Monday Nov 09, 2009

CIO Roundtables: Identity Management – Starts Tomorrow!

Tomorrow is the first of five “CIO  Roundtables” sponsored by CIO Magazine and Sun Microsystems to be held in Washington DC, New York, San Francisco, Vancouver and Toronto.  It will be a good experience to participate in each event with Michelle Dennedy, Chief Governance Officer of Cloud Computing for Sun Microsystems, and dozens of CIOs and IT management folks in what promises to be a lively and invigorating discussion of Identity Management issues facing modern enterprises and government institutions.  We will address the subject, “Identity Management - Pathway To Enterprise Agility.

A list of locations and further information are included in a previous post.

The Role of IAM in HIPAA/HITECH Compliance

I recently authored a white paper entitled, “Identity and Access Management – Enabling HIPAA/HITECH Compliance.”  The paper is now in the final editing and formatting process.  As we awaiting the final publishing date, let me share an excerpt from the paper, focused on the key ways IAM enables HIPAA/HITECH compliance.

HIPAA/HITECH requirements for privacy, security, auditing and notification are supported directly by IAM. By streamlining the management of user identities and access rights and automating time-consuming audits and reports, IAM solutions can help support strong privacy and security policies across the enterprise and throughout Health Information Networks while reducing the overall cost of compliance.

IAM provides the following key enablers for HIPAA/HITECH compliance:

  1. Assign and control user access rights. Securely managing the assignment of user access rights is critical to HIPAA/HITECH compliance, particularly in distributed and networked environments typical of modern healthcare business. Decentralized provisioning is not only inefficient and costly, it also increases the risk of security and privacy violations. Automated provisioning allows centralized control of resources and applications that have historically existed in silos. This provides a much greater level of control over access to those resources. Checking audit policy at the time or provisioning ensures regulatory compliance, thus preventing audit policy violations.

  2. Adjust user access rights when responsibilities change. Business risk is introduced when employees change jobs and access isn’t appropriately adjusted or removed. Failing to appropriately adjust or remove users’ access when job changes occur can result in superuser-access and SOD violations. Automated provisioning effectively eliminates many of these risks, especially when combined with auditing and role management capabilities.

  3. Revoke user access upon termination. IAM systems can automate the process of immediately revoking user access rights upon termination or suspension. This eliminates a commonly-exploited security gap and opportunity for policy violation that may occur after an employee or contractor has been dismissed.

  4. Manage allocation of user credentials. Managing user names, passwords and other user access credentials is essential to assuring that only authorized users are granted access to information systems. IAM technology can provide enterprise-wide control of user credentials, including the enforcement of uniform password policies (e.g. password strength, periodic change).

  5. Enforce segregation of duties (SOD) policies. Segregation of duties (also known as separation of duties), has as its primary objective the prevention of fraud and errors. This objective is achieved by disseminating the tasks and associated privileges for a specific business process among multiple users. IAM methods can prevent, detect, and resolve access rights conflicts to reduce the likelihood that individuals can act in a fraudulent or negligent manner. Once violations are identified, notification and remediation steps are automatically initiated based on corporate policies.

  6. Provide uniform access policy. IAM can provide administration and enforcement of common user access policies across a wide span of diverse systems, improving executive confidence in how the enterprise complies with HIPAA/HITECH requirements.

  7. Manage access based on business roles. Provisioning and auditing at the business role level, rather than just at the IT access control level, ties user access rights more closely to business processes. With a role management solution, managers can approve access rights that have a meaningful business context, thus reducing the risk of managers inadvertently creating SOD violations by granting carte blanche access to their direct reports.

  8. Enforce secure access policies. While automated identity administration, provisioning and auditing are essential to HIPAA/HITECH compliance, these methods don't actually enforce the use of security policies when a user accesses the controlled systems. IAM Access Management technology can enforce user access policy at the point of entry to an application or other system, in harmony with established policy. Examples of such enforcement include Web access management (including single sign-on or SSO), enterprise single sign-on (ESSO), and Web service security.

  9. Enforce informed consent principles. Informed consent principles (e.g. opt-in, opt-out, notice) can be enforced, based on identities of individual patients and potential users of personal information associated with such data.

  10. Extend access control to business associates. Identity Federation can extend access control beyond enterprise boundaries to enable secure access to electronic records while safeguarding the privacy of sensitive information. This is essential to complied with extended requirements of HITECH.

  11. Verify access rights. While automated user access provisioning is designed to accurately assign access rights, such access rights should be confirmed by audit. IAM can provide the ability to both assign access rights according to established polices and then periodically verify that access rights are still compliant with those same policies.

  12. Conduct periodic compliance assessments. Periodic audits of access rights and privileges can assure that security and privacy policies are consistently enforced. Re-certification is a process where managers approve direct reports’ access to enterprise resources and applications. IAM can provide the ability to automatically present managers with the correct information to attest to each employee's access rights needs. By applying role management principles, this re-certification process can enable the approving manager to work at the business-role level, attesting to those entitlements quickly and accurately because they are given in a meaningful business context.

