New Forrester’s Report: “Identity Management Market Forecast: 2007 to 2014”

An article written by Tim Wilson, called “Identity Management Ready to Skyrocket”, provides an overview of the content of a new Forrester’s Report, “Identity Management Market Forecast: 2007 to 2014”. Have a look to get same insights …

The executive summary of this Forrester’s report follows:

“The identity management — or identity and access management (IAM) — market will grow from nearly $2.6 billion in 2006 to more than $12.3 billion in 2014 (including revenues from both products and implementation services). Provisioning accounts for half of IAM market revenues today, but it will account for nearly two-thirds of all IAM revenues by 2014. Even after years of healthy adoption rates, the IAM market is actually just beginning its trajectory toward broad adoption and deep penetration. Moreover, during the next seven years, we will also see buying behavior migrating from point products to identity suites — and, to a lesser extent, from products to managed services. Meanwhile, vendors will decompose products into service-oriented architecture (SOA)-enabled functions, repackaged in the form of identity-as-a-service (IDaaS)”.

I read the actual report. I found the section on “Future Directions for Identity Management” interesting but, in my view, there are no major surprises …

--- NOTE: my original HP blog can be found here ---

On the “Identity Self-Defence Course” …

Have a look at this interesting post by Doug Pollack, titled “Are you Well Protected?”:

“As we look forward to what is in store for us in 2008, The Identity Theft Resource Center is projecting an increase in both the number of security breaches and incidents of identity theft. With this as a backdrop, we've developed a set of recommendations for people to protect themselves. As part of our ID Self-Defense Academy, a component of our subscription services member website, this Self-Defense Checklist includes both common sense suggestions that you are likely to be familiar with, as well as others that are new this year given the evolution in the use of the internet and computers in identity theft.”

Actually, this post provides an “ID self-defence check list” about:

• Protecting yourself at home
• Protecting your computer and Internet access
• Protecting yourself on the road

Of course, all this is pretty much based on common sense, but it provides a useful reminder …

--- NOTE: my original HP blog can be found here ---

Information Security Management: Top Priority in 2008?

An article, published by Reuters and called “Information Security Management Still Number One Concern”, provides an overview of the recent American Institute of Certified Public Accountants (AICPA)' 19th Annual Top Technology Initiatives survey:

“The AICPA poll was conducted in late 2007 with ISACA, the Institute of Internal Auditors (IIA) and the Information Technology Alliance (ITA). Respondents identified the top 10 most important technology initiatives for 2008 as follows:

1. 1. Information Security Management
2. 2. IT Governance
3. 3. Business Continuity Management and Disaster Recovery Planning
4. 4. Privacy Management
5. 5. Business Process Improvement, Workflow, and Process Exceptions Alerts
6. 6. Identity and Access Management
7. 7. Conforming to Assurance and Compliance Standards
8. 8. Business Intelligence
9. 9. Mobile and Remote Computing
10. 10. Document, Forms, Content and Knowledge Management

A selective group of 1,169 finance, accounting and technology participants ranked 29 technology initiatives they felt would have the most significant impact on their organizations in the next 12 to 18 months.”

Please notice that both Privacy Management and Identity Management appear in this list.

This article also reports that Lynn Lawton, International President of ISACA, made this interesting statement: "Recent studies show that investors are willing to pay a premium of up to 20 percent more for shares of enterprises with reputations for good IT governance practices; properly governed IT is critical to an organization's success."

--- NOTE: my original HP blog can be found here ---

Who Am I?

Well, on the Web this also depends on the search engine …

As a simple test, I searched (on 23 December 2007) for my surname, “casassa mont”, by using three popular search engines:

• Google: 5470 results
• Microsoft MSN: 15900 results
• Yahoo: 5070 results

Quite interestingly Microsoft MSN indicates a (potential) number of findings 3 times greater than the ones provided by Yahoo and Google … This ratio is pretty much the same also for a more specific search, about “marco casassa mont”:

• Google: 3960 results
• Microsoft MSN: 9940 results
• Yahoo: 3790 results

In this simple test, these search engines provide consistent information about my “web profile”: MSN also includes some oddities, i.e. specific findings not immediately spotted by the other two search engines. Of course I didn’t check for all the findings, just the first 30 …

Just wondering about the impact that “Consent and Privacy Management” could have on “digital personae”, in the context of the web and search engines …

--- NOTE: my original HP blog can be found here ---

Are Kids the New Targets of Identity Thefts?

