Oracle SSI

Thirumani Solaiappan, Oracle SSI

Identity Management (IDM) has emerged as a key technology to aid in handling the complexity of today’s Enterprise.  Open systems facilitate synergy in developing suitable solutions to tackle key problem in IDM space like dealing with security in the virtualized environment, strong authentication and dealing with persistent threats from Insiders.  This paper attempts to provide direction to entities interested in innovating in this space.  It also discusses some of the issues in the Indian context and similar research happening around the world.

I. Introduction

Identity management landscape has seen profound changes in the past few years.  In the simple settings of a typical Indian village establishing one’s Identity was never a problem.  Authentication is a simple task, as everyone knew everyone else.  But in today’s flat world where most communication happens over the wire, we deal with people whom we have not seen or even talked to.  Establishing trust becomes a complex and difficult proposition.  Authorities like the Government, Employers, Universities, Insurance providers, Banks or even the local retailer have the same problem.  Each one of these entities needs to know different things about a person to perform their job.

Defining an Identity boils down to specifying the minimum information that need to be maintained about a person without disturbing privacy of the individual.  Establishing a reliable chain of trust has become a critical need for smooth conduct of business.

Traditionally Identity Management solutions provided ROI in the form of automatic resource provisioning, self service for tasks like password reset etc, centralized user lifecycle management.  These areas have matured and are now considered as bare minimum necessities for an Enterprise class solution.  SSO (single sign-on) is a good to have feature that brings comfort to the end user rather than adding any new functionality.  With systems becoming more open, GRC (Governance Risk Management and Compliance) has become the driving force and IDM infrastructure has moved from being administrator centric to being business oriented (also known as Identity 2.0).

The year 2008 saw the launch of major research programs in universities and research centers across the globe.  This paper discusses the various problems these research programs are trying resolve specifically those that are relevant in the Indian context.  The emerging trends in the Identity Management space are also discussed.

II. Key Challenges

a.  Improving the Flexibility
Indian companies have adopted virtualization in a big way.  Virtualization has simplified the task of managing shared computing resources. The shift to centrally managed and centrally hosted environments gives more mobility and flexibility to the users. This opens up new challenges to the IDM system.  Identity management policies, procedures and technology will have to work together to create a secure yet flexible environment.

b.  Strong Authentication
Changes in business practices are forcing the enterprise to open up access to partners, employees working from home and in increasingly many cases even to end customers. IDM infrastructure was held within the boundaries of the Intranet and relied on a single source of truth to authenticate a user or to perform other workflow related tasks. This is no longer the case. The focus is shifted to knowing who is doing what with the data and applications irrespective of where they are physically located. Strong Authentication and Contextual Authorization are more important in this environment.

c.  Insider Threats are Persistent
As the enterprise opens up more and more critical resources and systems the probability of insider posing a threat is higher. Insider threat has been and will remain a key challenge in the IDM space. How can we prove that someone indeed has accessed the system when this person has used his friend's ID? It is important for an enterprise to know who is having access to systems, how they are accessing the system, what they are doing and from where? Advancements in biometrics and the reduction in the cost of security infrastructure may help in reducing this risk.

III. Emerging Trends

a.  Online Banking reaches the common man
Online banking has caught up significantly in India. BSNL has done a phenomenal job of connecting all the villages in India (should I say most of the villages). Computers and broadband connectivity is within the reach of the common man today. Also gone are the days when customers felt very insecure giving out a pin number for a purchase or do shopping online. 

During the past 8 months leading banks in India have significantly upgraded their infrastructure to use superior technology. Banks and other financial organizations are able to do assess risks faster. Further developments can be expected in the area of improving accuracy of background checks, more accurate and fine-grained risk assessment to aid insurance and retail industry. Entities like RBI might impose regulations. Banks around the globe are currently testing sophisticated encryption mechanisms and Flash-player based methods.

b.  OpenID for Identity 2.0
Open ID is a key standard for Identity 2.0.  InfoCards and CardSpace are becoming part of real life.  Governments around the globe are participating actively in the OpenID concept. They seem to have realized that protecting the identity of their citizens online is as important as providing physical security. http://www.openideurope.eu/ is a very good example of this.

