WEBVTT 00:00:00.000 --> 00:00:16.500 Welcome to the KuppingerCole Analysts Chat. 00:00:16.500 --> 00:00:17.500 I'm your host. 00:00:17.500 --> 00:00:18.500 My name is Matthias Reinwarth. 00:00:18.500 --> 00:00:22.700 I'm an analyst and advisor at KuppingerCole Analysts. 00:00:22.700 --> 00:00:24.800 My guest today is Warwick Ashford. 00:00:24.800 --> 00:00:27.703 He is a senior analyst working with all 00:00:27.703 --> 00:00:31.500 things identity and access and much more out of the 00:00:31.500 --> 00:00:32.500 UK. 00:00:32.500 --> 00:00:33.500 Hi, Warwick. 00:00:33.500 --> 00:00:34.500 Good to see you. 00:00:34.500 --> 00:00:35.500 I'm Matthias. 00:00:35.500 --> 00:00:36.500 Good to be here. 00:00:36.500 --> 00:00:37.500 Great to have you. 00:00:37.500 --> 00:00:40.800 And the starting point is some research that you just published. 00:00:40.800 --> 00:00:47.100 And it's a topic that is interwoven in many things that we currently do at KuppingerCole. 00:00:47.100 --> 00:00:51.300 We are adding new identity types to our identity fabric. 00:00:51.300 --> 00:00:56.800 We are looking at different life cycles of these identities, be they non-human, be they 00:00:56.800 --> 00:00:57.800 human. 00:00:57.800 --> 00:01:06.100 And your topic was third-party and third-party access to systems within organizations. 00:01:06.100 --> 00:01:11.500 First of all, maybe before we start, how would you define third-party access? 00:01:11.500 --> 00:01:12.500 What is that actually? 00:01:12.500 --> 00:01:17.500 Simply stated, third-party access, and in this case governance, it was third-party access 00:01:17.500 --> 00:01:19.300 governance that I was looking at. 00:01:19.300 --> 00:01:22.912 It means that you're controlling and monitoring 00:01:22.912 --> 00:01:26.600 what external users like contractors, suppliers, 00:01:26.600 --> 00:01:30.300 or partners can access inside your organization systems. 00:01:30.300 --> 00:01:32.689 So when you let someone from the outside of 00:01:32.689 --> 00:01:35.300 your organization into your network or systems, 00:01:35.300 --> 00:01:39.200 even if it's just for a short time, you need to know who they are, you need to be able 00:01:39.200 --> 00:01:42.284 to limit what they can do, you need to monitor 00:01:42.284 --> 00:01:45.300 what they're doing, and you need to make sure 00:01:45.300 --> 00:01:48.500 that you remove their access when it's no longer needed. 00:01:48.500 --> 00:01:53.300 So that's exactly what third-party access governance helps with. 00:01:53.300 --> 00:01:58.100 And I think it's important in the context of identity-centric security, because this 00:01:58.100 --> 00:02:03.900 focuses on protecting systems by managing and securing digital identities, not just 00:02:03.900 --> 00:02:06.500 networks or devices. 00:02:06.500 --> 00:02:08.777 So in this model, the biggest risk is 00:02:08.777 --> 00:02:12.100 unauthorized or excessive access by anyone, especially 00:02:12.100 --> 00:02:13.600 outsiders. 00:02:13.600 --> 00:02:18.000 So third-party users are often the weakest link because they don't work for you. 00:02:18.000 --> 00:02:19.600 You can't fully control them. 00:02:19.600 --> 00:02:22.936 They might use shared or reused credentials, 00:02:22.936 --> 00:02:26.500 or they might need temporary or limited access, 00:02:26.500 --> 00:02:27.900 but they get too much. 00:02:27.900 --> 00:02:33.200 So without proper governance, third parties can accidentally or intentionally cause data 00:02:33.200 --> 00:02:36.800 breaches, ransomware infections, or some system disruptions. 00:02:36.800 --> 00:02:37.800 Right. 00:02:37.800 --> 00:02:40.100 And you've already mentioned it partially. 