  13. Provide automated reports. The delivery of accurate, timely and complete reports can assess compliance with established requirements. IAM can provide scheduled and ad-hoc compliance reports, including automated violation notifications, comprehensive work flow processes, and audit assessment reports. Such reports can generated across multiple systems and enterprise applications and be submitted to appropriate people within the enterprise, to business associates and to appropriate regulatory agencies.

I’ll share more excerpts soon and let you know when the full paper is ready for download.  Please stay tuned.

Thursday Nov 05, 2009

Identity Management Trends and Predictions: Index

Over the past several weeks, I have posted a series of articles about Identity Management Trends and predictions.  This brief post provides an index to that series of posts.

Overview article: Identity Management Trends and Predictions

Individual articles:

  1. Market Maturity
  2. Authentication
  3. Authorization
  4. Identity Assurance
  5. Roles and Attributes
  6. Identity Federation
  7. Regulation and Compliance
  8. Personalization and Context
  9. Identity Analytics
  10. Internet Identity
  11. Identity in the Cloud

Thanks for joining me in this little exploration.  Any feedback you might have would be most welcome.

Identity Trend 11: Identity in the Cloud

This post is the last in a series of eleven posts I have written about trends in the Identity Management industry. 

imageI am certainly not an expert in the entire field of cloud computing, but find it fascinating to learn about this significant trend in computing technology. I recently read a book entitled, “The Big Switch:  Re-wiring the World, from Edison to Google,” by Nicholas Carr, which proposed that the shift from traditional data center computing to a utility-based computing model will follow the same general trend that electricity generation followed – from a model of each individual factory maintaining its own electricity generation capability to our current utility-based electricity generation and grid delivery model.  While I agree that the general direction is correct, there are several factors which make a move to utility computing much more difficult than a move to utility electricity generation.  I’ll address some of my thoughts about those differences in a future blog post.

Nevertheless, we can see that just like Identity is a core platform technology for computing in traditional enterprise IT environments, Identity is a critical foundation for cloud computing or utility computing.  Identity may be a component of cloud computing infrastructure, or exposed as a separate set of services in the form of Identity as a Service (IDaaS).

In some ways, the challenges and solutions about Identity in the Cloud are similar to Identity in traditional data center.   However, there is increased technical and administrative/legal complexity because of the locations and increased number of physical and virtual components involved. 

A few of the areas of increased complexity include:

  • Scale and distribution: Large numbers of accounts on large numbers of servers distributed globally.
  • Division of responsibility: The different levels of cloud computing – Infrastructure as a Service, Platform as a Service and Software as a Service  - may be split between different service providers.
  • Security Policy: Logging and auditing are essential to assure that cloud providers are not circumventing or compromising security policy.
  • Risk Management: Risk profiles are different for cloud users, depending on type of company (e.g. difference between SMB and high profile public company).
  • Legal and administrative: Control of Identity is often be delegated to external parties, so more complex trust relationships must be put in place.
  • Pricing.  How will Identity Services in the cloud be priced? How can the business value of Identity Services be quantified?
  • Governance.  How will Identity governance procedures become more complex as the number of stakeholders and individual companies increases?

One example of this increased complexity was highlighted in a recent legal case, where a lawsuit filed against eBay in Pennsylvania was transferred to Santa Clara, California because of a clause in eBay’s user agreement.  As with many areas of technology advancement, I expect that legal and procedural issues associated with cloud computing will be a challenging as the technologies involved.

A number of companies are emerging with the express emphasis of Identity Management in Cloud computing.  A couple of such companies I have recently connected with are Symplified and Conformity.  I expect many more will emerge and that existing vendors of Identity Management software will release software versions specifically tailored for cloud computing.

For example, some interesting discussions about cloud computing have been held with Oracle recently.  When asked about cloud computing by Ed Zander at the Churchill Club on September 21, 2009, Larry Ellison remarked, “just a lot of water vapor – nothing new!”

On the surface, it would seem that Larry was denigrating the whole idea of cloud computer.  However, further discussions revealed that Larry thinks that cloud computing is just another label for technology that has been around for awhile.  Oracle has been offering their ERP applications in a hosted, pay-as-you-go model for a decade.  I actually worked on that initiative while employed by Oracle nearly a ten years ago.

Coincidentally, the day I heard about Larry Ellison’s comments at the Churchill Club, I learned that Nishant Kaushik of Oracle had recently given an interesting presentation entitled “Identity Services And The Cloud.”  He also gave a follow-on presentation at Oracle Open World, entitled, “Identity Management in the Cloud: Stormy Days Ahead?”  Clearly, Oracle is right in the middle of addressing the issues surrounding Identity in the Cloud.

