Talking Identity

Catalyst 2007 has been a good conference for me simply because of the intangibles - Good conversations, stimulating discussions, and loads of fun. Here is a wrap up of a hodge-podge of thoughts from the conference.

Identity Services, Where Art Thou?
The second half of day 2 was dedicated to the subject of identity services. While Burton has been leading the discussion on the subject, they have encountered similar obstacles as the rest of us in trying to define a vast, amorphous area that is constantly being pulled apart by different parties. Whether it be vendors or customers, identity services tends to get defined either by what they need most, or can do the best. So arriving at one clear definition is difficult, leaving us with the very abstract, high level view that we have been stuck with for a while.

One of the interesting things I found out was that Burton has formed an Identity Services Working Group (ISWG) consisting of 9 of their customers. It is much more formal than I was expecting, collaborating via members-only wiki and following the Chatham House Rule. It will be interesting to see what comes out of the effort.

Meanwhile I, Prateek and Phil had some good conversations with colleagues at other vendors on the possibility of collaborating on defining identity services. There is recognition of the fact that a good identity fabric can only defined through a collaborative effort.

It is also interesting to see that the most recent entry into the IdM space is also the one gaining most traction as a true identity service - authorization service (aka entitlement management).

Oracle Had A Busy Catalyst
Catalyst turned out to be a really busy time for Oracle, with the IdM division making some major announcements around a major expansion of the Extended Identity Management Ecosystem. The Ecosystem is a set of ISVs that provide value-added integrations to Oracle's IAM offering, delivering comprehensive identity management solutions to customers. In all 8 new members were added to the eco-system, providing new capabilities in the following areas:

• Strong Authentication: Arcot, Imageware, TriCipher
• Physical Access Control: Quantum Secure
• Network Access Control: Juniper Networks, ForeScout
• Privileged Accounts Management: Cyber-Ark Software
• Federated Identity: Pay By Touch

Photo from Ian Glazer's blog at TuesdayNight

And the hospitality suites at Catalyst also offer a different way to connect with customers. Outside the usual confines of an exhibition hall booth, you get the opportunity to chat with them in an informal, fun atmosphere. And I think the casual atmosphere serves to loosen folks up a bit, because you definitely find yourself having a much more open discussion with folks.

And of course, many of the customers implementing OIM make an appearance at Catalyst as well, giving me a chance to talk with them about much more mundane, yet practical, matters.

And now, back to the drawing board.

Okay, so the days of questioning the impact of social networking websites on our digital lives is long gone. But the nature of the impact is still being understood, and this is producing some interesting findings. While the world of sociology is trying to make sense of the seeming divide between Facebook and MySpace users (see ), it is the world of identity and privacy that is seeing some interesting side effects. We all know how concerns about child predators on the web is leading to potential litigation on the need for identity vetting by social networking sites. But the recent opening up of Facebook to the public seems to have let loose a barrage of investigative reports. Two recent articles about Facebook caught my eye:

• Facebook demonstrates that opt-out privacy does not work.
• Fears over Facebook identity fraud

I read this post on the Wired blogs about an ATM heist in which the culprit re-programmed the ATM to think it was dispensing dollar bills when it was actually dispensing twenties, thereby allowing the guy to clean out the ATM. How did he do the re-programming? Because he knew the Master Passcode for the machine, which was still set to the factory default of "123456".

About changing the passcode, the owner said "Oh yeah. I've change it twice since then. I'm paranoid now. I'll probably do it again tonight."

Talk about the need for complex passwords and privileged account management.

So the big identity management news coming out of Redwood Shores today (where I happen to be this week) is the acquisition announcement of Bharosa by Oracle. Bharosa is a global provider of proactive, real-time fraud detection and multifactor online authentication security solutions for the enterprise. (Read the press release here).

By agreeing to acquire Bharosa, the access management capabilities in the Oracle IAM suite will now expand to add risk profiling to the mix of criteria for making authentication and authorization decisions. This means that it will be possible to look at the activity being done by a user and assign that activity a risk score, which can then determine the level of authentication needed to continue, or make authorization decisions that take the risk score into account.

Bharosa would also bring real-time fraudulent activity detection and prevention to the suite, and protect against common identity theft techniques like phishing, MITM attacks and keylogging trojans.

There has been quite a bit of interest in the announcement Oracle made last week regarding the acquisition of Bharosa (some interesting posts can be found here, here and here). Here is an overview of what the acquisition adds to the Access Management capabilities of our IAM suite.

Contextual & Software-based Strong Authentication & Authorization
Oracle Access Manager is the SSO solution already available in the suite to provide username-password (1-factor) authentication capabilities. The Bharosa acquisition bolsters that area of the suite by adding contextual authentication and authorization plus software-based strong authentication (2nd and 3rd factor).

Strong Authentication has traditionally been equated with hardware based mechanisms like one-time password (OTP) tokens, biometric devices or smart cards. All of these come with significant deployment cost and an impact on application usability by changing end-user behavior. A new generation of solutions (including those by Bharosa) is providing strong authentication using software based mechanisms that are easier to deploy and manage, and offer minimal end-user impact.

The Bharosa Tracker product does this by relying on real-time risk analysis and rule-based intervention. It sits in the background, monitoring user activity to build up a per-user profile of what is considered normal behavior. This profile consists of user specific characteristics like device forensics (authorized computers or personal devices), IP geolocation, time of day, normal workflow patterns, etc. It then compares any user activity against this profile to build a risk score of that activity in real-time (which is the only way to go, and so cool).

Customers can configure Tracker with a set of rules that define the actions to be taken based on the risk characteristics and on the context of the activity being done. These actions can cover the gamut, prompting the user for re-authentication, requiring stronger authentication, prompting for answers to challenge questions, or even preventing the transaction from proceeding altogether. This is what we call contextual authentication & authorization based on risk characteristics.

Bharosa Tracker Real-Time Interaction

Bharosa Authenticator Virtual Authentication Devices