00:02:40.100 --> 00:02:46.300 So they are under different lifecycle processes because you inherit them from somewhere. 00:02:46.300 --> 00:02:50.400 But you said you wrote about third-party access governance. 00:02:50.400 --> 00:02:55.000 So that means that these are different types of systems. 00:02:55.000 --> 00:02:59.200 And how do they differ from internal identity governance? 00:02:59.200 --> 00:03:05.000 Well, I think they're different to internal identity governance because internal IAM is 00:03:05.000 --> 00:03:12.800 designed around HR-driven workflows and user lifecycle events like JML processes, right? 00:03:12.800 --> 00:03:18.700 And also third-party access lacks these triggers and oversights mechanisms. 00:03:18.700 --> 00:03:24.500 External users are often onboarded manually via unstructured sort of means and processes 00:03:24.500 --> 00:03:28.300 like from spreadsheets or email invitations. 00:03:28.300 --> 00:03:34.300 And then that means that governance practices such as recertification, policy enforcement, 00:03:34.300 --> 00:03:40.100 audit logging, which are standard for internal identities are typically absent or sort of 00:03:40.100 --> 00:03:42.600 fragmented for third-party users. 00:03:42.600 --> 00:03:44.900 The question often is also, why? 00:03:44.900 --> 00:03:47.500 Why are we talking about that now? 00:03:47.500 --> 00:03:52.900 Have things changed that people, that organizations are more involving third parties? 00:03:52.900 --> 00:03:55.600 Is this kind of changing supply chain? 00:03:55.600 --> 00:03:56.600 What is behind that? 00:03:56.600 --> 00:03:58.639 Well, I just think in today's kind of 00:03:58.639 --> 00:04:02.000 hyper-connected world, organizations are kind of dealing more 00:04:02.000 --> 00:04:04.200 with external organizations. 00:04:04.200 --> 00:04:08.800 And so I think the biggest problem is that in many organizations, third-party identities 00:04:08.800 --> 00:04:11.289 are now often outnumber internal users, 00:04:11.289 --> 00:04:14.800 particularly in industries that rely on things like, as 00:04:14.800 --> 00:04:19.300 you mentioned, supply chains, outsourced development or services. 00:04:19.300 --> 00:04:21.935 And these external entities frequently gain 00:04:21.935 --> 00:04:25.000 access to sensitive systems without the consistent 00:04:25.000 --> 00:04:30.600 processes as I mentioned earlier for onboarding, identity proofing, and certification. 00:04:30.600 --> 00:04:36.600 So this inconsistency results in stale credentials, excessive entitlements. 00:04:36.600 --> 00:04:40.900 I think that's one of the big problems is people get too much access to too much. 00:04:40.900 --> 00:04:47.300 And then this creates like invisible access pathways, creating an expanded attack surface 00:04:47.300 --> 00:04:52.300 that's often exploited in breaches because the bad guys know this. 00:04:52.300 --> 00:04:56.200 And they know that people aren't paying much attention. 00:04:56.200 --> 00:04:58.600 That's where they go to work. 00:04:58.600 --> 00:04:59.600 Right. 00:04:59.600 --> 00:05:02.233 And when I look at customers or organizations 00:05:02.233 --> 00:05:05.100 in general, we are talking to many organizations. 00:05:05.100 --> 00:05:11.300 I will not give any names, of course, but often external users are just maintained within 00:05:11.300 --> 00:05:14.600 the regular IAM for purposes. 00:05:14.600 --> 00:05:18.700 For example, if I maintain them myself, I have a better control, which I would disagree 00:05:18.700 --> 00:05:19.700 with. 00:05:19.700 --> 00:05:22.298 But when it comes to the architectural 00:05:22.298 --> 00:05:26.400 limitations, do traditional IAM systems limit the management 00:05:26.400 --> 00:05:28.400 of third-party users? 