A recent article, titled “Children Becoming Prime Identity Theft Targets”, reports the findings of a recent study by the Identity Theft Resource Center:

“According to a recent study by the Identity Theft Resource Center, based in San Diego, the theft usually takes place early in the child’s life. The researchers found that, in 54 percent of the cases, the theft took place before the child was six years old. The study also found that, while parents or other relatives were the most likely perpetrators, other identity thieves increasingly target children for one simple reason. It’s easy to do, and to get away with for long periods of time before discovery.”

This article also highlights that:

“Of the more than 255,000 identity theft complaints received in 2005 by the Federal Trade Commission, five percent involved people 18 or younger, an increase from three percent in 2003.”

--- NOTE: my original HP blog can be found here ---

UK Information Commissioner’s Office (ICO): Call for Privacy Impact Assessment

A recent ICO’s Press Release (on December, 11th) reveals that:

“At a surveillance conference in Manchester the ICO will say that the breach at HM Revenue and Customs was a watershed and will call for organisations to implement new safeguards to help protect individuals’ privacy. The UK’s first privacy impact assessment handbook will be launched to help organisations address the risks to personal privacy before implementing new initiatives and technologies. By carrying out a privacy impact assessment organisations will also increase public confidence in data collection”

This Privacy Impact Assessment (PIA) handbook has now been released and it is available online, here.

--- NOTE: my original HP blog can be found here ---

Evolution of Identity Management

Jon Oltsik, in his blog post, “Redux in the Identity Management Market”, provides a concise and interesting account of the evolution of Identity Management, from initial start-ups, consolidation by large corporations and back again to start-ups, in some “hot” areas (such as governance, role management, network-based Identity Management, etc.).

Interestingly, he does not mention potential future evolutions of Identity Management in two areas: “Identity as a Service” and Identity Management for (Enterprise) Web 2.0.

He predicts more M&As and specializations in the Identity Management space in the months to come.

--- NOTE: my original HP blog can be found here ---

ENISA Position Paper – Reputation-based System: a Security Analysis

A new Position Paper has been released by ENISA, titled “Reputation-based System: a Security Analysis”:
“This paper aims to provide a useful introduction to security issues affecting Reputation-based Systems by identifying a number of possible threats and attacks, highlighting the security requirements that should be fulfilled by these systems and providing recommendations for action and best practices to reduce the security risks to users. … This paper is aimed at providers, designers, research and standardisation communities, government policy-makers and businesses.”

It provides an introduction to reputation-based systems and significant use-cases. It then analyses related key threats and security requirements. Finally it provides recommendations and concluding remarks.

The Identity Management Community might be interested in this paper given the role that identity management and privacy have in reputation-based systems and the fact that these systems are affected by and affect identities.

--- NOTE: my original HP blog can be found here ---

A “Living List of Identity Management Forums”

I have found on the web this interesting “Living List of Identity Management Forums”.

Despite being incomplete, it provides a pretty much good overview of (most of) public initiatives in the space of Identity Management.

An opportunity for the Identity Management Community to get references and create awareness about the missing ones …

--- NOTE: my original HP blog can be found here ---

US Federal Trade Commission: about 8 million US people estimated being victims of Identity Theft …

A recent report published by the US Federal Trade Commission, called “Federal Trade Commission – 2006 Identity Theft Survey Report” (the report is available online, here) provides an analysis and estimate of Identity Thefts happened in US, in 2005.

Based on this report, “A total of 3.7 percent of survey participants indicated that they had discovered they were victims of ID theft in 2005. This result suggests that approximately 8.3 million U.S. adults discovered that they were victims of some form of ID theft in 2005”.

