Narrator: You're listening to the humans of DevOps podcast, a
podcast focused on advancing the humans of DevOps through skills,
knowledge, ideas, and learning, or the skil framework.
Topher Marie: Consumers are trying to get away from those
legacy products as they move into cloud infrastructure. How
do we make it so you don't have to rewrite an application that
was targeted to one of those legacy products. That's
something that we do.
Eveline Oehrlich: Welcome to the humans of DevOps Podcast. I'm
evolutionarily Chief Research Officer at DevOps Institute. Our
episode title today is identity orchestration titbits, and I
have a very special guest. I'll tell you in a minute why that
guest is very special to me. Today we have with us Topher
Murray, who is CTO and co founder of strata. I'm saying
that a little bit with an Italian accent for no reason
just because I like the word, but let me tell you a little bit
about Topher. So Topher is the CTO and co founder of strata
identity, focusing on introducing identity
orchestration to the security ecosystem. Before start
identity, Topher was the CTO and co founder of jump cloud. In the
past, he has also been an architect for Oracle's global
cloud identity and security security portfolio, and a
product owner for us zero. He was simplified lead architect
and got his start in identity at ping back in the early days. As
part of his role. Topher travels extensively, developing a deep
appreciation for local cultures, food, and languages. Welcome to
our podcasts over.
Topher Marie: Thanks, Evelyn. It's great to be here. Thank you
so much for having me.
Eveline Oehrlich: It's great to have you with us. And again,
thank you so much for your time. I'm sure as you're in your role,
you have lots of other things to do. So that's why I'm very
appreciative of your time. Now, before we get into details, of
course, I was checking you out with a variety of things in your
background, and I saw that you went to the School of Mines, and
that there are lots of references to Colorado. Am I
correct to assume that you have some roots in Colorado with
stretch identity?
Topher Marie: Indeed, I'm born and raised here. I have been in
Colorado most of my life. And yes, School of Mines. I was an
undergrad graduate there. And I was actually a adjunct professor
there for a while to
Eveline Oehrlich: Wow, fantastic. Life sometimes is
just a coincidence. But I think we, I would say maybe are a
match in heaven to some extent, because I lived in Colorado in
Fort Collins. For 32 years. I had my daughter stared. And now
long, long gone. I moved back to Europe in 2018. And I miss
Colorado very, very, very much. So talking to you today gives me
a little bit of a homesickness. So please greet Colorado for me.
I will actually be there soon. So maybe we can meet and have a
cup of coffee together somewhere in the area. Anyway. I'd love
Yes, that would be fun. I really would love that too. Excellent.
So we're not here to talk about Colorado even so if you have not
visited Colorado you have to we are here to talk about identity
orchestration, which most likely a topic which not every one of
our listeners might be familiar with Serato for what is identity
orchestration? And why for a second question, why is this so
important?
Topher Marie: Yeah, so I don't blame people for not being
familiar with the term but it's something that we've really been
championing championing. It's kind of a new space in identity
over the last four years, we've really been pushing it, and it's
really starting to take off here. So what is identity
orchestration? And why is it important? So to me, identity,
or identity orchestration is kind of an abstraction layer on
top of the existing identity, or I'm going to start that again.