00:05:29.000 --> 00:05:32.437 Well, as I mentioned already, most IAM systems 00:05:32.437 --> 00:05:35.800 are designed for employees and known partners 00:05:35.800 --> 00:05:41.400 within the organizational boundary, within the controls. 00:05:41.400 --> 00:05:46.000 So there's a lack of organizational identity structures. 00:05:46.000 --> 00:05:52.900 So traditional IAM systems operate on a flat identity model and they don't support N-tier 00:05:52.900 --> 00:05:55.200 ecosystems. 00:05:55.200 --> 00:05:56.900 And there's limited delegation. 00:05:56.900 --> 00:06:01.800 They fail to provide mechanisms for delegated governance, which is essential for managing 00:06:01.800 --> 00:06:05.300 access across external organizations. 00:06:05.300 --> 00:06:08.000 Also traditional IAM, the identity proofing and 00:06:08.000 --> 00:06:10.700 onboarding, they rely on a sort of a structured 00:06:10.700 --> 00:06:14.800 thing, whereas I mentioned earlier, the third party, it's unstructured. 00:06:14.800 --> 00:06:17.800 And so this creates a credential sprawl. 00:06:17.800 --> 00:06:19.900 Also there's infrequent certification. 00:06:19.900 --> 00:06:23.200 So these systems rely on a kind of a point in time reviews. 00:06:23.200 --> 00:06:26.800 And so they miss the access changes that happen in between. 00:06:26.800 --> 00:06:32.300 And finally, they lack cross-organizational P-back and R-back policy enforcement. 00:06:32.300 --> 00:06:35.400 So this again leads to over-permissive access. 00:06:35.400 --> 00:06:36.400 Right. 00:06:36.400 --> 00:06:41.500 I've mentioned that in the beginnings, we are thinking where we love to think of identity 00:06:41.500 --> 00:06:46.400 systems as being constructed following the concept of the identity fabric. 00:06:46.400 --> 00:06:48.923 And our colleague Jonathan Kerr was here a few 00:06:48.923 --> 00:06:51.500 weeks ago and he talked about the cybersecurity 00:06:51.500 --> 00:06:52.500 fabric. 00:06:52.500 --> 00:06:57.100 How can these models be beneficial to support third party access governance? 00:06:57.100 --> 00:06:58.100 Do they help? 00:06:58.100 --> 00:06:59.800 Do they allow for integration? 00:06:59.800 --> 00:07:00.800 Well, absolutely. 00:07:00.800 --> 00:07:04.700 But I think in this bit of research that I did, one of the interesting things that came 00:07:04.700 --> 00:07:09.600 out for me was that in a way, third party access governance, I think should be thought 00:07:09.600 --> 00:07:13.300 of in terms of being an evolution of the identity and security fabric. 00:07:13.300 --> 00:07:14.700 So it's the same idea. 00:07:14.700 --> 00:07:17.100 It's just going beyond by recognizing. 00:07:17.100 --> 00:07:22.400 So the identity fabric must, if you look at the identity fabric, it must evolve from 00:07:22.400 --> 00:07:27.400 a user-centric approach to an organizational aware model. 00:07:27.400 --> 00:07:31.900 So it's not just about user, but talking about a wider organization. 00:07:31.900 --> 00:07:34.350 And it needs to include third party 00:07:34.350 --> 00:07:38.200 onboarding, delegated approvals, policy inheritance and 00:07:38.200 --> 00:07:40.300 lifecycle orchestration. 00:07:40.300 --> 00:07:42.918 And it also must accommodate federated 00:07:42.918 --> 00:07:46.500 identity sources and manage access across multi-tier 00:07:46.500 --> 00:07:48.300 partner ecosystems. 00:07:48.300 --> 00:07:49.900 So that's the identity side of things. 00:07:49.900 --> 00:07:53.512 And then the security fabric needs to integrate 00:07:53.512 --> 00:07:57.200 with the identity fabric to provide cross-tenant 00:07:57.200 --> 00:08:01.900 logging sort of behavioral analytics and policy enforcement. 