Questions to consider:

As you consider the implications of Identity Management as it applies to cloud computing, perhaps these questions will help:

  1. How does your enterprise use cloud-based computing now?
  2. What are your plans for the future?
  3. How do you plan to leverage your existing Identity infrastructure as you adopt more cloud-based computing models?
  4. What information security challenges do you see in extending Identity and Access Management into the cloud?
  5. How will inclusion of multiple cloud computing vendors affect your privacy protection methods?
  6. How will you will you comply with internal and external audit requirements as you adopt cloud computing principles?

Tuesday Oct 27, 2009

Identity Trend 10: Internet Identity

This post is the tenth in a series of eleven posts I am writing about key trends in the Identity Management industry.

Much of the traditional Identity Management market grew up meeting needs of Identity Management for enterprises, but, of course, Identity plays a large, essential role in the external Internet as well.  Modern enterprises are increasingly interconnected using the external Internet, but usually when we speak of Internet Identity, we are discussing the relationships between individuals and online service providers, as opposed to users of internal enterprise systems.  In this context, at least two major characteristics of Internet Identity Management are substantially different than Enterprise Identity Management.

  1. Super-scale. Internet Identity systems must scale to accommodate hundreds of millions or billions of individual Identities, as opposed to hundreds of thousands in the largest enterprise Identity systems. Internet scale is enormous.  Billions of people in the world have online accounts, and most online users have several online accounts, often across multiple devices.   The administration of these enormous quantities of identity credentials is currently highly redundant, error prone and costly.  Yet demands for privacy and security impose high standards on these Identity systems.
  2. User-managed Identities.  Rather than supporting the typical “assignment” and “administration” of identity credentials in enterprise setting, Internet Identity systems typically allow users to “choose” and “manage” their own identity credentials.  Ubiquitous standard methods do not yet exist to allow a common set of Identity credentials, managed by individual users, to be used with multiple online service providers.  The current default method is for each service provider to act as its own “Identity Provider” as well as being a “Service Provider” or “Relying party” that accepts a standard credential.  For example, Google, Yahoo, Facebook and Amazon.com each operates its own Identity Provider function without allowing a user to use a common set of identity credentials across all these major service providers.  While technical standards exist to enable a common Identity Provider serving multiple relying parties, we have not yet seen broad acceptance of an Identity Provider / Relying Party Identity infrastructure.

Multiple companies such as Facebook, Google, Yahoo, PayPal and Equifax have expressed interest in becoming Identity Providers for the Internet.  Certainly they have demonstrated the ability to provide highly performant systems at Internet scale.  Some relying parties have begun to demonstrate acceptance of Identity credentials from such Identity Providers, but clear winners haven’t yet emerged.  For example, Facebook and Google both provide facilities for other online sites to accept their Identity credentials, but uptake by relying parties has been fairly limited so far.

The biggest obstacles slowing widespread acceptance seem to be:

  1. Business Model. Lack of a clear financial business model to support the separation of Identity Providers from relying parties.  It is yet unclear what financial compensation should be provided to an Identity Provider by a Relying Party.  What business model is financially sustainable? 
  2. User Control.  The desire of big service providers to maintain exclusive control over their own user base.  Online service providers recognize that huge value is inherent in a large user base, particularly when combined with usage data that can be mined to provide context and preference information as discussed in my recent blog post.
  3. Ease-of-use vs. Security. Tension that exists between the need for a secure Identity credential system and the need for extreme ease-of-use by online users.  Some methods, such as Infocard/Cardspace and OpenID, have definite ease-of-use advantages over traditional systems, but serious concerns exist about whether either system can support high levels of security or Identity Assurance.

An example of cooperative efforts to address these challenges is the US Government Open Identity Initiative, which seeks to leverage existing industry credentials for Federal use of Internet Access.  Trust frameworks from organizations such as the Kantara Initiative, OpenID Foundation, InfoCard Foundation and InCommon Federation are being considered.  Google, Yahoo, Paypal and Wave are participating in this project as Identity Providers.  While the current focus is on enabling Infocard/Cardspace and OpenID for low-security access to government websites, concern has been expressed that neither method would be sufficient for higher security needs.

Recommendations:

The following questions may be in order as you consider how your organization will address Internet Identity:

  1. How many online users do you have now?
  2. How fast are you growing?
  3. What specific security and privacy assurance levels must you provide?
  4. How could easy-to-use, yet highly secure Identity credentials help you and your users?
  5. Will you be willing to rely on a third party Identity Provider to authenticate users to your site?
  6. What control do you want to entrust to your users to manage their own Identities?

Identity Trend 9: Identity Analytics

This post is the ninth in a series of eleven posts I am writing about key trends in the Identity Management industry.

Whenever data is amassed and made available for analysis, the odds are great that someone will  figure out ways to derive new meaning from this data.  So it is with data related to personal Identity.  I believe we will see an explosion of data analytics being applied to Identity-related data for a number of applications.  Three emerging areas are briefly described in this post.

Authentication/Discovery

imageConsiderable evidence is available to show how each of us is progressively establishing a historical, logical  “fingerprint” based on our personal patterns of accessing online resources.   In a blog post entitled, “Anonymized Data Really Isn't,” I discussed how correlating “anonymized” data with seemingly unrelated publicly available data can pinpoint personal identities with frightening accuracy. 

