HP Labs’ EnCoRe Service Framework: a General, Reference Implementation for Dynamic Consent and Privacy Management

HP Labs completed the development of the EnCoRe Service Framework for the management of dynamic consent and privacy within and across organisations [5]. This framework provides a general, reference implementation of EnCoRe technical capabilities, fully consistent and compliant with the third EnCoRe Technical Architecture [1].

The HP Labs Service Framework supports four general use cases that apply to all case studies explored in EnCoRe:

· A data subject (end-user) submits his/her personal data to an organization along with the expression of their consent preferences;
· An entity within the organisation trying to access personal data and being constrained (in so doing) by related data subjects’ consent preferences and policies. The organization uses EnCoRe to explicitly enforce (privacy) preferences and policies;
· The disclosure of personal data to a third party, along with associated consent preferences, via the sticky policy mechanism;
· A data subject subsequently changes their mind and modifies/revokes their consent. Changes are automatically propagated to all the involved parties;

More details about these use cases are available [1].

A fully working prototype has been built by HP Labs, to fully illustrate the capabilities of the EnCoRe Service Framework and the four general use cases.

Specifically, the Service Framework implements the following key EnCoRe Architectural capabilities [1]: module for the configuration of supported Privacy Preferences and Policies; the Consent/Revocation Provisioning module; the Data Registry module; the Privacy-aware Access Control module; the Obligation Management module; Internal and External Workflow Management modules; the Sticky Policy Management module; instantiation of types of Privacy Preferences, various Access Control and Obligation Policies.

The various components of the Service Framework have been implemented to run as self-standing, secure and distributed services within an organisation. The goal is to ensure that early adopters of the EnCoRe toolkits can use this framework to explore its privacy management capabilities and deploy an extended version of it within their IT operational environments.

The implementation uses state-of-the-art technologies based on the Java framework. It uses the REST [6] methodology and approach for a quick and flexible development of service interfaces and the exchange of information between the involved services. The EnCoRe components are implemented as self-standing RESTful services [7]. These service components can be distributed across different IT systems based on needs. Their implementation supports state-of-the art security, including encryption of data and secure SSL communication. The representation of information that is exchanged between these EnCoRe components uses the XML technology to support future extensions and quick adaptation to the needs of different organisations and their IT operational environments.

This framework has been used by HP Labs as a platform for experimentation of innovative privacy management and consent/revocation solutions. Specifically, HP Labs used it to develop and deploy advanced solutions for: the tracking of whereabouts of personal data (via an enhanced version of the Data Registry component); the management of sticky policies by means of a variety of possible technical approaches. The service framework now fully supports sticky policies as the mechanism to exchange personal data and privacy preferences across parties, in a safe and accountable way. A reference implementation is available as described in [8].

The HP Labs Service Framework is also an agile platform to develop demonstrators for a variety of needs, including prototypes of the overall system for the EnCoRe engagement with the Cabinet Office Identity Assurance Programme [2].

HP Labs are exploring the opportunity to release this Service Framework in the context of an Open Source initiative. This option is currently being discussed within EnCoRe and various involved organisations: a decision will be made towards the end of the project (April 2012).

[1] D2.3 Technical Architecture for the third realized Case Study,, http://www.encore-project.info/deliverables_material/D2_3_EnCoRe_Architecture_V1.0.pdf
[2] UK Cabinet Office, Identity Assurance (IdA) Programme Statements, http://services.parliament.uk/hansard/Commons/ByDate/20110518/writtenministerialstatements/part003.html
[3] D2.1 Technical Architecture for the first realized Case Study, http://www.encore-project.info/deliverables_material/D2.1%20EnCoRe%20Architecture%20V1.0.pdf
[4] D2.2 Technical Architecture for the second realized Case Study, http://www.encore-project.info/deliverables_material/D2_2_EnCoRe_Architecture_V1.0.pdf
[5] EnCoRe, HP Labs Service Framework, http://www.encore-project.info/newsletters/newsletter03/EnCoReAUG2011.html
[6] REST, http://en.wikipedia.org/wiki/Representational_state_transfer
[7] RESTLET, RESTful web framework for Java, http://www.restlet.org/
[8] Siani Pearson, Marco Casassa Mont, Sticky Policies: An Approach for Managing Privacy across Multiple Parties, IEEE Computer Magazine, Volume 44, Number 9, September 2011, 2011

--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---

Twitter and its Privacy and Identity Management Implications

I recently started using Twitter (my link: http://twitter.com/MCasassaMont).