Identity thefts have been classified in the following categories:

• New Accounts & Other Frauds
• Misuse of Existing Non-Credit Card Accounts or Account Number
• Misuse of Existing Credit Card or Credit Card Number
  

This report estimates that “The median value of goods and services obtained by the identity thieves for all categories of ID theft was $500. Ten percent of victims reported that the thief obtained $6,000 or more, while 5 percent reported that the thief obtained at least $13,000 in goods and services.
…
In more than 50 percent of ID thefts, victims incurred no out-of-pocket expenses. (Out-of-pocket expenses include any lost wages, legal fees, any payment of fraudulent debts, and miscellaneous expenses such as notarization, copying, and postage.) In the New Accounts & Other Frauds category, the median value of out-of-pocket expenses was $40”.

This report also compares these recent findings against findings of a similar investigation carried out in 2003: “The 2003 survey found that 4.6% of the survey population had experienced ID theft during the one year period before the survey was conducted. The 2006 survey found that 3.7% of the survey population had experienced ID theft during 2005. The difference between the rates is not statistically significant. Given the sample sizes and the variances within the samples, one cannot conclude that the apparent difference between the two figures is the result of a real decrease in ID theft rather than a result of random variation.”

--- NOTE: my original HP blog can be found here ---

Conference Event: Ethics, Technology and Identity

I’d like to create awareness about the “Ethics, Technologies and Identity” conference (June 18-20, 2008 - The Hague, the Netherlands):

“Information technology plays an increasingly important role in society and in human lives. Identity Management Technologies (e.g. biometrics, profiling, surveillance), in combination with a variety of identification procedures and personalized services are ubiquitous and pervasive. This calls for careful consideration and design of collecting, mining, storing and use of personal information. This conference aims to discuss the theme of ‘identity’ in light of new (information) technology. Key-note speakers are David Velleman, Oscar Gandy, Robin Dellon and David Shoemaker.”

The deadline to submit abstracts is 07 December 2007. The full call for papers is available here.

--- NOTE: my original HP blog can be found here ---

UK: Personal data of 25 million people have gone missing by Postal Service

A recent BBC article (called “UK’s families put on fraud alert”) provides more details about a recent incident happened in UK, where two CDs containing the personal details of all families in the UK with a child under 16 that have gone missing:

“The Child Benefit data on them includes name, address, date of birth, National Insurance number and, where relevant, bank details of 25 million people.

Chancellor Alistair Darling said there was no evidence the data had gone to criminals - but urged people to monitor bank accounts "for unusual activity". The chancellor blamed mistakes by junior officials at HMRC, who he said had ignored security procedures when they sent information to the National Audit Office (NAO) for auditing.

Mr Darling told MPs: "Two password protected discs containing a full copy of HMRC's entire data in relation to the payment of child benefit was sent to the NAO, by HMRC's internal post system operated by the courier TNT. The package was not recorded or registered. It appears the data has failed to reach the addressee in the NAO.”

It looks like good practices and processes were in place but nevertheless the system failed. I see the limitations of any privacy enforcement system, in this context.

I wonder if a “Risk-Driven Decision Support System” would have been of some use in this context, to discourage this action (given the existing policies and the potential involved risks) and suggest more compliant ways to proceed …

--- NOTE: my original HP blog can be found here ---

What is your “Identity Footprint” on the Web?

Very few people actually know what their “Identity Footprint” is (e.g. various pieces of information and details related to them, given away on the web …), especially if they have been exposed for a while to the Internet, have accessed and interacted with various social network services or simply have been involved in web service interactions.

What are going to be the risk induced by these “Identity Footprints”? Could “personal profiles” be inferred from this information at a point to become a threat e.g. enable identity thefts, frauds or simply have future impact on people’s reputation, etc.?

I believe that understanding and managing this kind of risk is going to become a priority in a not so far away future … Its implications are already becoming obvious today, as it is possible to gather reasonable amount of “personal” information on individuals by searching in various sites (e.g. Google, FaceBook, Linkedin, Del.icio.us, Technorati, etc.).