In his address at Digital ID World, Jeff Jonas’ discussion about using data analytics to discover space-time-travel characteristics of individuals was both challenging and disturbing.  Mobile operators are accumulating 600 billion cellphone transaction records annually and are selling this data to third parties who use advanced analytics to identify space/time/travel characteristics of individual people, to be used for authentication and focused marketing activities.

I expect we will soon see many ways data analytics will be used for both positive and negative purposes, to very accurately identify individual people and leverage that identification for authentication and personalization purposes.

Context/Purpose

imageJust like data analytics can be used to identify who we really are, these methods can be leveraged to personalize the experience online users have with each other and with online applications.  As I discussed in my Identity Trend blog post about Personalization and Context, personalization increases the value of online user experience by presenting relevant content to a specific user at a particular time and tailoring the user experience  to fit what a user is doing at that time.  Data analytics can be used to evaluate both real time and historical information to answer questions such as:

  • What are you doing now?
  • What did you do recently in a similar circumstance?
  • Will historical patterns predict your preferences?

Perhaps the best-known example of this is Amazon.com’s recommendation service illustrated in the photo above.  In this case, based on my historical purchase pattern, Amazon recommended two books to me.  Ironically, Amazon recommended I purchase Seth Godin’s book entitled “Permission Marketing, which addresses some of these very issues we are addressing in this post.  In the next few years, we will most likely see more powerful and refined recommendation engines based on complex data analytics, adapted to a wide variety of user interfaces.

Auditing

imageThe big question surrounding IT auditing is, “Who really did what, when and where?”  While many tools exist for maintain audit trails and evaluating compliance with audit policy, I believe we will see and emerging class of tools to evaluate audit trails and logs in ways not anticipated by current tools.  A few examples:

Sophisticated ad hoc analytics may make it easier to discover patterns of fraudulent access that may be missed by more structured audit tools. 

Enhanced analytics may help improve the business role discovery process by detecting obscure usage trends in log data.

Recommendations:

Some questions you may consider to explore how Identity Analytics may affect your enterprise include:

  1. What Identity data do you currently store?
  2. What related data do you store that could be correlated with Identity data?
  3. Can data analytics be used to correlate data you store with publicly-available data to provide value to your enterprise and your customers?
  4. What additional business value could accrue to your organization base on such analytics?
  5. That privacy and security threats may exist to your employees and your organization if advanced analytics are used to correlate publicly-available data with data you make available?
  6. How could data analytics related to Context and Preference be used to enhance the way users interact with your organization?
  7. How can advanced analytics help you combat fraud or other cybercrime?
  8. How can you use advanced analytics to improve corporate processes?

Identity Trend 8: Personalization and Context

This post is the eighth in a series of eleven posts I am writing about key trends in the Identity Management industry.

Much of the work I have been doing with Sun Microsystems during the past year has been focused on how to leverage Identity to enhance personalization of user experience across multiple “screens of your life.”  Project Destination, a Sun initiative which I lead, is all about enhancing online user experience through “Identity-enabled Service Orchestration and Delivery.”

Personalization increases the value of online user experience by presenting relevant content to a specific user at a particular time and tailoring the user experience  to fit what a user is doing at that time.  An effective combination of Identity and Context is essential for personalization.

Context refers to the idea that computer systems and networks can both sense and react based on their environment. For example, devices may have information about the circumstances under which they are able to operate and based on rules, or an intelligent stimulus, react accordingly.  Context is not simply a state, but part of a process in which users are intimately involved and user interfaces are adapted in real time to accommodate changes in user or system context. For example, a context aware mobile phone may know that it is currently in the meeting room, and that the user has sat down. The phone may conclude that the user is currently in a meeting and reject any unimportant calls. Context-aware systems are concerned with the acquisition of context, the abstraction and understanding of context, and application behavior based on the recognized context. Context awareness is regarded as an enabling technology for ubiquitous computing systems.  The Wikipedia article, “Context Awareness,” provides more details and valuable links to material on the subject.

The emergence of Context as a key component of personalization will likely accelerate as service providers seek to answer demand for the delivery of identity-enabled, highly personalized, blended services to subscribers of modern networks.

imageCombining a third element, “Preference,” will enable further personalization.  In a blog post entitled, “Identity, Context, Preference and Persona,” I proposed that the concept of persona is best understood as the intersection of three elements: 

  • Identity = who I am
  • Context = what I am doing
  • Preference = what I want
  • Persona is not just a partial projection of one's identity.  It must take into account the context in which a person exists at the moment, and the preferences the person makes relative to that particular situation. Personalization of a product or service must be synchronized with the persona of a person at any relevant point in time - his or her current persona.