Twitter it getting more and more popular within (and across) organisations in particular for geographically distributed teams, to share their activities and whereabouts.

I am interested to better understand this tool, in particular in terms of its identity and privacy implications and long term repercussions for individuals and organisations.

I see some interesting research to be potentially carried out in the context of the Identity Analytics R&D project at HP Labs and UK TSB EnCoRe project.


--- Posted by Marco Casassa Mont (here and here) ---


--- NOTE: my original HP blog can be found here ---

2009-2010: Predictions about Identity and Privacy Management

During the next two years (2009-2010), the Identity and Privacy Management areas are going to be subject to the consolidation and cost cutting trends that are already happening in security and, more in general, in IT.

In my view investments in Identity Management (IdM) are going to be very pragmatic, also driven by the need to: manage a very “variable” workforce; cope with an increase of internal enterprise reorganizations and consolidations; deal with an increased number of identity thefts and related attacks.

As such I believe that the IdM areas that will get most of the market attentions are going to be in the areas of:

• Entitlement management (and automated user provisioning)
• Enterprise SSO
• Authentication strategies
  

I don’t believe that client-based federated identity management and advanced authorization solutions will be driving the Identity Management space, during this period of time.

From a Privacy Management perspective, I still believe that most of the action will happen in R&D contexts.

Of course, this is my view, based on some evidence and intuitions. I would be interested in getting your opinions.

I am also planning to compile a list of world-wide R&D projects and (industrial/university-based) R&D activities in the space of Identity and Privacy Management. I will post information about this. Of course, feel free to send me your input and relevant URLs.

--- NOTE: my original HP blog can be found here ---

Built-in Data Loss Prevention and Analogy with Privacy Management

I have just read this interesting article, called “Microsoft, RSA Partner to Develop Next-Gen data Loss Prevention”, by Lawrence Walsh:

“The alliance between Microsoft and RSA will move data loss prevention technology into the fabric of the IT infrastructure and improve protection by associating data with identities and classifications. Analysts are already calling the idea a "game changer.””

The main message I got is that we need to move away from bolt-on solutions, towards “built-in DLP approaches”. I tend to agree with this approach, despite being much harder to achieve.

This has some interesting analogies with privacy and the way privacy management is currently carried out, at least with most of current privacy-enhancing technology (PET) approaches. I believe that we need to move toward built-in approaches too, that require deep understanding of the interconnections with the relevant “IT infrastructure fabric”, related business processes (and needs), along with involved risks and their potential impact.

So, I believe this is something to consider very carefully, for example, in the context of the “Consent and Revocation Management” R&D area, within the TSB EnCoRe project.

--- NOTE: my original HP blog can be found here ---

Survey: Only Eight Percent of American are “Very Confident” their Personal Data is Properly Managed

This is the outcome of a recent survey by The Strategic Counsel, at least based on the overview provided by this article (called “Only Eight Percent of Americans are 'Very Confident' Their Personal Data is Safe With Retailers, Banks and Governments”):

“Only an average of eight percent of Americans say they are very confident in the ability of U.S. retailers, government and banks to protect their personal information, according to a national survey commissioned by CA, Inc., and conducted by The Strategic Counsel. The CA 2008 Security and Privacy Survey was done as in follow-up to the 2006 survey. Additionally, the consumer survey indicated that an average of 79 percent of American consumers cite loss of trust and confidence, damage to reputation, and reduced customer satisfaction as consequences of major security and privacy breaches suffered by the business or government organizations that they deal with.”

Even more interesting is this statement, mentioned by the above article:

“Businesses used to worry about the hackers and thieves launching denial of service attacks from outside the firewall, now they recognize that their greatest danger lurks within the organization. The good news is that increasingly businesses are turning to identify and access management solutions to ensure that confidential data is safeguarded and available only to the people within the organization who genuinely need to have it.”

