't like it, but there is this term 00:07:33.227 --> 00:07:35.800 of the elevator pitch. So, you have two minutes 00:07:35.800 --> 00:07:38.376 to explain something to somebody who's 00:07:38.376 --> 00:07:41.900 probably not that technical, who's probably not even 00:07:41.900 --> 00:07:47.800 interested in all the details that are depicted here. Then we need a different means for 00:07:47.800 --> 00:07:50.703 storytelling. Yeah. And I think the elevator 00:07:50.703 --> 00:07:54.200 pitch starts with, good elevator pitch with 30 words. 00:07:54.200 --> 00:08:01.800 The paradigm for a holistic identity and access management across all types of identities 00:08:02.700 --> 00:08:11.700 and all services, something like that. So, it is not easy to build such a picture, 00:08:11.700 --> 00:08:14.830 because as I said, it depends on whom you are 00:08:14.830 --> 00:08:18.100 talking to. And at the end of the day, the core 00:08:18.100 --> 00:08:21.023 things in that are, on the left-hand side, all 00:08:21.023 --> 00:08:24.200 types of identities, human and, call it non-human, 00:08:26.200 --> 00:08:32.100 all types of target systems. And we need to think from capabilities to services to tools. 00:08:32.600 --> 00:08:36.500 So, we need to start thinking about which capabilities we need, how do we group them 00:08:36.500 --> 00:08:43.900 into services, and finally, which tools are needed. And that must, at the bottom, connect 00:08:44.500 --> 00:08:51.900 to the legacy IAM and legacy applications via connectors. To the upper right, it must 00:08:53.000 --> 00:08:56.941 support and manage digital services in SAS, also 00:08:56.941 --> 00:09:00.800 via connectors, via standards. But to the upper 00:09:00.800 --> 00:09:04.700 left, it also must expose an identity API layer 00:09:04.700 --> 00:09:08.600 where digital services can consume the services 00:09:08.600 --> 00:09:14.600 of the identity fabric. That really becomes a factory of services where a service can ask 00:09:15.600 --> 00:09:19.240 whatever account to be created, a secret to be 00:09:19.240 --> 00:09:22.800 managed, access to be granted, or can consume 00:09:22.800 --> 00:09:26.710 information about potential anomalies. That's it. 00:09:26.710 --> 00:09:30.700 So, I think below two minutes, but above 30 words. 00:09:30.700 --> 00:09:34.102 But also, by removing, by reducing it to the 00:09:34.102 --> 00:09:38.200 core, it really allows this strategic view on things. 00:09:38.900 --> 00:09:41.564 Not being overwhelmed by detail, but really 00:09:41.564 --> 00:09:44.600 getting back to what you just said, the strategic 00:09:44.600 --> 00:09:48.250 view, high-level, simplified, but easily graspable 00:09:48.250 --> 00:09:51.900 for everybody who is even not a too much technical 00:09:51.900 --> 00:10:00.000 person to involve all decision-makers, stakeholders, and maybe also C-level, right? 00:10:01.000 --> 00:10:05.145 Yes, I think that's the point. It's a powerful 00:10:05.145 --> 00:10:09.200 concept that starts with a simple explanation 00:10:10.700 --> 00:10:16.800 and that could be describing what you need for seamless access of everyone, everything, 00:10:16.800 --> 00:10:24.500 to every service across capabilities, services, and tools to something that really becomes 00:10:25.200 --> 00:10:28.515 actionable in the sense of that we can use it in 00:10:28.515 --> 00:10:31.900 advisory to help organizations building their own 00:10:31.900 --> 00:10:34.882 incarnation of the identity fabric because the 00:10:34.882 --> 00:10:37.800 identity fabric is always somewhat different, 00:10:37.800 --> 00:10:41.700 depending on the legacy, depending on the identity type, depending on the applications, 00:10:41.700 --> 00:10:45.188 the maturity, and other aspects. What I really 00:10:45.188 --> 00:10:48.600 often try to make sure that people understand 00:10:48.600 --> 00:10:51.025 that this is not our secret sauce. Of course, we 00:10:51.025 --> 00:10:53.400 created it. Of course, we live it. We use it in 00:10:54.100 --> 00:10:56.374 every aspect of the work we do in identity, but 00:10:56.374 --> 00:10:58.600 this is something that is published. Your blog 00:10:58.600 --> 00:11:01.018 post is available right now on both pictures 00:11:01.018 --> 00:11:03.600 that I'm just showing here. They are available, 00:11:03.600 --> 00:11:06.734 and I've just talked to a prospective customer 00:11:06.734 --> 00:11:09.800 who said, yeah, we use that internally. I use 00:11:09.800 --> 00:11:12.967 that internally to tell the story to my team, to 00:11:12.967 --> 00:11:16.200 my management, that there's a reason behind that. 00:11:16.200 --> 00:11:19.826 There is this fabric, and we