    I expect that two key context-enabled concepts will continue to gain more focus in the near future:

    1. Selective Personae refers to the ability of a person to choose which persona he or she desires to use in a particular context to enable certain types of online experiences.  For example,  online systems (such as BigDialog, a project directed by eCitizen Foundation and Massachusetts Institute of Technology) are emerging to enable citizens to interact more effectively with government officials.  In such a case, a context-driven, selective persona system may validate that a user is indeed a citizen, but allow the user to specify how much personal information (e.g. age, marital status, race) he or she wishes to expose for a particular conversation.
    2. Purpose-driven Web refers to providing a context-driven online experience focused on what a person is doing or wants to do at a particular time, not just what sites the person may be visiting on line.  For example, at the recent DIDW conference, Phil Windley, founder of  of Kynetx proposed to enable contextualized, purpose-based user experiences using the web browser as a point of integration.

    Recommendations:

    Consider questions such as these to determine how your organization can leverage Context to enhance user experience:

    1. How can a more personalized user experience strengthen the relationship between my customers and my organization?
    2. What new business opportunities can we leverage if we can deliver better user experience to our users?
    3. In what different contexts (e.g. in-store, via web browser, with mobile phone, via TV, at home, at work, during travel) do my user interact with my organization?
    4. How can we augment Identity information we have about users with contextual information to further personalize user experience?
    5. How can information I have collected about user interactions with my organization be leveraged to further personalize a user experience?
    6. What privacy and security regulations limit how we can leverage user information?
    7. Can we effectively leverage user opt-in or opt-out techniques to meet individual user preferences?
    8. How can we leverage new context-driven concepts such as Selective Personae or Purpose-driven Web to personalize the user experience for our customers?

    Identity Trend 7: Regulation and Compliance

    This post is the seventh in a series of eleven posts I am writing about key trends in the Identity Management industry.

    imageGovernment regulations have been enacted to address problems problems with fraud, governance, security and privacy arising in various industries.  For example, the Sarbanes-Oxley Act of 2002 (Sarbox) was intended to make corporate governance practices more transparent and to improve investor confidence. It addressed financial control and financial reporting issues raised by the corporate financial scandals, focusing primarily on two major areas: corporate governance and financial disclosure.

    Government regulations tend to become more complex and far-reaching over time.  For example, to address the challenges of security and privacy, the Health Insurance Portability and Accountability Act (HIPAA) was enacted by Congress in 1996 to establish national standards for use of health care records. HIPAA provided a foundation upon which multiple regulations have been based to address issues with the administration and protection of sensitive medical records information.

    Title XIII of the American Recovery and Reinvestment Act of 2009 (ARRA), also known as the Health Information Technology for Economic and Clinical Health Act (HITECH) includes a section that expands the reach of HIPAA by introducing the first federally mandated data breach notification requirement and extending HIPAA privacy and security liability to business associates of "covered entities" (generally, health care clearinghouses, employer sponsored health plans, health insurers, and medical service providers that engage in certain transactions on behalf of individuals).

    The current trend to more extensive government regulation of industry will likely continue or escalate, placing additional burden on enterprises to comply with increasingly complex compliance mandates.

    imageA second source for industry regulations comes from industry itself.  For example, the Payment Card Industry (PCI) Data Security Standard (DSS) is a global security standard for safeguarding sensitive credit card data.  This standard was established by PCI Security Standards Council, an organization founded by industry leading enterprises: American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa, Inc. The standard was created to help organizations that process card payments prevent credit card fraud through increased controls around data and its exposure to compromise.

    Identity and Access Management (IAM) is a critical enabler for compliance with government and industry regulations.  For example, Sarbox requirements for fraud reduction, policy enforcement, risk assessment and compliance auditing are supported directly by IAM technology and methods. By streamlining the management of user identities and access rights, automating enforcement of segregation of duties policies, and automating time-consuming audits and reports, IAM solutions can help support strong security policies across the enterprise while reducing the overall cost of compliance.

    Similarly, IAM technology and processes, which control user access to data, applications, networks and other resources, can directly support HIPAA/HITECH requirements for privacy, security, auditing and notification.

    Recommendations:

    Practical experience in the field gained as many enterprises have implemented IAM systems to support compliance efforts has yielded several recommended best practices for implementing IAM systems to enable HIPAA/HITECH compliance.  The following list of best practices will be explored in more detail in a subsequent blog post:

    1. Understand regulatory requirements that apply to your enterprise.
    2. Recognize IT's critical role in the compliance process.

    3. Understand the role of IAM in supporting compliance.

    4. Think of compliance as a long-term program, not a single project.

    5. Establish compliance policies. principles should be documented as a foundation upon which to build policies, practices and strategies.