Sorry, but let me go back to the beginning on like, what is
identity orchestration? So to me, identity orchestration is
really an abstraction layer on top of the other identity
components that a company may already have. So there's three
parts to this. The first would be what I call distributed
identity. Almost all organizations already have their
identity in multiple, multiple places. Smaller ones might have
various silos, like in SAS products might have an HR
system, they have their email in Gmail. They have issue tracking
and larger organizations might have this for fragmented across
different departments, different business units. They one
business unit might be focused on Okta, another one might be
focused on using, let's say, a joueur as their identity system
of record. And that's quite common. Another reason that this
identity fragmentation happens is just because of mergers and
acquisitions as a company grows, it might acquire another
company, and that company might have had a different focus on
their identity, where their directory of identity was, and
so mixing and matching those things becomes difficult. And
one approach that our industry has taken over the last, I don't
know two decades, or whatever is one identity to rule them all,
or a virtual directory, or something of that sort, where
you're moving all of the identities into one place. And
it's time to admit that that really just does not work. This
mixing and matching of where my identities are stored, has just,
if anything proliferated, and then worse and worse over the
last few years rather than mitigated by trying to have this
one identity to rule them all. So that's, that's the first part
of what identity orchestration addresses the distributed
identity systems. The second one is there's a variety of tools
and implementations. various vendors, various producers of
identity products, have their first off like their directories
like I was just talking about, you might have some identities
in Azure, or you might have other identities and Ping
Identity. And also, on top of that, you might have different
MFA providers for a long time we were using RSA tokens is a
completely separate second factor that people could use in
order to secure their systems. We also have different
authorization engines. Now that our back versus a back we have
identity proofing, we have governance, so we have a large
variety of different identity tools that we need to make work
together. And the third one, the third component, I would say, of
identity orchestration is the customized user journeys, where
every if we were to rely just on one identity provider, that
might not be the right way for us to log our users in, that
might not be what we want to do, we might want to have a
different mix of these tools and implementations, we might want
to have a different mix of even where the door where the
identities are stored in the first place. So the Customize
User journey allows us to say hey, so despite where their
identity might be stored, I want them to have the same user login
screen. And then I might want to decide which different MFA
provider they use based on what they are trying to get into. And
I might want to use identity proofing for some users and not
for other users. So to me, identity orchestration is all
about those three things, distributed identity, the
variety of tools and implementations that we can make
work together and the customized user journey.
Eveline Oehrlich: Wow. Lots of I can already kind of guess why
this is important. Why I did the orchestration is important,
because I've been in it long enough to realize some of the
benefits but love to hear it. From your perspective, why is it
that the orchestration really important?
Topher Marie: Yeah, but so identity orchestration is very
important, because as companies are moving to the cloud, or
multiple clouds, and I will pause there and say that most
companies don't just have one cloud. They most companies have
different departments that are working in different clouds, or
even different products that they have to work with, that are
residing, that the compute for those products is residing in
different clouds. And as this just grows, more and more, it
becomes a huge concern about Alright, so what am I going to
try to do here is AWS going to be the center of my identity is
as you're going to be the center of my identity? Am I doing LDAP
on premises? How do I make all of this work together? So as we
become more of a multi cloud industry, it's very important
that we have some way of making all of these identity systems
work together, and also all of our identity targets. Should I
say all of the applications that are consuming identity? How do
we make it so hey, this person logged in from AWS, but the
actual application is residing in Azure or on premises? How do
I make that identity palatable to the target application? And
how do I avoid rewriting that application? If I've got an old
application that was using a legacy identity system such as
one that we very commonly see as ca SiteMinder, we see a lot of
Oracle products as well. Consumers are trying to get away
from those legacy products as they move into cloud
infrastructure, how do we make it so you don't have to rewrite
an application that was targeted to one of those legacy products.
That's something that we do and something that really, really
resonates with our customers. Beautiful.
Eveline Oehrlich: So I heard you improve collaboration, of
course, right reuse, and with it, of course, saving time, and
hassle for all of those who actually have to work together
and manage all of those different identities. Absolutely
intriguing. Certainly an area which our listeners are
extremely interested. Fantastic, super. Now, I was doing
additional research, you know, analysts like myself, which I
am, by nature by heart and have always been always curious. And
your company was co founded by Eric Alden, Eric Leach and
yourself and researching your company a little bit, I found it
very interesting that even before you all figured out
exactly how strategy would work or how it would get funded. You
laid out core values. And this really tickled me and I love
them. So the core values of openness, honesty, integrity,
transparency, accountability, and empowerment. This really is
very dear near to me, because I worked for Hewlett Packard when
it was Hewlett Packard many moons ago. And these types of
things were very much written in like an HP way. So that's why I
love this so much. Additionally, in 22, you guys got voted by Ink
Magazine, in are listed as best workplaces and the extract from
a press release, it said, best workplaces, 2020 to 475
employers, these companies out of Florida 75, employers have
cracked the code for excellent company culture. Now my
question, give us some examples on how this plays out in your
day to day work within strata. What what do you guys do? How do
you make this openness, honesty, all of those wonderful core
values? How do you practice them?