00:08:01.900 --> 00:08:06.900 So they should be able to detect analogous behavior and trace access violations across 00:08:06.900 --> 00:08:10.500 external systems rather than just internally. 00:08:10.500 --> 00:08:15.900 So think of third party access governance as governance overlay. 00:08:15.900 --> 00:08:21.800 It acts as a dedicated governance layer, so to speak, that bridges the gaps between 00:08:21.800 --> 00:08:23.000 both fabrics. 00:08:23.000 --> 00:08:26.437 So it bridges the security and identity fabrics 00:08:26.437 --> 00:08:29.800 and it provides capabilities like event-driven 00:08:29.800 --> 00:08:34.700 certification, delegated governance and risk-based access controls. 00:08:34.700 --> 00:08:39.600 So that enables visibility and governance beyond the enterprise. 00:08:39.600 --> 00:08:44.100 So I think that's just the best way to think of it is being able to see and govern what's 00:08:44.200 --> 00:08:49.100 going on beyond your enterprise, which is increasingly important because more and more 00:08:49.100 --> 00:08:54.300 now, I've been doing quite a bit around third party access failures. 00:08:54.300 --> 00:09:00.100 And I was surprised just how many breaches in recent times and going back the last 10 00:09:00.100 --> 00:09:03.500 years, where it's traced back to a third party. 00:09:03.500 --> 00:09:06.400 And so I just think this has never been more important. 00:09:06.400 --> 00:09:08.100 But we say that about most things, really. 00:09:08.100 --> 00:09:09.100 Exactly. 00:09:09.100 --> 00:09:14.100 And just everything what you said, if I think one year back, so we were discussing 00:09:14.100 --> 00:09:19.800 with many organizations and the dust has settled a bit, but the problem is not yet solved. 00:09:19.800 --> 00:09:24.300 Many organizations were talking about upcoming regulatory frameworks like DORA for finance 00:09:24.300 --> 00:09:30.500 or NIST for critical infrastructures, while the scope was immensely growing. 00:09:30.500 --> 00:09:35.100 I think everything that you said is part of these regulations. 00:09:35.100 --> 00:09:40.100 So having a proper control insight into what third parties, what your supply chain does 00:09:40.300 --> 00:09:44.900 within your systems is as important as what your own employees do. 00:09:44.900 --> 00:09:49.700 So is this a driver and does that shape the need for third party access governance and 00:09:49.700 --> 00:09:51.900 make you write this thing at least partially? 00:09:51.900 --> 00:09:52.900 Yeah, sure. 00:09:52.900 --> 00:09:58.900 Look, I think regulation is a very important driver, but even it's a good indicator of 00:09:58.900 --> 00:10:01.500 what should be the best practice, really. 00:10:01.500 --> 00:10:06.900 So what's great about the regulations that you mentioned is that they recognize that 00:10:06.900 --> 00:10:09.500 third party access is a board level risk. 00:10:09.500 --> 00:10:12.500 It's not just a technical detail that must be taken care of. 00:10:12.500 --> 00:10:18.100 This is something that can, so if you speak to the board of maybe Marks and Spencers, 00:10:18.100 --> 00:10:22.000 they might agree that third party risk is something that they will pay a little bit 00:10:22.000 --> 00:10:27.900 more attention to now that they are having to spend a couple of hundred million to recover 00:10:27.900 --> 00:10:34.100 from something that at the moment still looks like it was traced back to bad third party 00:10:34.100 --> 00:10:35.100 access. 00:10:35.100 --> 00:10:40.900 Specifically, DORA mandates that financial institutions govern the entire life cycle 00:10:40.900 --> 00:10:43.700 of third party ICT providers. 