On Making a Business Case for Identity Management …

A recent article, by Katherine Walsh, titled “How to Make a Business Case for Identity Management” provides a few tips on how to articulate a business case for Identity Management:

• Decide what IdM means to you
• Articulate the Business Performance and Productivity Benefits of IDM
• Create a Tangible, Phased Implementation Plan
• Don't Forget to Have a 'Mr. or Ms. IDM'--Is This You?
• Avoid Scare Tactics or Pigeonholing

I think that, from a CSO/CISO perspective, it would also make sense to clearly articulate the Business Risk Mitigation factors that IdM could bring …

--- NOTE: my original HP blog can be found here ---

On the “Identity Oracle” and Improper Disclosures

I have been following with great interest the thread of discussions about the business concept of “Identity Oracle” and related posts by Bob Blakley, Kim Cameron (here and here), Jeff Bohren and Phil Hunt.

I wondered for a while about business models and business scenarios for “Identity Providers” (e.g. see here and here): the idea of the Identity Oracle can have some good, interesting potential.

However, there is one thing, about the Identity Oracle, that is puzzling me, based on what Bob Blakley wrote in his post:

“… The Identity Oracle charges GiCorp and other relying-party customers money for its services. The asset on the basis of which the Identity Oracle is able to charge money is its database of personal information. Because personal information is its only business asset, the Identity Oracle guards personal information very carefully.
Because disclosing personal information to relying-party customers like GiCorp would be giving away its only asset for free, it strongly resists disclosing personal information to its relying-party customers. In the rare cases in which relying parties need to receive actual personal data (not just metadata) to do their jobs, the Identity Oracle requires its relying-party customers to sign a legally binding contract stating what they are and are not allowed to do with the information. This contract contains indemnity clauses – if GiCorp signs the contract and then misuses or improperly discloses the personal information it receives from the Identity Oracle about Bob, the contract requires GiCorp to pay a large amount of cash money to the Identity Oracle, which then turns around and reimburses Bob for his loss. …”

How are (in practice) improper disclosures of personal data going to be detected? And what would be (in practice) an “improper disclosure”? Some misuse of credit card details? Spamming emails?

I guess that to be a viable business, the Identity Oracle needs to have relationships with many Relying Parties – which themselves might have relationships with other parties. How to track the source of improper leakages/data misuses? Wouldn’t the cost of “forensic analysis” be potentially very high for the Identity Oracle (which I assume it must make the first steps in investigating the incident and in finding the source of improper disclosure)?

Wouldn’t this also be a potential source of frauds against the Identity Oracle, paradoxically generated by some of its own “customers”, trying to get money/compensations back by orchestrating “improper disclosures” and relying on the fact that it will be hard to pinpoint the culprit?

How would the legal framework help the Identity Oracle in these situations? I am afraid this might end-up with very restrictive “terms & condition” imposed by the Identity Oracle (to protect its own interests) that eventually won’t be of any benefit to honest users (the very large majority) in case of genuine identity misuses.

I would be very interested in getting opinions and views about the above aspects.

--- NOTE: my original HP blog can be found here ---

Part II: To Be or Not To Be an Identity Provider?

In a recent post, James McGovern makes this comment about a post of mine, called “To Be or Not To Be and Identity Provider?”:

“One should never research the notion of the business model of identity providers from scratch when there are many already in existence. How about starting with Securities Hub to not only understand the business model of being an identity provider but why it matters in an industry vertical context which most identity bloggers pretend don't exist.”

Well, I’ve never said I was researching on this topic – I was just trying to understand the business model …, as I also wrote in a previous post of mine called “What is the Business Case for Identity Providers?”: “I wonder what would be the incentive for an organization to be an Identity Provider (IdP) and, in particular one that just plays this role i.e. with no additional stake in providing other services”.

Anyway, thanks for suggesting an example – even if this example looks like more being about a “Hub-based Service Provider” rather than an “Identity Provider” …

Any other example? In particular where the role of the Identity Provider is clear, whatever underlying federated identity management solution is adopted.

--- NOTE: my original HP blog can be found here ---

What is the Business Case for Identity Providers?

I’ve recently been asked by a customer what would be the business case for Identity Providers, in the context of federated identity management …

This question specifically referred to Identity Providers that just play this role i.e. have no additional stake in providing other services (e.g. being also Service Providers) and, by doing this, ensure real “separation of duty” between who handle identities & authentication (them) and relying parties that “consume” this information.

Any link to available material (so far, I haven’t found anything particularly relevant)? Any thought?

--- NOTE: my original HP blog can be found here ---