What’s the Future of Enterprise Identity Management? Risk Management …

I believe that Risk Management is going to have a deep impact on Enterprise Identity Management.

On one hand “Traditional” Enterprise Identity Management solutions (e.g. provisioning solutions, AAA, storage solutions, etc.) are under consolidation.

On the other hand, there is an increased urge to assess and (automatically) deal with risks and vulnerabilities affecting enterprise “assets”, driven by business and security perspectives. In this context, it is going to be important to accurately assess risks, vulnerabilities and threats for identity (and privacy) management practices, processes, solutions and related assets.

Of course, a few “Identity Risk Management” solutions are already aware on the market and there is a consolidation process in the consulting space. However, the big challenge has to come in a few years, because of the increased adoption of open “web 2.0” solutions by enterprises, the blurring of enterprise boundaries and a workforce that is more and more “accustomed” to use “social networking solutions” in their private and professional activities (and consequently expose enterprise information and assets to the external world).

It will be very important to be able to assess and mitigate risks about “confidential information” that has been directly or indirectly exposed to the web in terms of enterprise systems, plans, projects or activities and whose discovery and correlation (by third parties) can provide relevant insights and intelligence about enterprise “high-value” strategies and practices.

Ultimately “risk analysis” solutions will be used to assess threats concerning the overall “identity” of an enterprise in addition to the ones related to its assets …

--- NOTE: my original HP blog can be found here ---

Lots of Warnings about “Enterprise Web 2.0” Risks – What about Identity 2.0?

A recent article by Robert Mullins, called “Enterprises warned to approach Web 2.0 with caution”, says:

“Danny Allan of IBM had just finished his primer on potential security risks of Web 2.0 applications when enterprise software developers filing out were overheard telling each other, “That was scary!” and “Now I’m depressed.” Allan says he didn’t mean to scare, but to educate. “The lesson is not to run away but to prepare,” said Allan, director of security research at Watchfire, an IBM-owned security firm”

This is also consistent with what HP SPIDynamics said sometimes ago, in particular about security risks and issues with Enterprise Web 2.0 (see here and here).

In a previous post of mine, called “Web 2.0/Ajax “Submission Throttling” and Privacy Concerns” I also highlighted a (simple) example of a potential Web 2.0 privacy threat (ok, this was primarily from a B2C perspective, but this could also apply to enterprise and federated IdM contexts …). I am sure this is just the tip of the iceberg …

I would be interested in knowing what the outcome of a similar risk/security/threat analysis/assessment would *specifically* be for “Identity 2.0”-based solutions (including Liberty Alliance, of course …) – in B2C, Enterprise and federated IdM contexts.

I believe there will be interesting findings, from a privacy and data security perspective, in particular when dealing with personal and confidential information.

--- NOTE: my original HP blog can be found here ---

Liberty Alliance - a New Identity Assurance Initiative

On Sunday, 9th September, Liberty Alliance has announced the creation of a new Identity Assurance initiative:

“Liberty Alliance, the global identity consortium working to build a more trusted Internet for consumers, governments and businesses worldwide, today announced it has formed a new expert group to deliver the Liberty Trust Framework, an organizational framework designed to fill industry requirements for standardized identity assurance criteria for use in a broad range of federation scenarios. Liberty’s Identity Assurance Expert Group (IAEG) was established by the recent merge of the Electronic Authentication Partnership (EAP) into Liberty Alliance, and consists of representatives from the worldwide financial services, government, healthcare and service provider sectors working collaboratively to release the Liberty Trust Framework for public review and input later this year. The Liberty Trust Framework will remove a major barrier to global inter-federation deployments: the complexity of assessing the level of identity assurance among all organizations participating in federated relationships. Currently, different federations have varying policies and processes governing identity operations, the interpretation of which adds to the cost and complexity of deploying assured identity services. …”

Hopefully this initiative will help to define comprehensive requirements and criteria for “Identity Assurance” in Federated Identity Management contexts.

A few colleagues of mine and I recently wrote an HP Labs Technical report on a related topic, called “On Identity Assurance in the Presence of Federated Identity Management Systems”.

In our view Identity Assurance must be concerned with the proper management of risks associated with identity management. In an enterprise context, “processes” define how identity information has to be managed; identity management technologies ease the burden of dealing with them, by automating some of the related operational aspects. However, it is of paramount importance to ensure that these processes are well controlled and therefore risk is controlled – hence the need for identity assurance. Prior to defining an identity assurance framework, a risk analysis needs to be carried out identifying the identity assets (e.g. user accounts, user profiles, user rights, etc.) and the impact if there is a loss of confidentiality, availability or integrity along with threats that could lead to such losses. From an understanding of risks an enterprise can make decisions about the control objectives (strategies for mitigating risks) they need and ultimately design the controls that need to operate to achieve these objectives. Typically controls will be additional stages in management processes designed to mitigate risks (e.g. an approval step) although they may be technological mechanisms.