    6. Develop a business-driven, risk-based, and technology-enabled compliance strategy.

    7. Collaborate with your business partners and associates.

    8. Establish a governance process.

    9. Implement your strategy in phases.

    10. Follow established standards.

    11. Give real-time visibility into compliance status, progress and risks.

    12. Unify disparate compliance efforts.

    13. Assess progress and adjust as necessary.

    Friday Oct 23, 2009

    Identity Trend 6: Identity Federation

    This post is the sixth in a series of eleven posts I am writing about important trends in the Identity Management industry.

    imageIdentity Federation refers to the “technologies, standards and use-cases which serve to enable the portability of identity information across otherwise autonomous security domains. The ultimate goal of identity federation is to enable users of one domain to securely access data or systems of another domain seamlessly, and without the need for completely redundant user administration.” (Wikipedia – Federated Identity)

    At the present time, Identity Federation technology has been well-proved is in production in many enterprises and government agencies.  As the most broadly deployed standard for enabling cross-domain federation, SAML is well supported by a wide array of software vendors.  Several successful business models have emerged to support federation technology, and implementation of this technology is becoming less complex.  This growth in adoption will most likely continue, both within and beyond enterprise boundaries.

    For several vertical markets, such as health care, the need for broad, integrated networks comprised of many interrelated enterprises (e.g. National Health Information Network) is accelerating the demand for federation deployment.

    However, business challenges associated with federation are often more difficult to address than technology challenges and continue to be the primary impediment to broader adoption of this technology.  Unless understandable and enforceable trust relationships exist between business entities, the technology to support such trust relationships is meaningless.  Just like technology standards have emerged to enable the technical side of federation, I expect that more standardized legal agreements will be developed to simplify the establishment of legal trust relationships.

    As cloud computing gains momentum as an alternative or complementary means to deploy systems and applications, federation can be a key technology to enable integration between various cloud systems or components.  Discussion of how employ federation in cloud systems has led to interesting statements such as proposed by Symplified, Inc., at the recent Digital ID World Conference: “Federation is Dead. Long Live the Federation Fabric.”

    The essence of Symplified’s argument is that using Identity Federation for point-to-point system integration is too complex and expensive.  Therefore a web or fabric of federation is needed to simplify and extend current federation models.  I expect that we will see “Federated Service Bus” technology to emerge to address this need, much like Enterprise Service Bus technology is currently employed to simplify complex integration challenges within enterprise systems.

    Recommendations:

    To determine how you should address Identity Federation, consider questions such as these:

    • Where have you already employed Federation?
    • Where can federation simplify integration within your enterprise?
    • Where would Federation enable more business value for your customers and your partners?
    • Which of these relationships is highest priority for you?
    • What trust relationships have you already established with other enterprises? 
    • What must you do to establish new trust relationships?

    Wednesday Oct 07, 2009

    Identity Management Is a Lifestyle

    Rolls Royce It is always enjoyable to read advice from those in the trenches of Identity management implementation.  As a recent guest blogger on the Identigral blog,  Tom Ebner outlined and explained ten best practice rules he learned while living the “Identity Management Lifestyle:”

    • Rule #1. Understand the problem and the opportunity
    • Rule #2. Assess the quality of the identity data
    • Rule #3. Create a strategic technical vision
    • Rule #4. Get (and keep) an executive sponsor
    • Rule #5. Build a great team
    • Rule #6. Add great partners to your team
    • Rule #7. Create a strategic technical architecture
    • Rule #8. Deliver something valuable to the business
    • Rule #9. Manage your risk
    • Rule #10. Understand and communicate “What does success look like?”

    Thanks, Tom, for excellent advice.  May your continued work in this lifestyle earn you the yacht and Rolls Royce your colleague talked about!

    (You’ll have to read Tom’s article to catch the significance of that last statement.)

    Identity Trend 5: Roles and Attributes

    imageThis post is the fifth in a series of eleven posts I am writing about trends in the Identity Management industry.  

    The use of roles for identity provisioning and audit compliance has seen growing acceptance in production systems.  Enterprises are getting more value in both operational efficiency and streamlining compliance efforts by leveraging business  roles.  Role management can support compliance efforts even if full automated provisioning is not in place. 

    Experience has shown that using a fairly modest number of roles relative to the size of the user population is most effective, rather than engineering and trying to maintain a large number of roles to take care of all circumstances.  A blend of role- and rule-based provisioning appears to strike the right balance.

    As roles are implemented, good governance methods are essential to oversee the entire role management life cycle, just as governance over the complete Identity management life cycle in needed.  The governance structure over both life cycles should be closely integrated.

    Some companies are finding a broader use of roles than realized at first.  Roles may have been first engineered to drive role-based access control and compliance enforcement, but can also be used for such things are evaluating organization and infrastructure effectiveness.

    Attribute-based access control (ABAC) is emerging as a possible alternative to role-based access control (RBAC), particularly for large, complex organizations such as government entities.  This has led some people to predict that ABAC will replace RBAC.  However, if we consider that roles are really a form of attributes attached to Identities, we could predict that the two methods will converge – with the best approach being a balance that leverages roles where appropriate, and attribute-driven rules where that approach makes sense.