00:10:43.700 --> 00:10:46.300 So that includes continuous certification. 00:10:46.300 --> 00:10:52.700 This too requires identity centric security for all access relationships across critical 00:10:52.700 --> 00:10:54.300 infrastructure. 00:10:54.300 --> 00:10:56.757 And then the CMMC enforces identity 00:10:56.757 --> 00:11:00.900 verification, MFA and authorization life cycle for entities 00:11:00.900 --> 00:11:04.000 within the US defense supply chain. 00:11:04.000 --> 00:11:08.300 But more importantly, I think all the shared expectations across these frameworks, and 00:11:08.300 --> 00:11:10.416 I think this is what the end user 00:11:10.416 --> 00:11:14.200 organizations need to imbibe, is that identity verification 00:11:14.200 --> 00:11:16.700 for third parties is important. 00:11:16.700 --> 00:11:22.000 Strong authentication and continuous access certification is important. 00:11:22.000 --> 00:11:27.400 Policy based governance is tied to business relationships and risk levels. 00:11:27.400 --> 00:11:32.000 And finally, auditability and accountability for external user access. 00:11:32.000 --> 00:11:38.900 I think the days where boards or organizations are responsible only for the people within 00:11:38.900 --> 00:11:41.937 the walls, so to speak, of their organization or 00:11:41.937 --> 00:11:45.100 within, even if it's a multinational organization, 00:11:45.100 --> 00:11:48.100 it used to be sort of clearly defined. 00:11:48.100 --> 00:11:53.100 Back in the day too, in terms of when we had perimeter controls, the perimeter was ours 00:11:53.100 --> 00:11:55.900 and anything beyond that wasn't our problem. 00:11:55.900 --> 00:12:00.200 Things have changed and we've been talking about it for years, but businesses still seem 00:12:00.200 --> 00:12:02.800 to be struggling to implement this. 00:12:02.800 --> 00:12:08.400 I think we've understood it for a while and we've been talking about it for a long time, 00:12:08.400 --> 00:12:14.500 but I'm still seeing organizations where they just aren't doing things in a practical way 00:12:14.500 --> 00:12:17.500 to say, yes, we understand this, we get it. 00:12:17.500 --> 00:12:18.500 Okay. 00:12:18.500 --> 00:12:21.500 Let's assume that everybody who's listening right now understands that. 00:12:21.500 --> 00:12:23.754 They understand what you've mentioned, credential 00:12:23.754 --> 00:12:26.100 sprawl, entitlement drift, unstructured onboarding. 00:12:26.100 --> 00:12:32.200 What are some typical capabilities within these third-party access governance solutions 00:12:32.200 --> 00:12:36.000 that help organizations in actually addressing these risks? 00:12:36.000 --> 00:12:37.700 How do these solutions look like? 00:12:37.700 --> 00:12:45.200 Well, you mentioned credential sprawl, so a TPAG could enable an organization to, well, 00:12:45.200 --> 00:12:50.100 it kind of requires an organization to enforce phishing-resistant authentication. 00:12:50.700 --> 00:12:54.257 The push towards pass keys and use of FIDO-2 00:12:54.257 --> 00:12:58.300 compliant tools and methods, because it eliminates 00:12:58.300 --> 00:13:03.500 reliance on shared credentials and email-based invitations. 00:13:03.500 --> 00:13:08.300 I think that's the first thing in terms of credential sprawl. 00:13:08.300 --> 00:13:10.981 Then it also helps control entitlement drift, 00:13:10.981 --> 00:13:13.900 which as you know, and in your advisory business, 00:13:13.900 --> 00:13:16.251 this is a perennial problem with many 00:13:16.251 --> 00:13:20.000 organizations where people change roles and the entitlement 00:13:20.400 --> 00:13:22.400 just don't get updated. 