The interesting challenge is how to enable Identity Assurance in a federated identity management context, where multiple organisations need to collaborate and share information to achieve this. In our paper we suggested a potential approach to move forward …

--- NOTE: my original HP blog can be found here ---

TrustBus 2007: presentations on “Device-based Identity Management in Enterprises” and "Challenges and Opportunities in IdM”

I am back from Regensburg, Germany where I attended and presented at TrustBus 2007. This conference was very interesting for the variety of presentations and covered topics, including:

• aspects of trusted and secure virtual organisations;
• identity management and usage control;
• authentication and access control;
• compliance and user privacy;
• policy management;
• secure system management and trust.
  

In this context I gave a presentation on our work on “Device-based Identity Management in Enterprises”. My presentation is available here: it describes the outcome of our related R&D project, where we explored ways to model and represent device identities (and the role that Trusted Computing/TPM can play), provision these identities by leveraging enterprise IdM solutions and use them to define access control policies. Technical results and outcomes are shared.

I’ve also been involved in a panel discussion on “Managing Digital Identities – Challenges and Opportunities” (chair: Gunther Pernul). My presentation (along with my view on top challenges and opportunities in the IdM space) is available here. The other panellists gave interesting presentations, with additional, complementary views of IdM challenges and opportunities, from government, software developer and academic perspectives. Hopefully their presentations will be made available online.

--- NOTE: my original HP blog can be found here ---

On the Role of “Role Mining” in Enterprises

I believe that “Role Mining” is and will become more and more relevant in enterprises and complex organisations. Too many changes happen nowadays in enterprises (changes in org charts, merge & acquisitions, business-focus changes, increased outsourcing of activities and temporary labour force, etc.). How to ensure that the right people/groups have the necessary access rights in a context that is constantly changing?

Good practices and processes, auditing and compliance checking are ways to achieve for … However, “Role Mining” solutions can provide additional help, from an operational perspective, to identify “organisational roles” that reflects current security and access control permissions associated to employees. The analysis of the outcome of a “role mining” activity can sometime reserve surprises …

“Role Mining”, at the very core, is about identifying and extracting meaningful “roles” in an enterprise from “row data” (e.g. access control rights, ACLs, etc.) by using different techniques (e.g. data mining, clustering, etc.). A related, interesting paper on Role Mining can be found here.

Solutions are already available in the market: however I believe this is still a green field, open to innovation – in particular if we consider this in the overall context of Enterprise Identity Management (by including provisioning, access control policy setting and compliance management).

After all, the effectiveness of “Role Mining” solutions and related techniques can be measured in their capability of extracting meaningful set of roles, from a business perspective (i.e. meaningful to and comparable with an enterprise organisation) rather than purely from a technical perspective (i.e. a list of “labels” identifying abstract roles) and helping administrators to spot potential anomalies and suggest remediation steps – integrated wit hstate-of-the-art identity management solutions.

--- NOTE: my original HP blog can be found here ---

New “Identity & Access Management Services” Report

I’ve just come across this site providing an overview of a new report (to be released in September 2007), titled “Identity & Access Management Services”, by Research&Market:

“The "Identity & Access Management Services” report provides extensive research and rational analysis on the Identity Management industry at global level. This report has been made to help clients in analyzing the opportunities, challenges and drivers critical to the growth of identity management service industry. The forecast given in this report is not based on a complex economic model, but is intended as a rough guide to the direction in which the market is likely to move. It is based on a correlation between the past market growth and growth of base drivers….”

Here are some of the key findings of this work, including a list of the issues, facts and players that have been analysed:

“Key Findings

• Identity management services industry is expected to grow at a CAGR of 7.28% over the period 2007 to 2011.
• It is forecasted that hardware token authentication market will grow at a rate of 10.72% from 2003 to 2009.
• Increasing investment in identity management-related technologies will further drive the identity management services industry in future.
• Use of identity management services will curtail the administrative time up to 50%.
• Identity management services can be applied to different industry verticals like banking, defense, and automotive manufacturing.

Key Issues and Facts Analyzed

• The market size of the global identity management services industry.
• Analysis of various challenges and opportunities for the industry.
• The factors driving growth in this sector.
• SWOT analysis of key players operating in the industry.
  

Key Players Analyzed

This section covers the key players operating in the global identity management service industry including BMC Software, Inc., Computer Associates, Novell Inc., Cisco Systems Inc., Accenture, IBM Corporation, Hewlett Packard Co. etc.”

Further information is available here, including a “Table of Content”.

The “Industry Analysis” (and related SWOT analysis) and “Future Outlook (2007-2011)” sections might potentially provide some interesting insights about the current status of Identity Management Technologies/Services and where this area is heading: however it must be said that this report is not free (and actually it is quite expensive …).

--- NOTE: my original HP blog can be found here ---

OpenId and its Security, Privacy and Trust Issues: Next Steps to Address Them?

I agree with the comments made by Jeff (in a recent post called “Compendium of OpenId Issues”) about current OpenId limitations. I’ve also found the analysis made by Stefan Brand in his post about current OpenId issues very educational and comprehensive.