    Recommendations:

    Consider questions such as the following:

    1. Where can roles be leveraged to improve the effectiveness of your Identity provisioning and compliance system?
    2. What is the right balance for your organization in the number of roles and the rules that complement the roles?
    3. How can you effectively govern both the Identity life cycle and role life cycle in your organization?
    4. Are there ways you can leverage the role infrastructure you have adopted in other ways besides RBAC and compliance?
    5. Can emerging methods such as ABAC bring further efficiencies to your operation?

    By the way, the stack of hats shown above served to represent different roles or personae a person may possess in a tongue-in-cheek blog post I posted earlier this year: Have a Token: ID Hats and Personae.   I liked Dave Kearn’s perceptive comment to that blog: “Good analogy Mark, but I'm afraid that those of us who understand the phrase ‘to wear different hats’ are getting grayer, plumper and more forgetful every day! People just don't wear a good homburg, Stetson or Panama any more....”

    Tuesday Oct 06, 2009

    Identity Trend 4: Identity Assurance

    imageThis post is the fourth in a series of eleven posts I am writing about important trends in the Identity Management industry.

    When you present identity credentials to log into an enterprise system or online Internet site, are you really whom you claim to be?  Do your credentials represent the “real you?”

    I published one of my favorite blog posts, entitled “OpenID Credibility: Harry and Bess Truman,” back in June, 2007.  A brief excerpt:

    I visited MyOpenID.com and was issued an identifier for Harry Truman: http://harrytruman.openid.com. No validation, no verification of Harry's real Identity. I just plugged in President Harry Truman's birthday and home town. I did use my own personal email address, but it wasn't even validated at the time.

    Armed with my new bogus identifier, I marched over to Jyte.com and made a couple of claims: The Buck Stops Here and I Love Bess.

    Interestingly enough, the Jyte.com links still work!

    This little exercise, where I wasn’t really THE Harry Truman, illustrates the need for Identity Assurance to validate whether my identity credentials really represents who I really am. Identity Assurance can be described as “a means to allow Identity Providers (IdPs), Relying Parties (RPs) and subscribers to determine the degree of certainty that the identity of an entity presenting an electronic identity credential is truly represented by the presented credential.”

    With the continual expansion of online fraud and other threats to online security and privacy, the need for Identity Assurance methods are rising.  Being able to certify the that the correct Identity credentials are issue to the correct user before access is attempted is an increasingly critical issue.

    The Liberty Alliance Identity Assurance Framework defines four progressive levels of assurance, depending on confidence in the asserted identity's validity, as shown in the following table from the Liberty Identity Assurance Framework document.

    liberty_assurance01

    By comparing the assurance level against the potential impact of authentication errors, we get a clear picture of how the wide spectrum of online access transactions require substantially different levels of Identity assurance.

    liberty_assurance02

    My impersonating the late Harry Truman requires minimal assurance because the potential impact for the transactions I conducted is minor.  However, at the other end of the spectrum, identity credentials used to conduct high value financial transactions protected by civil or criminal statute are probably worthy of far more stringent Identity Assurance screening.

    So, who is responsible to issue high level credentials?  Should it be the government, who is responsible for issuing validated credentials like birth certificates, passports and drivers licenses?  Should it be private enterprise?   It depends on the two factors illustrated above: Assurance Level and Potential Impact.

    Recommendations:

    Consider these questions for your specific cases:

    1. What level of assurance do you require to match the risk (potential impact) to the cost and complexity of issuing identity credentials?
    2. What different levels may be appropriate for different applications or systems for which you are responsible?
    3. What sources of validation are appropriate to assure that the identity credentials you issue are valid?
    4. What should the role of government or private enterprise have in Identity assurance?

    By the way, I still think Harry and Bess look good together.  What do you think?

    Monday Oct 05, 2009

    Identity Trend 3: Authorization

    This post is the third in a series of eleven posts I am writing about trends in the Identity Management industry.

    imageOne might say that simple authorization is like permitting entry through the front gate of an amusement park, while fine grained authorization is like granting access to each individual attraction within the amusement park separately, based on some sort of policy.  Following this analogy, the most common method of Identity Management Authorization is like a full-day pass to Disneyland granting access to the front gate as well as every ride in the park.  Similarly, simple Identity Management authorization allows access to all functions within an application.

    imageHowever, a trend is growing towards using standards-based, fine grained authorization methods to selectively grant access to individual functions within applications, depending on user roles or responsibilities.  For example, one user could be granted access to only simple data browsing privileges, while another user could be grated data creation or edit privileges, as determined by a policy stored in XACML format.   The definition and enforcement of this fine-grained authorization would be externalized from the application itself.

    At the present time, fine grained authorization is desirable but difficult to implement.  It appears to be easier to define and control policies in an Identity system than changing each application to rely on an external system for authorization policy. 

    Much is being discussed about policy management standards (e.g. XACML).  Several vendors are effectively demonstrating interoperability based on XACML, but such systems are not yet in broad production.

    Recommendations:

    As progress is being made in both management of standards-based policies and the enforcement of such policies within applications, the following questions could be considered:

    1. Which of your applications could benefit most from fine-grained authorization?
    2. How would externalizing policy management and enforcement streamline your applications?
    3. How could standards such as XACML improve the management of security and access control policies in you organization?