Topher Marie: Yeah, it's a thank you for acknowledging that it
was very deliberate for us to come in, figure out what kind of
company we wanted to work for what kind of culture we wanted
to inculcate. So this was very edifying to have to be
recognized a few years ago by buy the industry as a great
place to work. So in our day to day lives, well, first off, we
have a couple of ceremonies which are more weekly, but we
have a Mavericks Monday, we call it where the first thing that
happens is we come in and we just discuss a this is what's
going on this week across the entire company. And here's what
every individual is looking forward to. And what they're
going to be doing that week really promotes the openness
really promotes that communication. Many times I've
been on those calls, Zoom meetings, I've been on that Zoom
meeting and realize, hey, that's something that we've already
done like six weeks ago, let me help you out there, or oh, this
person might be struggling with this, and be able to offer help,
that openness, that that communication is very core to
us. Another thing that we do is what we call Aloha Friday. So we
have the Mavericks Monday that kicks off the week. And then on
Friday, we all get together. Again, we're a completely
distributed company. So most of us are just joining over zoom, a
few in offices here in there. But over zoom, we get together
and we just talk about the week, hey, here's what's happened. And
here's what I'm thankful for here are things that I'm very
appreciative of, let me call out this person, let me call out
this team, let me discuss, this is what happened and look at how
they really gave their all in order to turn something around
very quickly, or the great communication that happened or
here's the event that a that our marketing department put on and
look at all the pictures of our happy attendees, those kinds of
things are very rewarding, just to be able to have that
communication. You know, as companies become more and more
distributed. As we have more work from home, it becomes
really easy to be isolated. So it's important to us that we
have this open communication and we have this ability to call
each other out for Hey, these are great things that people
have done. Let's have these conversations. Let's feel like a
team and work together on things.
Narrator: Do you want to advance your career and organization? We
can help you do that. DevOps Institute offers a wide range of
educational experiences for you to begin your upskilling
journey. Whether you're looking for a defined path to
certification, exploring the latest in DevOps, or connecting
with the larger community, we can help you develop the
specialized skills needed for the future of it. And it won't
just be good for your career. It will also make you indispensable
at work with our lineup of industry recognized DevOps
certifications, digital learning opportunities, and engaging
events, you can connect with our network of experts and expand
your potential today. Visit DevOps institute.com and join
our community now.
Eveline Oehrlich: I love those. I think I'm going to, I don't
want to use the word copy. I think I use word leverage. I'm
going to leverage this into a new team I'm forming. I love the
Mavericks Monday, I might call it something else to be more.
That's all that's not so American. Right? And then Aloha
Friday, everybody knows Aloha. Even we here in Europe, of
course, no Aloha. So I didn't have those. That's fantastic.
Thank you for sharing that.
Topher Marie: It just, it just occurred to me that when I saved
Mavericks Monday, it might not. I realized that Netflix is the
name of our main product. And that's why we've chosen that
particular alliteration there for Mavericks Monday. Ah, not
just because we are also Mavericks with K, the product
Maverick was actually Mavericks was actually named after a
particular wave in California that is important is powerful is
great for a lot of different surfers, and three co founders,
we actually built the company or decided on these core values
that we were just talking about as we were on a surfing trip in
Puerto Rico. So surfing is kind of I wouldn't say a core value,
but something that resonates with a lot of us, so Oh, great.
Eveline Oehrlich: Excellent, excellent. You have to come to
Nazarene or Nazareth down in Portugal, in April or in January
to watch the maverick stare. That's a fantastic place.
Excellent. All right. Let's go back to strategize. So, in your
words, why is what started us unique when we think about the
identity orchestration?
Topher Marie: Yeah, great question. So recently, at the
Gartner conference here in 2023, a cube con said, vendors are
going to have to handle orchestration, or they will be
orchestrated. So to me, I see, from a consumer point of view,
great value in decoupling the orchestrations from a particular
vendor. Every company probably, again has multiple vendors that
they're working with, if you're a nontrivially sized
organization, you've got multiple IDPs, whether you like
it or not, and orchestration can be seen as an abstraction layer
on top of that identity. So it prevents some of the lock in and
gives you leverage in the future. When you think about
changing vendors or you think about changing approaches. The
problem that I see, with every vendor becoming their own
identity orchestration system, which you we are seeing that
every vendor is pushing into that area is that they become
their own little sinkhole, they become their own little center
of gravity. And so it's no better to say, Okay, I have to
escape from the orchestration of one vendor, in order to be able
to leverage the capabilities of another vendor, you're still
getting into the center of gravity. So as a, I'll say,
neutral vendor of orchestration that allows us to help you to
not be so bound to any so coupled to any one particular
vendor. It also allows us to do a lot more customized
customizability in that we don't have a preferred way of doing
let's say, NFA, if you are in a particular, if you are tied to a
particular vendor, and they just want to push you into their own
NFA system all of the time. I mean, of course, that's what
they're incentivized to do, the more that they can lock you into
their particular product, the better it is for them, but it's
not good for the consumers to be locked into any particular
product. They'd rather choose the best of breed for for
anything and with identity, which is my main concern.