need to provide 00:11:19.826 --> 00:11:23.700 dynamic, agile services within an IAM portfolio 00:11:23.700 --> 00:11:26.492 rather than maintaining a silo. This is 00:11:26.492 --> 00:11:30.500 something that everybody can take away from this podcast 00:11:30.500 --> 00:11:33.150 episode, from our website, to say, okay, even 00:11:33.150 --> 00:11:35.800 if I don't talk a word to KupingerCore, I can 00:11:35.800 --> 00:11:38.431 use this for storytelling. I think that is 00:11:38.431 --> 00:11:41.500 also the beauty because then people talk the same 00:11:41.500 --> 00:11:48.600 language. It's interesting to see how many organizations build on this concept. I see 00:11:49.300 --> 00:11:55.800 really quite a lot that say, okay, I use this. I use this in SlideX when I present to the 00:11:55.800 --> 00:12:01.800 management, when I work with the team. It has achieved really widespread recognition and 00:12:01.800 --> 00:12:04.627 adoption, which is a good thing. Absolutely. I 00:12:04.627 --> 00:12:07.700 just talked to our colleague Alejandro about that, 00:12:07.700 --> 00:12:10.920 and he said, not even, vendors, especially 00:12:10.920 --> 00:12:14.600 vendors, pick up on that because they can easily 00:12:15.400 --> 00:12:20.100 show on that picture where they are, what is their capability set that they are providing, 00:12:20.100 --> 00:12:23.800 what are the services that they are providing, and what is their tool to the right, 00:12:24.700 --> 00:12:31.300 to say, okay, we fit into that. We know where we are, where we are a piece of that puzzle 00:12:31.900 --> 00:12:36.200 and provide services within the overall framework. I think that's really helpful. 00:12:37.000 --> 00:12:40.221 We highly encourage everybody just to pick up 00:12:40.221 --> 00:12:43.800 that model. You can talk to us. You don't have to, 00:12:43.800 --> 00:12:49.000 but we're happy if you talk to us. If you visit us at Identity Fabric Impact Day, 00:12:49.000 --> 00:12:52.234 we encourage you to come there in Munich just to 00:12:52.234 --> 00:12:55.400 talk about the application, about the real-life 00:12:55.400 --> 00:12:58.664 operationalization of this thing. If you need 00:12:58.664 --> 00:13:02.000 to convey the message then to your management, 00:13:02.000 --> 00:13:04.908 to people who are usually limited in time, 00:13:04.908 --> 00:13:08.300 take the leaner version. I will try that as well, 00:13:08.300 --> 00:13:14.100 so it's one more arrow in the basket that we can use to convey the message. 00:13:15.200 --> 00:13:17.785 Thank you, Martin, for explaining that to us. 00:13:17.785 --> 00:13:20.600 Any final word when it comes to simplifying that? 00:13:20.600 --> 00:13:23.500 Is it just simplifying or is it just reducing to the core? 00:13:23.500 --> 00:13:30.100 I think it's just another way of illustrating it so that a story can be easier told across 00:13:31.000 --> 00:13:35.245 several steps. I think it helps also developing 00:13:35.245 --> 00:13:39.400 the story and then going even further into the 00:13:39.400 --> 00:13:44.400 reference architecture. We have the advisory note on Identity Fabric and that reference 00:13:44.400 --> 00:13:52.700 architecture goes very deep into it. I think that is where it helps. I think it's just an 00:13:52.700 --> 00:13:57.200 easier entry to a complex scene. You've mentioned that there are other versions, 00:13:57.200 --> 00:14:01.400 especially these forward-looking versions of the Identity Fabric. You've mentioned that 00:14:01.400 --> 00:14:07.800 regarding your opening keynote for EIC. An Identity Fabric for the 2040s, which seems far 00:14:07.800 --> 00:14:10.482 away, but it is not. This is something that 00:14:10.482 --> 00:14:13.600 people can also look into. Just catch up with your 00:14:14.200 --> 00:14:19.400 opening keynote and there's more about that also in your blog post. I highly recommend 00:14:19.400 --> 00:14:22.400 for everybody who finds this interesting to just 00:14:22.400 --> 00:14:25.400 jump over to our website. Blog posts, of course, 00:14:25.400 --> 00:14:28.113 are not somewhere hidden, but you just can find 00:14:28.113 --> 00:14:31.000 them easily. I think we will link them in the show 00:14:31.000 --> 00:14:34.068 notes for this episode as well and then continue 00:14:34.068 --> 00:14:37.200 your journey into the Identity Fabric from there. 00:14:37.200 --> 00:14:41.000 Thank you very much, Martin, for being my guest today. Questions, of course, always 00:14:41.000 --> 00:14:47.000 askable in the comment section of this video or just reach out to me or to Martin. 00:14:47.000 --> 00:14:50.200 We are happy to answer. Thank you, Martin, for being my guest today.