Well, I just partially agree with the final part of this statement. Turning to identity and access management solutions is indeed important, but this is just one step towards really ensuring that personal and confidential data is managed according to legislation and users’ preferences.

First of all, most of current IdM solutions are not really privacy-aware and/or do not provide privacy enhancing capabilities (e.g. privacy-aware access control) – aspects that are at the base for preventing that PII data is accessed and used beyond agreed purposes and for the wrong intents … Secondly, IdM solutions can address the problem till at one point if accidents, social engineering, actions by traitors/insiders, and the effects of bad processes and practices can still happen …

So, the other part of the story, for the enterprise, is putting in place proper “data governance processes” and dealing (upfront and periodically) with the necessary risk assessment and management steps. These steps (that should be carried out before deploying any “control point” in the IT infrastructure) are much, much harder to achieve and maintain than simply deploying IdM solutions …

--- NOTE: my original HP blog can be found here ---

Liberty Alliance releases the Identity Assurance Framework (IAF) and Identity Governance Framework (IGF) Specifications

Today, Liberty Alliance has publicly announced the release of the Identity Assurance Framework (IAF) and Identity Governance Framework (IGF) Specifications:

"Liberty Alliance, the global identity community working to build a more trust-worthy internet for consumers, governments and businesses worldwide, today announced an industry milestone in driving trust and privacy into enterprise and identity-enabled applications based on the release of the Liberty Identity Assurance Framework (IAF) and the Liberty Identity Governance Framework (IGF). Today’s news is the result of the collaborative development of standardized frameworks and technologies designed to meet cross-industry requirements for policy-based security and privacy systems, with a focus on streamlining the establishment and management of identity and trust across user-driven applications and networks."

I believe this is a first, important steps towards providing a more systemic approach to assurance and privacy management in complex organisational (and cross-organisational) contexts.

More details can be found in the Liberty Alliance’s announcement, here.

--- NOTE: my original HP blog can be found here ---

Liberty Alliance’s Privacy Summits

A recent press release issued by Liberty Alliance announced the first of three webcasts from its 2008 Privacy in Perspective series:

“Taking place at 8:00am US PT (3:00 UTC) on Wednesday, April 16, the public event is hosted by Robin Wilton, Corporate Architect for Federated Identity, Sun Microsystems and co-chair of the Liberty Alliance Public Policy Group. The webcast will review findings and next steps from the ongoing series of global Liberty Alliance privacy summits held so far in Basel, Berlin, Brussels, London and Washington DC.

The Liberty Alliance privacy summits bring privacy stakeholders from the global commercial, academic, legal and public sectors together to address privacy concerns and discuss possible solutions," said Wilton. "The April 16 webcast will showcase lessons learned during the summits to help organizations remove obstacles to a productive, multi-stakeholder discussion about privacy issues.””

The registration site for this privacy summit is available here.

Published findings from previous Liberty Alliance’s Privacy Summits are available here.

--- NOTE: my original HP blog can be found here ---

HPL Technical Report: On Automatic Compliance of Privacy Policies in Federated Identity Management …

An HPL Technical report has been recently published on the topic of “Automatic Compliance of Privacy Policies in Federated Identity Management”:

“Privacy in the digital world is an important problem which is becoming even more pressing as new collaborative applications are developed. The lack of privacy preserving mechanisms is particularly problematic in federated identity management contexts. In such a context, users can seamlessly interact with a variety of federated web services, through the use of single-sign-on mechanisms and the capability of sharing personal data among these web services. Because of the latter feature, user's privacy is at a stake, if the sharing of such data among federated service providers is not properly controlled to ensure that privacy is preserved and user's privacy preferences are complied with. Current federated identity managed solutions adopt simplistic approaches to privacy management, based on contractual/legal approaches and/or limited simple checks on users' privacy preferences. We argue that more comprehensive privacy policies (consisting of access control and obligation constraints, along with privacy preferences) should be stated by federated service providers and proactively checked by these providers, before disclosing users' data to federated partners. To address such requirements, we introduce mechanisms and algorithms for policy compliance checking between federated service providers, based on an innovative policy subsumption approach. We formally introduce and analyze our approach. We also show how our approach is suitable for deployment and application in existing federated identity management solutions, such as Liberty Alliance, WS-* and Shibboleth.”