That's, that's obviously true. Let's let them choose the
identity directory that they need for any particular
application or for any particular user journey. Let's
then let them layer on top of that the MFA. Let's then let
them layer on top of that the governance system or creating
new customers, sorry, new users in these directory systems. So
our best of breed approach and our neutral approach to how
identity systems work is really The different than any one
particular identity vendor trying to get into the
orchestration.
Eveline Oehrlich: Right. So best of breed and then the
Switzerland, right, as you said the neutral, we sometimes use
that in Europe to describe neutrality, which is, which is
everybody understands super. Now as we know, there are many
organizations which are working on moving off outdated cloud
identity providers to more secure and flexible cloud
identity systems like Octa, you mentioned a few already
Microsoft assure AWS and more. And you you guys recently
announced no code software recipes for application
modernisations I love the word recipes. I might have called
them blue books, or blue or blue books or Blue Book, sorry,
playbooks, blue books, just try to sell my daughter's car. So
that's why I'm in love books, but playbooks for application
modernization, but you call them recipes. Tell us what do these
recipes do?
Topher Marie: Yeah, there are some common use cases that we
see as we talk to consumers. As we talk to prospects as we talk
to our customers that they have the same problem across the
entire industry, a lot of people are trying to move off of some
of these legacy systems and into more modern identity
architectures, but they don't want to rewrite their original
application that was tied to the legacy system. So for instance,
one of our Blueprints Wow, now you've got me doing. Sorry, one
of our recipes is, hey, here's a no code approach. All you have
to do is drop this in and we can move you off of the legacy
application start the legacy infrastructure, such as site
minder, or Oracle, we can move you off of that very simply. And
now you're working against a modern identity systems such as
insurer or Okta, got other ones. For instance, one common
scenario that we see is, instead of moving, so one common
scenario is, hey, I'm moving from one identity architecture,
one identity framework to another identity framework, or
I'm trying to move the center of gravity or here's, here's this
one that has just jacked up the price by five times eight times.
And so I need to move my users out of there. But I don't want
to do the Big Bang cutover from one to the other. I don't want
users to come in one Monday morning, and suddenly their user
experience is completely different. So that goes kind of
to our, to our user journeys story where we can have the
customized user journey that looks the same as before. But
another component of this particular recipe is we can move
the users from one identity system to the other identity
system, without them knowing about that. So they're still
logging into the first identity system, they're still passing in
their username and password to let's say, a, let's say to a
SiteMinder based application, we will go and create the user at
runtime in Okta, or in Ping Identity, wherever the target
destination is, without them, knowing that anything has
happened there. This is also a perfect time for us to layer on
a second factor, if the legacy identity system didn't have
second factors, we know who that user is, because they just
logged in to the legacy system where we have a good handle on
their session at that time. Let's now prompt them and move
them through the process of adding a second factor. But
again, this is a incremental thing, just as users are logging
in. And you don't even have to do all users at once. You can do
individual, you 10% of your users one week 20% Next week,
you know, move over to the system gradually. So it's not as
nightmare Big Bang cutover where your entire infrastructure team,
all of the DevOps people are there all weekend and crossing
their fingers on Monday morning that something disastrous
doesn't happen and you haven't locked out 10,000 users. That's
a nightmare scenario with us. Yeah, just layer on this, again,
abstraction layer. And we have recipes that help with this.
This transference of your center of gravity for your identity
systems from one to the other.