00:13:23.700 --> 00:13:31.700 With TPAG, it's event-driven recertification, so it's triggered by status changes and it's 00:13:31.700 --> 00:13:38.100 linked to risk signals, so it automates, it ensures things like automated deprovisioning, 00:13:38.100 --> 00:13:40.300 so where access is no longer justified. 00:13:40.300 --> 00:13:44.300 If you change role, you leave organization, project ends, your access ends. 00:13:44.600 --> 00:13:46.600 It's no longer this kind of thing. 00:13:47.500 --> 00:13:53.300 It introduces the idea of structured onboarding for people beyond the organization, so it 00:13:53.300 --> 00:13:59.700 enables multi-tier onboarding, invalidating both users and their organizations. 00:13:59.700 --> 00:14:05.900 It incorporates identity proofing, document and biometric verification, and then also 00:14:05.900 --> 00:14:07.700 has delegated workflows. 00:14:08.500 --> 00:14:13.400 It also applies policy inheritance that I mentioned earlier to ensure that there is 00:14:13.400 --> 00:14:17.300 consistent enforcement across external organizations. 00:14:17.300 --> 00:14:23.000 These capabilities all ensure that external access reflects the current business context 00:14:23.000 --> 00:14:25.000 and not sort of outdated assumptions. 00:14:25.000 --> 00:14:30.700 It kind of helps the organizations keep pace with the reality that's out there rather than 00:14:30.700 --> 00:14:32.000 just a point in time. 00:14:32.000 --> 00:14:32.700 Right. 00:14:32.700 --> 00:14:34.100 That's really fascinating. 00:14:34.100 --> 00:14:38.500 I already come to my famous final question, as usual. 00:14:38.600 --> 00:14:44.500 If we think we are also here to educate and to raise awareness, if there are organizations 00:14:44.500 --> 00:14:51.700 out there who realize there is a gap in my security posture, in my identity fabric, I 00:14:51.700 --> 00:14:53.854 have not yet really thought of this 00:14:53.854 --> 00:14:57.300 third-party access because I'm not critical, because I'm 00:14:57.300 --> 00:15:01.000 not a financial institution, but I think I should do that. 00:15:01.000 --> 00:15:06.500 Before running and buying something, a solution, what would be – and that's the question, 00:15:06.500 --> 00:15:11.900 this famous last question – what would be a good first starting point to embark on that 00:15:11.900 --> 00:15:13.700 journey beyond tools? 00:15:13.700 --> 00:15:18.600 I think there are quite a number of things that organizations need to consider, but I 00:15:18.600 --> 00:15:24.500 think the most important thing is to treat third-party access as a governance domain, 00:15:24.500 --> 00:15:27.300 not sort of just an integration task. 00:15:27.300 --> 00:15:32.500 As we said earlier, third-party identities outnumber internal ones in many environments, 00:15:32.500 --> 00:15:35.200 and they often present a higher risk. 00:15:35.200 --> 00:15:40.900 I think it's just kind of that mindset change that I was talking about earlier is that you 00:15:40.900 --> 00:15:43.300 need to think beyond the organization. 00:15:44.500 --> 00:15:49.800 Managing access cannot be limited to provisioning accounts or federating logins. 00:15:49.800 --> 00:15:53.116 Governance must include onboarding assurance, 00:15:53.116 --> 00:15:56.800 delegated administration, lifecycle orchestration, 00:15:56.800 --> 00:15:59.200 and continuous certification. 00:15:59.200 --> 00:16:01.800 Just like in the cybersecurity world, there's 00:16:01.800 --> 00:16:04.400 got to be continuous verification that people 00:16:05.300 --> 00:16:09.000 that things are who they are and that things are being checked all the time. 00:16:09.000 --> 00:16:14.900 Actors or entities that are doing things need to be continually certified, and then extend 00:16:14.900 --> 00:16:20.100 your identity and your security fabric architectures with TAP capabilities, which we've 00:16:20.100 --> 00:16:20.900 been talking about. 