In India there has been a talk about providing an ID card to every citizen.  But we need to cover lot of ground before we leverage its full potential. With the recent developments in the news, this initiative might get a renewed push.

c.  Governance, Risk Management and Compliance (GRC)
Compliance regulations are starting to drive the development of some common rules and best practices for Identity Management. It might not become standards though in the near future. GRC has become a driving force for Identity Management focusing on business-oriented Identity management. Specialized applications for Risk Management and Auditing will be launched. Business Role Management will also mature within this year.

d.   SOA and IDM grow together
Collaboration between SOA and Identity Management is a key requirement. Investigations are on to arrive at services that can be executed in the context of identities to ensure end-to-end security. Identity Federation and use of virtual directories for flexible provisioning of Identity data will continue to grow.

III. Research Programs

In Aug 2008 experts at Cranfield University, Royal Holloway University of London, Salford University, Consult Hyperion and Sunderland City Council have formed a consortium and are teaming up on a three-year project to pioneer innovations in the Identity Management space specifically in the privacy and consent for Identity Management. Indian Universities also can take up similar initiatives and contribute ideas to resolving Identity Management problems India faces.

Digitizing the land records and computer-aided registration has brought in significant benefits like eliminating bribe and avoiding stamp paper scams.  But even in this initiative there is lot of scope for improvement, as the Identity of a person is not linked across the various Government departments like the Passport office, Birth & Death Registration office, Marriage Registration Office and many other offices.

Today the police in Bangalore are trying out latest technology to aid their decision-making. This also needs lot of focused attention and research. The cops here do note down the vehicle number of those who are jumping signals or not following traffic rules. But I don’t think they are able to successfully link the vehicle number to the Identity of the person owning the vehicle. Dubai has implemented an advanced system to automatically detect offenders through cameras located at different road intersections and link it to the account of the person owning the vehicle thereby automatically deducting the fine amount. This is possible only if we build a good Identity Management system for our citizens.

IV. Conclusion

Universities in India can take up research work in the Identity management space to contribute innovations to resolve problems faced by Indian enterprises and Government. Open systems and standards facilitate collaborated efforts and research work in the IDM space.

References 

1. Blogs and news items posted at http://www.kuppingercole.com/
2. Blogs and news items published in http://news.cnet.com
3. Blogs and news items published in http://www.computerweekly.com/
4. Blogs and news items published in http://www.sourcewire.com/

----------------------------------------

Thirumani Solaiappan is a Principal Consultant & leads the Security & Identity Management Team at Oracle SSI. He can be contacted on thirumani.solaiappan@oracle.com. You can also read more of his writings on his personal blog http://thirumanusolaiappan.blogspot.com.

We at Oracle have come a long way in the Hyperion arena. Hyperion is one of my favourite domains as I was the key member to even have started building the team for Hyperion Consulting in Oracle SSI. This large team of consultants, is slated as one practice that grew beyond boundaries in the shortest span of time. This team is doing excellent consulting work in the Hyperion area across EMEA.

I still remember how we all started from scratch sometime in July 2007 in building the team. It was in September 2007 I hired one key member who is currently the Practice Manager for the Hyperion group. From then to now, we really have come a long way. The team consists of excellent resources who were hand picked to deliver Hyperion related technological solutions to our customer needs. These consultants not only are tech architects but also possess excellent leadership skills who see themselves as leaders without title.

The challenge was immense in 2007 when we wanted to hire extremely talented and skillful resources, as the technology was relatively new in India. Hyperion had a small office in Bangalore in association with Symphony services. The challenge was to hire only Hyperion Planning and Hyperion Financial Management (HFM) skill only. Nevertheless, doing the impossible is not new to anybody here in Oracle and we; the recruitment team did surely prove that.

I can proudly say how the practice is close to me as I have seen it strengthen day by day to what it is now. The team is extremely aggressive in its approach to client needs and has been winning accolades from all corners. And not just that, this teams members also won awards in the last quarterly review and that surely has something more to say.

To know more about Hyperion in Oracle and its solutioning, see this: http://www.oracle.com/hyperion/index.html

To know more about how you can be part of Oracle in Hyperion domain, drop an email to me.