I see an opportunity for researching and developing new identity management services in this space to help people assessing risks and potentially mitigating them (for example, the “Personal Guardian Angel” service, that I described in a previous post, “2012: A Day in the Life of John Webber”).

--- NOTE: my original HP blog can be found here ---

Technologies and Solutions to Help Fighting Identity Thefts …

A recent article by Brad Stone, titled “In ID Theft, some victims see opportunities”, provides an interesting overview of some emerging technologies and solutions that can help people to be more aware of identity thefts and potentially fight them.

Some emerging companies have interesting ideas and proposals in this space. Have a look …

--- NOTE: my original HP blog can be found here ---

Identity Management @ HP Labs: Challenges and Opportunities

I have recently given a few public presentations about HPL R&D activities on Identity Management. I would like to share a presentation (.ppt), called “Identity Management @ HP Labs: Challenges and Opportunities” where I discuss:

• Challenges and Opportunities (in the next 5 years) in the Identity Management space
• A few HPL research activities in the space of Identity Management. This includes work done on “Enterprise Privacy Management for Identity Management” and “Device-based Identity Management in Enterprises”
• A few Identity Management initiatives HPL have been involved in. This includes the “Identity Capable Platforms (ICP)” initiative and the “Identity Governance Framework” initiative.

My presentation is available online and can be downloaded here.

--- NOTE: my original HP blog can be found here ---

HP’s Security Handbook

The HP’s Security Handbook is available online (2006 edition):

“The HP Security handbook provides a view into all the different threads of security that HP works in. Much of the content is focused on the three pillars of our security strategy: Identity Management, Proactive Security Management and Trusted Infrastructures. The handbook also describes how Governance issues fit into our security strategy and provides an insight into the security research work done by HP Labs.”

In particular, the Identity Management community might be interested in having a look at the section on Identity Management.

--- NOTE: my original HP blog can be found here ---

The Basics of Identity Management?

An interesting article has been recently written by John Dunn, Techworld, called “The Basics of Identity Management”.

This article actually focuses on “Federated Identity Management (FIM)”. It analyses aspects of FIM and provides the author’s view about what FIM can offer to IT planners. A key point is made by the author:

“To succeed, FIM has to undo half a century of IT, based on the idea that IT is constructed around the logical arrangement and securing of systems into which users are placed. FIM, by contrast, has the potential to be radically user-centric, making users the centrepiece of an IT system, around which systems are built as digital supports. A systems mentality looks on users as existing on a hierarchy of privilege, with higher rungs gaining more authorisation and power, but within defined geographical and logical limits. A FIM way of looking at users is to see these systems from their point of view. That information, or the ability to transact, resides on the network of another company matters not if that it essential to the business objective. It should be accessible.

For the time-being, FIM will most likely be restricted to specific projects – getting two partners working together - with defined goals and timescales. Longer term, it has the potential to transform even the humblest IT operation into something quite new. But as a concept, federation surely represents the future of networks, so that they become not as islands of digital power, but overlapping ‘networks of networks’. It is happening already. But it will force companies to re-examine their own security processes before they jump into its whirlpool of potential difficulties.”

--- NOTE: my original HP blog can be found here ---

2012: A Day in the Life of John Webber

How digital-personae, identity management and web 2.0 will impact, influence and reshape people lives and organisations during the next 5 years? What is going to be “hot” in 2012?

Difficult questions … A few colleagues of mine and I tried to explore future scenarios and opportunities in the space of digital identity and identity management. We wrote a story, “2012: A Day in the Life of John Webber”. We would like to share it with this community, to open a debate and exchange opinions. Enjoy it …

--- 2012: A Day in the Life of John Webber ---

“John Webber is a young, ambitious professional. He has a very intense life with interests spanning work, social and political aspects, many friends spread all over the world and a girlfriend. He is accustomed to using new technologies and web 3.0 services: he sees them as a way to simplify his life and enable the broad, rich set of personal and digital interactions that he requires on daily basis in his life.