Of course, I believe that OpenId provides value but I also see some of the key limitations and related threats (in terms of privacy, security and trust), when considering them from (1) an end-user perspective and (2) potential future adoption of OpenId in enterprise contexts – if “valuable” transactions and/or assets are involved.

Kim Cameron’s post, called “Integrating OpenId with InfoCard”, suggests an interesting approach to mitigate some of these issues (in particular identity phishing) by leveraging InfoCard/CardSpace. I’ve also found in the web other people’s suggestions and ideas on how to solve other specific issues.

However, in general, what is OpenId community’s reaction to these issues and criticisms? Is there any site/documents tracking these issues and describing how the OpenId community thinks to address them, along with plans/roadmaps?

“Content-Aware Access Control” and Enterprise Web 2.0…

Web 2.0 is eventually going to have an impact on Enterprises, at least in terms of collaborative tools. Employees, familiar with Web 2.0 mash-up tools, social network tools, etc., (because they use them in their “private lives” …) will gradually find these tools (and related approaches) more and more relevant and useful also in their day-to-day work, in organising their information, generating content and sharing it with other colleagues. This will have an impact on enterprise collaborative solutions. It is already happening …

However, collecting and organising information within enterprises is subject to business rules, security and privacy constraints. Depending on the level of confidentiality, people’s roles and current stages of business activities (e.g. a Merge & Acquisition process, a security/audit review, a product development, etc.), different “views” and “perspectives” on information need to be provided to different employees for specific reasons. Generated and collected information can be unstructured or only partially structured.

Whilst collaborative and mash-up tools on the web might only need simple access control (or no security at all), a quite different story applies for enterprises. These tools and solutions needs to be “adapted” and re-thought in an Enterprise context.

I am still looking for additional use cases and business cases for Identity 2.0 in enterprises (see here and here …): however I think that there is an opportunity and a role for “Content-Aware Access Policies” and “Content-Aware Access Control” for Web 2.0 collaborative solutions in enterprises.

Content-Aware Access Policies define fine-grained access control constraints on information (for example collected in enterprise collaborative/mash-up tools), by keeping into account different types of content, its actual content and contextual parameters (users, their role, system information, etc.). They reflect business, security and privacy constraints directly on valuable information and content. Part of these policies can be defined directly by people (employees) generating “content” and coupled to this content. In this scenario, the definition of access policies becomes itself the result of social/collaborative networks (in enterprise contexts).

Content-Aware Access Control is driven by these policies: it is not only about allowing (or denying) access to a piece of information (as a whole entity), but can provide fine-grained views and perspectives on this information by processing and manipulating the content.

I think there is an opportunity in exploring models and criteria to express these policies and enforce them with “appropriate” access control systems – by leveraging and extending existing Web 2.0 collaborative solutions. I am very interested in knowing your views and comments on this.

An Identity Management Survey for the Financial Sector …

I came across this article by ITWeb (South Africa), called “ID Management Survey call for entries”, highlighting the fact that “The Tshwane University of Technology has constructed an identity management survey, and is inviting public participation to aid with its research”.

The identity management Community might be interested in contributing to this survey. NOTE: I didn’t find any link form this University to the survey web site, but the survey site provides some contacts to ask questions to.

The article says that “The faculty of ICT aims to use the results of the survey to develop a generic implementation model for identity management in the financial sector.” The survey web site also says that “This will help identify to what extent different organisations agree on what identity management entails, as well as what the requirements are for implementing an identity management solution”.

On Company Policies and Impact on Identity Theft …

Ian Williams’ article, titled “Poor company policy aids identity thefts”, provides an overview of a recent report by Experian:

“Many businesses are still in the dark ages when it comes to making sure customers are who they say they are, reveals a new report by risk management experts Experian.
The report shows that 70 per cent of financial services companies still rely on fraud-friendly paper documents to authenticate a person's identity, and 36 per cent of retailers and 40 per cent of telecommunications companies are still doing it.
According to the survey too many industries are left hamstrung by their reliance on the use of passports, utility bills and driving licences for authentication, despite the fact that electronic systems are generally considered to be safer and faster for all concerned. The report is based on interviews with 1,500 consumers and anti-fraud, risk and compliance experts from 70 businesses in the UK.”

It would be interesting to have a comparative analysis across different countries (e.g. in EU, US, etc.) showing the impact that different companies’ policies have on identity theft.

Part II: Enterprise Use Case for OpenId and/or InfoCard …

Thanks to James McGovern for his input and his articulated reply to my comments. James, I see we have some different views in terms of B2B and outsourcing, at least concerning potential deployments of OpenID or InfoCard. I see your points and I found them useful to better understand your perspective.

The key reason, at this stage, for asking for enterprise use cases for OpenId and InfoCard in enterprise is primarily curiosity and interest in better understanding this space. Most of my IdM R&D work is actually “enterprise-centric”: I am keen to explore how recent “user-centric” trends might impact the enterprise.

Going back to this initial question, any additional input or view from the Community would be welcome.