Authors: Anna Squicciarini (The Pennsylvania State University), Marco Casassa Mont, Abhilasha Bhargav-Spantzel (Purdue University), Elisa Bertino (Purdue University).

A short paper derived from this technical report has been accepted at IEEE Policy 2008.

--- NOTE: my original HP blog can be found here ---

Webinar (17 January 2008, 3:00 PM, GMT) – “Internal Threats to Your Data. From erring employees to malicious infiltrators - how do you protect ...?"

I received an email from Elsevier/InfoSecurity advertising a public webinar, called “Internal Threats to Your Data. From erring employees to malicious infiltrators - how do you protect against the unknown?”.

I think this might be of interest to this community (due to its identity and privacy implications):

“Database attacks have long been associated with the problem of external hackers, who, whilst searching for vulnerabilities in an organisation's IT resource and often using SQL injection techniques, seek to steal data for their own - or third party - malicious usage. Recently, however, the number of security breaches occurring in the public and private sector, has raised the topic to the top of the list as far as board level management is concerned. The risks involved are many, ranging from employees stealing confidential data for personal gain, right through to a lack of corporate governance and policies allowing staff access to information they should not normally have access to in their day-to-day duties. …

This webinar will:

• Give clear insight in to the complex and changing nature of insider threats, with a look at original research
• Show how accidental misuse can lead to disastrous consequences
• Offer proven strategies to secure your data, including practical advice on how to determine what is normal behaviour and what is an abuse of privilege
• Explain what to look for in an employee's abuse of privilege”

The webinar is free and it is going to take place on Thursday, January 17th at 3:00 PM (GMT). Attendees are requested to register online. Of course, read the Webcast Registration Policy …

Apparently, CISSPs and SSCPs will receive 1 CPE credit for attending this webinar.

--- NOTE: my original HP blog can be found here ---

Information Security Management: Top Priority in 2008?

An article, published by Reuters and called “Information Security Management Still Number One Concern”, provides an overview of the recent American Institute of Certified Public Accountants (AICPA)' 19th Annual Top Technology Initiatives survey:

“The AICPA poll was conducted in late 2007 with ISACA, the Institute of Internal Auditors (IIA) and the Information Technology Alliance (ITA). Respondents identified the top 10 most important technology initiatives for 2008 as follows:

1. 1. Information Security Management
2. 2. IT Governance
3. 3. Business Continuity Management and Disaster Recovery Planning
4. 4. Privacy Management
5. 5. Business Process Improvement, Workflow, and Process Exceptions Alerts
6. 6. Identity and Access Management
7. 7. Conforming to Assurance and Compliance Standards
8. 8. Business Intelligence
9. 9. Mobile and Remote Computing
10. 10. Document, Forms, Content and Knowledge Management

A selective group of 1,169 finance, accounting and technology participants ranked 29 technology initiatives they felt would have the most significant impact on their organizations in the next 12 to 18 months.”

Please notice that both Privacy Management and Identity Management appear in this list.

This article also reports that Lynn Lawton, International President of ISACA, made this interesting statement: "Recent studies show that investors are willing to pay a premium of up to 20 percent more for shares of enterprises with reputations for good IT governance practices; properly governed IT is critical to an organization's success."

--- NOTE: my original HP blog can be found here ---

IT and Privacy Landscape: Areas to Watch in 2008

A recent article by Brian Tretick, titled “IT and the Changing Privacy Landscape: Eight Areas to Watch in 2008”, provides an interesting analysis of the current state of privacy management and suggests eight areas to watch in 2008:

• Information is Power: Keeping Data Classification up to Date;
• Less is More: Minimising the Use of Personal Information;
• Decode or Not Decode: The Evolving Use of Encryption;
• The Three-Legged Stool: Strict Standards for Vendors and Business Partners;
• On the Road Again: Personal Information and the Telecommuter’s Way of Life;
• In Case of Emergency: Having a Plan for a Worst-Case Scenario;
• It’s a Small World: Developing Privacy Procedures for Home and Abroad;
• Building a Better Mousetrap: Keeping Pace with Privacy Management Technologies;
  

This article concludes by saying that “Privacy is a mainstream business issue. These eight areas deserve more than a check-the-box exercise. Each one should be addressed as part of the comprehensive, deliberate management of privacy risk and compliance. Founded on policy and governance, an effective privacy program relies on controls, monitoring, compliance activities and other assurances to keep an effective operation in place.”.