John works for a multinational enterprise. He uses his mobile appliances (laptop, office PC, smartphone, etc.) in an interchangeable way, to interact with colleagues, send/receive multimedia e-mails and edit reports and critical information for his company. On a daily basis he accesses state-of-the art enterprise services, to collaborate with project colleagues all over the word. This is a simple and gratifying experience thanks to the latest generation, enterprise web 3.0 collaborative, integrated services – where multimedia information is easily collected, stored and indexed for future usage, as well as securely and privately protected, based on the “value” of the content.

John gets access to all these services with his “personae-selector” (virtual) device, installed on his Smartphone. Recognizing John using multiple biometric sensors, the device suggests a persona relevant to the current context or allows John to override the automatic selection. This (virtual) device securely interacts with other of John’s devices and authorised enterprise devices (including that new, secure Printer, and associated Print 3.0 services, recently deployed in John’s office).

John is aware that to be successful in his job, he needs to have constant interactions with other professionals and experts around the world: he wants to exchange opinions and have an early understanding of new trends and exciting initiatives. This is now a recognised need and common practice within modern enterprises.

John runs a few, interactive, multimedia external blogs to expose his views, start discussions and get feedback. He is aware of confidentiality aspects that might rise from his interactions with external people: he uses ad-hoc personae to interact with these services, by exposing a profile and information compatible with his company’s business policies and his privacy preferences. An online, trusted “personal guardian angel” service, accessible via his “personae-selector” (virtual) device, helps him to handle these different personae and to get reminders about the context he is interacting with.

The multinational he works for is aware that people and information are the most valuable assets in these days. On one hand it recognises the need to enable collaborative interactions of its employees with the external world. On the other hand it is aware of potential risks and threads for its own security and businesses.
Thanks to the new generation of “Identity Risk Management and Assessment” services jointly run by the CIO/CPO Offices, enterprise officers periodically scan various sources on the web (including social networks, blogs, etc.) against any improper leak of confidential data or information that could harm enterprise business and employees. This service provides reports on critical issues and confidential and personalised suggestions (on how to mitigate risks) to employees, in case of any problem.

Today, John works from home. It is his girlfriend’s (Alice) birthday. This is special occasion he wants to properly celebrate. By using his home laptop he accesses his preferred “federated service provider community” and in few minutes makes all the required arrangements to celebrate this event: buying Alice’s preferred flowers at “Flowers’R Us”, arranging for an exclusive dinner at the “Genuine Italian Food Restaurant” and buying that jewellery ring that Alice desired so much.
From his laptop John securely links to his “personae-selector” (virtual) device to authenticate and access these various service providers in a transparent way – thanks to their integrated single-sign-on capabilities (via interoperable Liberty Alliance 3.0, OpenId 3.0 and CardSpace 3.0 protocols). In 5 minutes, he buys flowers (to be delivered at the restaurant), arranges for a table at the restaurant and buys the present for Alice. His interactions with these service providers is smooth and simple, as it is mediated by a “joint-collaboration” between his “personae-selector” device and the “personal guardian angel” service, that ensure that a “personae-handover” process happens across various service providers (i.e. different personae are automatically used in different contexts) and the right credentials (including credit card details) and contextual data are exposed based on John’s privacy preferences and interaction policies.

The service providers involved above use the latest, state-of-the-art “Personae-aware” Identity and Privacy Management Services to seamlessly engage in federated contexts and properly handle and process personal information disclosed by John. They ensure his privacy preferences are enforced along with current world-wide (privacy and data protection) legislation. They also use a new generation of “Risk Management and Assessment” services to check their own compliance to business objectives and legislation and automatically report any violation (and start remediation steps). Consistently with this, they offer John a tailored (persona-aware) service experience, in suggesting a customised but not invasive interaction.

It is still early for John to meet with Alice. A good opportunity for John to socialise with his friends spread all over the world and engage in these social networks he likes so much. John connects to a few of them by using appropriate personae (thanks to the help of his “personae-selector” device) and starts posting and chatting.