Eveline Oehrlich: That already answers. So one of the questions
What would you advise our listeners to do right away, it's
really take a look at these recipes. I think this is a
great, a great idea. Now, I want to look a little bit into the
future before we end this because I want to look into your
crystal ball. From our research. We know there's a skill shortage
in it. Right. We also know from Gartner and Forrester, my old
colleagues there, there's a not too much additional money in
terms of budgets in 23 for it so it's really all about how do we
upskill rescale and save cost to get all of this done right. So
what would you say If I asked you predictions around that add
orchestration 23 Oh, my goodness is almost half over. But we
still have a few months left, but for 23 and maybe beyond,
when you look in their crystal ball predictions around identity
orchestration from you.
Topher Marie: Yeah, I think that one prediction, which has
already come true, as we're gonna see, the term
orchestration tossed around quite a bit, I think it's going
to become like zero trust has become over the last 510 years
where it's just everywhere, it loses all of its meaning,
because we just say, Yeah, I've got some orchestration, I can
work with a different identity system, or I like to customize
the user journey, they really kind of ticks tick the boxes,
but they missed the spirit of it, I don't want to be caught up
in one identity system and not be able to choose the best of
breed for from some other places. So I would suggest that,
that listeners kind of inoculate themselves against the buzzword.
What is it really? What is our identity orchestration actually
mean? And how would it benefit me, if it doesn't matter that
you have, if you are actually just in one identity system,
then then you don't care about it. But I think that most
nontrivially size organizations probably could benefit from
identity orchestration. And what they should do is let's, let's
look at some of these siloed identities that I have, you
know, not just my main directories as your or aka or
wherever I keep keep the main body of directories, but also
all of the other subsystems EHR system, the email, though,
whatever it is, how can I make these things work together
better and think about the underused utilities that you
already have? Maybe one small department had as a particular
need. And so they had to pick a particular MFA vendor? How do I
unlock that and actually make it available across the entire
organization? Or how can I use identity orchestration to choose
and make the best use of all of these tools that I'm paying for,
and maybe stop paying for some of the tools that I don't need
anymore, or law, getting rid of some of these legacy systems
that are really really jacking up the prices and getting really
expensive? So unlocking a lot of value by allowing you to mix and
match your identity systems, the tools that you're using and to
customize that user journey.
Eveline Oehrlich: Great advice. Super. And I love that you
mentioned zero trust shout out to my old colleague, John Kim
Novak, who is called the father of zero trust. So excellent,
fantastic advice. All right. I have one more question. It has
nothing to do with identity orchestration, sadly, but truly,
I want to know, what do you do for fun because you live in
Colorado, you're a surfer, but I don't think there was any
surfing in Colorado. But maybe you have found some places. Tell
us what you do for fun. Dover
Topher Marie: definitely knows surfing. Definitely no surfing
here. What I do, I think it's one of those classic I grew up
in Colorado, I used to do a lot of skiing. I used to get up
there into the mountains for doing that. But honestly, the
traffic is just making that kind of unpalatable. He's spent a lot
of time just right driving out there and driving back. So one
of the things that I really liked doing is going to other
places in the mountains, not the popular i 70 area but other
places in the mountains and doing a lot of hiking, doing a
lot of mountain climbing. That's something I've been passionate
about for decades now doing mountain climbing. I've got a
goal of doing Aconcagua, which is the tallest peak in South
America. I've had a goal of doing it a couple of years back
but unfortunately COVID knocked out plan to the side. So now I'm
now that I'm back in Colorado, spending all my time here. I'm
able to get into the mountains, get my fitness back up and hope
to get that done this coming winter.
Eveline Oehrlich: Wow, great goal to have good luck. That
sounds fantastic. Thank you so much for this has been a great
conversation. We have been talking to Topher Murray, CTO
and co founder at Strata identity again, thanks so much
for joining me today on humans of DevOps podcast.
Topher Marie: Thank you, Evelyn. I had a great time.
Eveline Oehrlich: Humans of DevOps podcast is produced by
DevOps Institute. Our audio production team includes Daniel
Newman, Schultz and Brendan Lee, shout out to my colleagues. I'm
humans of DevOps podcast, executive producer
evolutionarily. If you would like to join us on the podcast,
please contact us at humans of DevOps podcast at DevOps
institute.com. I'm Evelyn ilish. Talk to you soon.
Narrator: Thanks for listening to this episode of the humans of
DevOps podcast. Don't forget to join our global community to get
access to even more great resources like this. Until next
time, remember, you are part of something bigger than yourself.
You belong