I really tend to agree with this point: in my view, identities and privacy should be more and more considered as key “enterprise assets” and addressed from an “enterprise risk and compliance management” perspective (also see a related post of mine, here).

--- NOTE: my original HP blog can be found here ---

Coming Conferences on Identity and Privacy Management

Here are a few conferences related to the Identity and Privacy Management topics whose paper submission deadlines are in January and February 2008:

• SEC 2008 23rd International Information Security Conference, Co-located with IFIP World Computer Congress 2008, Milan, Italy, September 8-10, 2008. (Submissions due 10 January 2008)
• IFIP-TM 2008 Joint iTrust and PST conferences on Privacy, Trust Management and Security, Trondheim, Norway, June 18-20, 2008. (Submissions due 11 January 2008)
• UPSEC 2008 Workshop on Usability, Psychology, and Security, Co-located with the 5th USENIX Symposium on Networked Systems Design & Implementation (NSDI 2008), San Francisco, California, USA, April 14, 2008. (Submissions due 18 January 2008)
• CARDIS 2008 8th Smart Card Research and Advanced Application Conference, Royal Holloway, University of London, Egham, Surrey, UK, September 8-11, 2008. (Submissions due 15 February 2008)
• IFIP-DAS 2008 22nd Annual IFIP WG 11.3 Working Conference on Data and Applications Security, London, UK, July 13-16, 2008. (Submissions due 20 February 2008)
• SHPCS 2008 Workshop on Security and High Performance Computing Systems, Held in conjunction with the 2008 International Conference on High Performance Computing & Simulation (HPCS 2008) and the 22nd European Conference on Modelling and Simulation (ECMS 2008), Nicosia, Cyprus, June 3-6, 2008.
• SOUPS 2008 Symposium On Usable Privacy and Security, Carnegie Mellon University, Pittsburgh, PA, USA, July 23-25, 2008. (Submissions due 29 February 2008)

--- NOTE: my original HP blog can be found here ---

UK Information Commissioner’s Office (ICO): Call for Privacy Impact Assessment

A recent ICO’s Press Release (on December, 11th) reveals that:

“At a surveillance conference in Manchester the ICO will say that the breach at HM Revenue and Customs was a watershed and will call for organisations to implement new safeguards to help protect individuals’ privacy. The UK’s first privacy impact assessment handbook will be launched to help organisations address the risks to personal privacy before implementing new initiatives and technologies. By carrying out a privacy impact assessment organisations will also increase public confidence in data collection”

This Privacy Impact Assessment (PIA) handbook has now been released and it is available online, here.

--- NOTE: my original HP blog can be found here ---

Event - Privacy Enhancing Technology: How to Create a Trusted Information Society …

A Conference/Forum is going to be held in London, UK, on 21 November, focusing on “Privacy enhancing technologies: How to create a trusted information society”:

“Organised by three of the UK’s Knowledge Transfer Networks (KTN), and supported by the European Commission, A Fine Balance 2007 is an independent forum for discussing privacy in relation to the development of new technology. Building on last year’s event of the same name, this year’s conference discusses the development and integration of technologies which can build privacy into new devices and services at the design stage.
Privacy Enhancing Technologies (PETs) will encourage industry to recognise that valuable emerging technologies can be designed with privacy and data security in-mind from the outset. On May 2nd, the European Commission adopted a Communication "Promoting Data Protection by Privacy enhancing Technologies (PETs)" in which it calls for stepping up research in and development of PETs. In this context, the outcomes of this event will be taken under consideration by the European Commission in its formulation of upcoming work programmes for funding calls in this area of the FP7 - ICT programme and will influence the direction of future research in the fields of privacy and technology.”

Apparently part of this forum/conference can also be followed in a “Web 2.0 workshop” on Second Life.