    Friday Oct 02, 2009

    Identity Trend 2: Authentication

    This post is the second in a series of eleven articles I am writing about trends in the Identity Management industry. 

    After all is said and done, Authentication continues to be right at the heart of Identity Management.  Determining whether the correct set of Identity credentials is presented, so a person or process can be granted access to the correct system, application or data, is critical to the integrity of the online experience.   Authentication is like the gatekeeper or enforcer who determines who gets in the door. 

    1. Demand for strong authentication is accelerating as the sophistication and sheer numbers of people who would defraud or damage online systems continue to grow.  More effort is being focused on just how to economically, but securely, implement strong authentication methods to protect confidential information.
    2. As the need for strong authentication grows, there has been considerable conversation about whether the pervasive use of passwords is headed for extinction.  Is the password really on its deathbed? In a Network World column posted earlier this year, Dave Kearns equated passwords to buggy whips.  In my response entitled Passwords and Buggy Whips, I challenged “Replace username/password with what?"  Until we get wide acceptance of alternate methods, it is unlikely that passwords will join buggy whips in the dustbin of history.
    3. In a subsequent post entitled, Seat Belts and Passwords ... and Buggy Whips, I proposed that “until ease of use makes passwords irrelevant, people will continue to use buggy whips or drive without seat belts.”  The key issue dogging the industry is how to provide identity credentials that are so easy to use that the technical unsavvy majority can easily use them while providing a level of security commensurate with the rising tide of online threats.

    Recommendations:

    1. Assess what level of security is needed for different areas of your enterprise.  In some cases, authentication must protect high value information.  In other cases, less strong authentication may be appropriate.
    2. Seek to understand what your users need.  What methods are both secure and easy to use for them?
    3. Is the cost of strong authentication commensurate with the risk of data loss or compromised system access?
    4. What is the best combination of authentication methods to serve my user community and protect my business interests?

    Many years ago, while involved in a large physical security project, we joked that you need to invest enough in your security system so it is cheaper to bribe the guard than to breach the electronic system.  The same principle may be true with Identity Authentication.

    Thursday Oct 01, 2009

    Identity Trend 1: Market Maturity

    This post is the first in a series of eleven posts I am writing about trends of key importance to the Identity Management industry.

    As the following series of photos shows my son Eric progressing from infancy to young adulthood, the Identity Management market has matured, but still has a bright future ahead.

    maturity

    The Identity Management industry has been building for about a decade.  The market is definitely maturing out of adolescence into young adulthood.  Key characteristics of this maturing market include:

    1. Much focus is being given to best practices of how to maximize enterprises’ investment in these systems.  Rather than focusing on green field Identity implementations, enterprises are concentrating on system refinement, expansion or replacement.
    2. While the industry quite universally agrees that “quick wins” are essential first steps to implementing Identity Management systems, significant additional value can accrue as enterprises expand the reach and scope of their Identity infrastructure.
    3. The importance of Identity governance is becoming entrenched in enterprise culture, as holistic initiatives to address the broad areas of governance, risk and compliance recognize the critical importance of Identity Management in these processes.
    4. Experience has shown that Identity Management is a journey, not a destination.  Enterprises are recognizing that they must approach Identity Management as a long-term program, not a single project.
    5. The industry continues to consolidate, as we at Sun are well aware.  While there are still several emerging niche companies, larger vendors offer complete suites of Identity Management products.
    6. The major business drivers for investing in Identity Management systems still continue to be regulatory compliance, operational efficiency/cost and information security.  However, more focus is being placed on Identity as a key enabler of customer satisfaction through context-aware personalization.
    7. Identity Management is also moving down market, particularly as vendors and systems integrators are addressing the issues of rapid deployment and reduced pricing for smaller businesses.

    Recommendations:

    In light of this maturing industry, I recommend that enterprises concentrate primarily on the business value Identity Management can deliver.  Questions such as these are appropriate:

    1. Where am I on the journey to implement Identity Management in my enterprise?
    2. Where has Identity Management already delivered value to my business?
    3. Where else can Identity Management deliver value?
    4. How can Identity Management enable Privacy and Security?
    5. How can Identity Management enable compliance?
    6. How can Identity Management increase efficiency and reduce cost?
    7. How can Identity Management enable a better user experience to my customers?
    About

    Discovering Identity was founded on blogs.sun.com in May 2005 as a means of documenting my exploration of the field of Identity and Access Management. In February, 2010, I switched to hosting the blog at DiscoveringIdentity.com. In March 2012, I began posting Oracle-related information in both places.

    Thanks for stopping by.

    Please connect with me in cyberspace at LinkedIn or Twitter.


    The views expressed on this blog are my own and do not necessarily reflect the views of my employer, Oracle Corporation, or any other person or organization.

    Search

    Archives
    « April 2014
    SunMonTueWedThuFriSat
      
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
       
           
    Today