Talking Identity

This week, Oracle took a long awaited first step towards the realization of the Identity Services Framework that I have been talking about. At the Gartner IAM Summit this week, Oracle announced an open initiative, the Identity Governance Framework (IGF), to address
governance of identity related information across enterprise IT systems. The IGF will enable enterprises to declaratively control how identity related information, including Personally Identifiable Information (PII), access entitlements, attributes, etc. are used, stored, and propagated between their systems.

This is a key part of the ISF. The biggest challenge in IdM is making identity-related data available to the enterprise as a service that is part of the identity infrastructure layer. Without it, the enterprise is forced down traditional paths of trying to consolidate all that identity data in a central directory, or forcing individual applications to maintain their own redundant identity silos. As enterprises become more distributed, and as the definition of identity-related data continues to expand, such approaches are no longer adequate and cannot scale.

The IGF solves this problem by providing a standard way to support access to identity attributes originating from other sources (application-centric stores, departmental information, SAML assertions, InfoCards,...). It's function is give organizations and business managers responsible for the security of identity-related data the ability to define more specifically how and when information may be used on a contextual or transactional basis.

The four key components of the Identity Governance Framework that
vendors and customers can currently review include:

• Client Attribute Requirement Markup Language (CARML): an
  XML-based declarative contract defined by application developers that
  informs deployment managers and service providers about the attribute
  usage requirements of an application
• Attribute Authority Policy Markup Language (AAPML): a set of
  policy rules regarding the use of identity-related information from an
  identity source that allow these sources to specify constraints on use
  of provided data by consuming applications
• CARML API: an Application Programming Interface that makes it
  easier for developers to write applications that consume and use
  identity-related data in a way that conforms to policies set around the
  use of such information
• Identity Provider Service: a policy-secured service for accessing identity-related data from multiple identity sources.

Wired News (which I read assiduously) had a pretty interesting article in their "Security Matters" section recently that talked about an analysis done of MySpace account passwords ("MySpace Passwords Aren't So Dumb"). It makes for a pretty interesting read, so check it out. While you are at it, check out whether you have a password that falls into the list of "most common passwords". Particularly interesting to me was the following statement:

Another password study in November looked at 200 corporate employee passwords: 20 percent letters only, 78 percent alphanumeric, 2.1 percent with non-alphanumeric characters, and a 7.8-character average length. Better than 15 years ago, but not as good as MySpace users. Kids really are the future.

I usually don't expect too many replies to postcards (real world or blog) that I write, so I was pleasantly surprised to see the discussion my post about the Gartner summit generated. The lively discussions regarding the part roles play in compliance were definitely expected. What I was not expecting were the few emails I received from people asking me if I didn't like the Gartner conference.

Not sure how I managed to get that perception out there. In my post I made no judgments about the conference; I merely made a specific comment regarding its format and content, and touched on a few topics that generated a lot of discussion at the blackjack tables (which was probably good because if I was paying attention to the game, I probably would have lost money).

The perception of a conference can only be judged by what you, the attendee, are looking to get out of it. My
(personal) interest in these conferences is
that of someone trying to gain a deeper understanding of the space, especially its future. From my standpoint, the Gartner Summit concentrated on delivering a good primer in identity management - IAM 101, if you will. So if you were looking for a conference that would help you understand what IAM is, Gartner was the place to be. If you wanted to delve into the weeds and understand, say, the impact the net neutrality debate would have on identity and privacy, you probably weren't going to find any sessions covering that. That was the essence of my comment.

Given that this was Gartner's first conference, I actually think that they did a good thing by going back to basics. More than anything else, the request I get from prospects I am brought into talk with is for an IdM reference architecture. The kind of customer that understands IAM is actually quite rare, and there is a lot of misinformation out there. There are a lot of companies starting projects that are looking for a map to help them navigate the morass we call Identity and Access Management. And a number of them were at this conference. Analysts like Burton and Gartner do a pretty good job of providing just such a sitemap through their research. Gartner brought that same approach to the conference. They did a pretty good job of creating sessions that explained the basics of IAM.

While the conference may not have been as technologically enlightening for us (so-called) identity experts, it hit the mark in terms of its target audience - the customer who wants to understand the solutions available today that can help them solve their needs. Which is, in turn, valuable to me, a member of the IdM vendor and (self-professed) identity geek community, because it helps keep me grounded in reality. It reminds me of the questions people I am creating solutions for are asking and what they actually care about. It was telling that the sessions with the highest turnout were the ones that explored the basic tenets of IAM - role management, provisioning, authentication (and, judging from the talk around the resort, authorization will be joining in soon).

It will be interesting to see how Gartner establishes the identity (pun intended) of this conference among the Catalyst's, DIDW's, RSA's and IIW's of the IdM world. And I expect they will find a place to accommodate some of the more esoteric and cutting-edge discussions that I personally am interested in.

I'm still making sense of all the discussions I got into regarding roles and compliance. As soon as I wrap my head around it, I will bring you into it. Stay tuned.