John is aware that he his using multiple personae and the implications and possible risks that exposing information on the web could have, such as correlation, deductions and misuse of this information to commit crimes. His trusted “personal guardian angel” service helps him to keep track of John’s personae, automatically updating changes and providing additional, useful services. John chooses to have all his interactions on the internet monitored by his trusted “personal guardian angel” service: he configures it to monitor his social network interactions and warn him of any danger, in particular related to disclosure of personal details and information. This has been a wise choice: the interactions with a new guy - Charles, a friend of his friend Bob is strange. His questions and request for work information are going in a direction that could be dangerous. The “personal guardian angel” service warns John of the risks of disclosing some information and the implications this could have for his work and social life. John decides that it is best to drop the call …

Reminded of these potential dangers, John, whilst he is dressing up to go out with Alice, starts a “Personae-Risk Scan” check via his “personal guardian angel” service. This checks for any information directly/indirectly exposed on the web or via his various social network links (Facebook 3.0, MySpace 3.0, LinkedIn 3.0, YouTube 3.0, Second and Third Life 3.0, etc.) and service accounts. It compares retrieved information against perceived threads and risks and provides a meaningful, user friendly report along with suggestion on how to mitigate problems. This time John is lucky: nothing to worry about.

Alice is going to be a little bit late. Why not doing a back-up of John “personae-selector” (virtual) device – as prompted by the device itself? After all it is a “virtual” device: a few seconds and its entire content is securely copied and protected in his new Smartphone along with an image of its personae and preferences.

This was a good move: at the restaurant, perhaps distracted by the good Italian food, a thief steals his current Smartphone with his “personae-selector” (virtual) device. No problem: just the hassle of reporting this (online) to the police. He can carry on celebrating with Alice.

The thief didn’t realise he had no way to access the content and use the device, thanks to its biometric-based protection and encrypted content. It is a “useless tool” to be thrown away at the first opportunity. So he does.
This is good for John: the discarded device is quickly located via GPS and the collaboration with its “personal guardian angel” service. The device is back home the next day.”

--- NOTE: my original HP blog can be found here ---

Part II: CIMIP to Release Landmark Study on Identify Theft

As anticipated in my previous post, “CIMIP to Release Landmark Study on Identify Theft”, The CIMIP report, called “Identity Fraud Trends and Patterns: Building a Data-Based Foundation for Proactive Enforcement”, has been released. It can be downloaded, for free, here.

The executive summary of this report mentions that: “The purpose of this study was to provide empirical evidence on which law enforcement can base enhanced proactive identity theft control and prevention efforts. It focuses on identity theft offenders, which sets it apart from previous surveys and other research which have centered on identity theft victims. As a result of the study of closed United States Secret Service cases with an identity theft component (2000-2006), empirical data concerning the key factors relevant to the criminal behavior of identity thieves and the conditions under which that behavior occurs are available to law enforcement agencies and corporate security and fraud investigators for the first time.”

This report covers various topics, including: Goals and Values of the Study, The Empirical Approach, Findings, The Offenders,The Commission of the Crime, Victimization, Recommendations and Conclusions. It is worth reading it: it provides an interesting perspective and analysis on Identity Thefts based on factual information.

--- NOTE: my original HP blog can be found here ---

CIMIP to Release Landmark Study on Identify Theft

This could be of interest to the Identity Management Community. A recent article written by Amanda Damiano (“CMIP to Release Landmark Study”) reveals that:

“On Monday (Oct. 22), Utica College’s Center for Identity Management and Information Protection (CIMIP) will release the results of a landmark study of closed U.S. Secret Service cases involving identity theft. The study, which will reveal new findings about identity theft perpetrators, victims, and methods, marks the first time the U.S. Secret Service has allowed review of its closed case files on identity theft and fraud. The research will be of particular value to government, law enforcement and corporate entities whose mission is to prevent, detect, investigate or prosecute identity theft crimes, said Gary R. Gordon, executive director of CIMIP and professor of economic crime at Utica College. Information on insider threats, points of compromise, and vulnerabilities will be of specific interest to chief security and chief information officers across many industries, including financial services and retail corporations, Gordon said.”

These results will be released at the 18th annual ECI (Economic Crime Institute) Conference (October, 21-23), this year focusing on the topic: “Identity Management and Information Protection: Research and Action”.

--- NOTE: my original HP blog can be found here ---