00:16:20.900 --> 00:16:26.500 So really interesting, and it adds another facet to this identity fabric that we are 00:16:26.500 --> 00:16:33.000 talking about, adding these B2B customers, these – no, not customers, partners, everything 00:16:33.000 --> 00:16:38.000 that is outside organization and that need access to our internal systems, to our cloud 00:16:38.000 --> 00:16:39.100 access, whatever. 00:16:39.100 --> 00:16:40.500 So really interesting. 00:16:40.500 --> 00:16:46.700 Thank you very much, Warwick, for being here today, for telling really freshly from your 00:16:46.700 --> 00:16:49.200 just recent research around that topic. 00:16:50.000 --> 00:16:53.100 If people are interested, that paper is also available. 00:16:53.100 --> 00:16:54.800 We have Warwick's name. 00:16:54.800 --> 00:16:59.300 Just Google for him within our system and just try to find him. 00:16:59.300 --> 00:17:04.900 And there is lots of information around these topics and many other where Warwick provides 00:17:04.900 --> 00:17:08.600 research as a foundation for everything that Köppinger Co. 00:17:08.600 --> 00:17:09.300 does. 00:17:09.300 --> 00:17:11.647 If you have additional questions around that 00:17:11.647 --> 00:17:14.100 topic, and if you're watching this on YouTube, 00:17:14.100 --> 00:17:18.100 leave a comment in the comment section of this video, just below that video. 00:17:18.100 --> 00:17:23.200 If you are listening or watching this on any other platform, just reach out to us. 00:17:23.200 --> 00:17:25.300 We are happy to answer your questions. 00:17:25.400 --> 00:17:30.400 And if you have specific questions that might spawn another episode of this, why not? 00:17:30.400 --> 00:17:31.300 Let us know. 00:17:31.300 --> 00:17:32.500 We are interested in that. 00:17:32.500 --> 00:17:39.400 So third-party access governance sounds a bit dry and not boring, but challenging. 00:17:40.100 --> 00:17:44.600 But it's really an interesting topic, and I think many organizations are still beginning 00:17:44.600 --> 00:17:48.900 on that journey and trying to fulfill their requirements when it comes to that. 00:17:48.900 --> 00:17:51.500 Any final thoughts before we close down, Warwick? 00:17:51.500 --> 00:17:53.429 Yeah, I think it's just important to remember 00:17:53.429 --> 00:17:55.400 that having this third-party access governance 00:17:55.400 --> 00:18:00.700 ensures that external users are governed by the same principles like least privilege, 00:18:00.700 --> 00:18:03.041 strong authentication, and continuous 00:18:03.041 --> 00:18:06.900 certification as internal users, but with mechanisms designed 00:18:06.900 --> 00:18:09.700 specifically for inter-organizational contexts. 00:18:09.700 --> 00:18:11.700 And go do it now, today. 00:18:12.400 --> 00:18:13.500 Exactly, exactly. 00:18:13.500 --> 00:18:18.500 For those whom we just informed that there might be something to do, do it. 00:18:18.500 --> 00:18:20.300 So really starting there. 00:18:20.300 --> 00:18:23.400 And reading Warwick's paper might be a good starting point as well. 00:18:23.400 --> 00:18:25.400 Thank you, Warwick, for being my guest today. 00:18:25.400 --> 00:18:28.255 Looking forward to having you here again soon 00:18:28.255 --> 00:18:31.300 regarding your research or any other interesting 00:18:31.300 --> 00:18:32.700 topic that we cover. 00:18:32.700 --> 00:18:33.300 Thanks again. 00:18:34.000 --> 00:18:34.700 Thanks, Matthias. 00:18:34.700 --> 00:18:35.200 Bye. 00:18:35.900 --> 00:18:36.200 See you. 00:18:36.200 --> 00:18:37.200 Bye-bye.