The author of this article has been with the Oracle India Recruitment Team for the past three years and can be contacted at pushpalatha.sreenivasan@oracle.com

Here is what the guests had to share:

Vidya Nagaraj – Vidya has been with Oracle for 14 years now. She is currently with Oracle University where she has taken up the responsibility of teaching. Vidya recalled her early days with Oracle when the software giant was yet to establish a foothold for itself in India. She and her colleagues used to work in a makeshift premise with a ‘startup kind of culture’. Her 3 key suggestions to the women audience –

• Plan well, execute excellently and strive to be a subject matter expert with global bent of mind
• Volunteer for special projects to explore something extra within each one of you and increase your visibility
• Be resilient and equipped to handle issues

Speaking about her work, Vidya openly endorsed the work culture of Oracle that gives its workers a lot of freedom and places a lot of trust in every employee. In return, she says that we are expected to be flexible in our approach towards work. Vidya also said that since working-women need to balance both family and work, it is necessary that we identify our priorities and make peace with the small compromises that we may have to make in both personal and professional lives.

Seema Ambastha – A charming lady with an eye-catching personality that exudes an air of self-confidence and assurance, Seema is a Sales Consulting Director for Database Technologies. She had three simple points as her formula for success –

• Be passionate about your work.
• Possess the drive to achieve.
• Possess the adaptability to continuous change.

Seema caused uproar in the audience when she revealed that from day one of her career, she had made the decision to ‘manage her manager’. On a serious note, she emphasized the importance of taking things happening around us into control and being more proactive. She feels that the biggest challenge that women face at their workplace is conflict resolution. ‘Saying right things at the right time’ is also another common roadblock for women. Hard-pressed for time to catch her flight back to Mumbai, Seema signed off saying that the two key traits that make a good professional are ‘to never stop learning’ and ‘to never give up’.

Shalini Chandrashekar – Shalini works as the Business Development Director with the Sales team in Oracle. She recalled the difficult decision she had to make when she was recruited in Oracle at IC1 level instead of manager by mistake. However, she made the conscious decision of sticking on since she knew that this position was not where she would stay for long. And she proved herself right in course of time, given that since then she has been promoted almost every fourteen months during her career with Oracle till date. For Shalini, doing things that she loves is more important than doing something for the sake of prospects. She feels that every worker has the capability to further her career, provided she is ready for it. Shalini observed that in a workplace, women get promoted on their past experiences while men get promoted on the basis of their potential. She urged all the women never to compromise or hesitate to speak for themselves. She also emphasized that while a workingwoman definitely can’t spend enough time with her family, it is finally the quality of time that makes the difference. As a woman who has taken up the daunting task of working during the nights in order to be with her family, Shalini drew a ready applause from the audience for her determination and passion.

Tapasi Sengupta – Our last guest for the day was Tapasi, who worked as a Consulting Practice Director with Oracle GSD. Tapasi graduated from IIT Kharagpur in Electronics and Telecommunication Engineering and has worked in various organizations like IOCL, Satyam, Accenture etc before joining Oracle. She quickly impressed the audience with her strong traits of boldness and passion. According to Tapasi, a woman’s biggest advantage is her capability of multi-tasking and she feels that women should use their special attributes to their advantage in professional life. She accepted that as a perfectionist, she has often worked for more than 20 hours a day. Tapasi also shared that job satisfaction has played a very key role in her career onslaught. Like her fellow guest Vidya, Tapasi also advised her audience to work on special projects and also work with different teams in an effort to diversify, rather than just concentrating on one work. Another very crucial issue that Tapasi discussed was the relationship between women co-workers. She urged everybody to get motivated by the success of women colleagues. Speaking about Oracle, Tapasi echoed everybody’s sentiments when she said that she belongs to an organization that has no hierarchy and stresses on open culture.

As the day drew to a close, everybody present in the meeting had acquired something. While the audience was highly inspired by the four absolutely magnificent guests, the four ladies themselves were awed to meet such a huge gathering of charged women, ambitious and willing to do something different than just work. The upbeat atmosphere echoed Seema’s closing words – ‘Emancipation is a wrong word used in the context of women. We are all emancipated.’ Indeed, all women need to realize this today.