Identity at the Center #351 - Jerome Thorstenson on B2B Identity First Security
May 26, 2025
Jerome Thorstenson, IAM Architect at Salling Group, brings hands-on experience securing B2B supply chains and leading IGA and ABAC work. He discusses identity-first security, tackling varied vendor onboarding, treating identity as a product, and using ABAC to avoid role explosion. Practical migration lessons, data quality, and retail turnover realities round out the conversation.
AI Snips
Chapters
Transcript
Episode notes
Pen Test Revealed Clear-Text Passwords
- Jerome recounts a pen test that exposed clear-text passwords and initial passwords stored in AD attributes.
- That discovery changed his view of IAM from simple user management to security-critical work.
Supply Chain Identity Risks Are Organizational
- Supply-chain security depends on making vendors as compliant and resilient as you are.
- Regulations like NIST2 force faster vendor cybersecurity alignment and onboarding controls.
ABAC Mitigates Role Sprawl
- RBAC explodes with scale: thousands of stores and many apps create massive role sprawl.
- ABAC lets you use attributes to reduce rigid role counts and nested groups.