More information about EU initiatives on PET can be fond here. PRIME Project is mentioned as one of them …

--- NOTE: my original HP blog can be found here ---

Identity Management @ HP Labs: Challenges and Opportunities

I have recently given a few public presentations about HPL R&D activities on Identity Management. I would like to share a presentation (.ppt), called “Identity Management @ HP Labs: Challenges and Opportunities” where I discuss:

• Challenges and Opportunities (in the next 5 years) in the Identity Management space
• A few HPL research activities in the space of Identity Management. This includes work done on “Enterprise Privacy Management for Identity Management” and “Device-based Identity Management in Enterprises”
• A few Identity Management initiatives HPL have been involved in. This includes the “Identity Capable Platforms (ICP)” initiative and the “Identity Governance Framework” initiative.

My presentation is available online and can be downloaded here.

--- NOTE: my original HP blog can be found here ---

Health Information Exchanges and Privacy Concerns

A recent article, by Diana Manos, called “Privacy Concerns Remain Barrier to Health Information Exchanges (HIE)” provides an overview on a report released by the American Health Information Management Association (AHIMA) and the Office of the National Coordinator (ONC) for Health Information Technology:

“A new report on health information exchange says state public-private health information exchange organizations are making progress in some areas, but the question of privacy remains a hurdle. … ONC chief Robert Kolodner, MD, said one barrier to HIE growth is the lack of trust across all stakeholders. Governance must include all stakeholders or “solutions are sub-optimized,” he said. Now is “a pivotal time” for building sustainable health information exchange, he added.”

This report, titled “State-Level Health Information Exchange: Roles in Ensuring Governance and Advancing Interoperability” is available online and can be downloaded here:

“It outlines a potential framework for organizing HIE functions and formalizing organizational and sector roles and responsibilities. It synthesizes field research and provides recommendations to be considered for strengthening and expanding HIE capacity, capitalizing on the important contributions of state-level HIE initiatives.”

--- NOTE: my original HP blog can be found here ---

Making a case for the “Identity Leak” Service …

A recent article by Tom Bowers, called “Smart security testing on the cheap”, makes a few good points:

“Most executives in a company are focused on building on the company's strengths. The chief information security officer, however, must look through a different lens. The job of the security chief is to measure the risks to the business, and then to work to reduce them. That means focusing on weaknesses, namely on weaknesses in the company's networks, systems, and business processes. It's a big job that requires a comprehensive plan, strong skills, and a good set of tools.

The time and skills necessary for effective security assessment will never be free, but a terrific plan and excellent tools are readily available at no cost, courtesy of the open source community. I'm a big believer in tapping open source solutions whenever possible, but there is a catch. Open source is free in cost, but not free in time. Be prepared to spend time learning how to use open source tools and techniques properly. …”

Now, have a look at the mentioned “Google Hacking Database”. The key point that Tom makes here is that similar techniques could be used to “find privacy data of your employees that may have leaked to the Internet from your network”. This is actually important.

Given an enterprise, which confidential information has been disclosed/leaked (and for which reasons) on the web? Which (personal/business) information about people (in their roles as employees and private people) has been disclosed that could be used for cross-correlations and inferences about enterprises businesses or individuals?

In the context of current discussions about “Identity Providers”, it might also make sense to think about “Identity Leak” Services (or if you prefer, more in general, “Information Leak” Services) … providing (on payment?) consolidated information about leaked data (for a user, an organisation, in a specific area/context) AND potential predictions about risks and threats for the involved entities.

Something to think about …

--- NOTE: my original HP blog can be found here ---

Call for Papers: IEEE Workshop Policy 2008 (2-4 June 2008, NY)

The call for papers for Policy 2008 is now available online:

“POLICY 2008 is the 9th in a series of successful workshops, which since 1999 have provided a forum for discussion and collaboration between researchers, developers, and users of policy-based systems. This year, in addition to the latest research results from the communities working in any area of policy-based management and computing, we encourage contributions on policy-based techniques in support of all types of wireless networks: cellular, Wi-Fi, Mobile Ad Hoc, hybrids, etc.
Policy 2008 aims to bring together researchers and practitioners working on policy-based systems across a wide range of application areas including networking, privacy and security management, storage area networking, enterprise systems, and the Web.”

Topics of interest are classified in the following categories:

• Policy models and Languages
• Policy Applications
• Policies in Wireless Networks

Identity management, privacy and security are key topics of this workshop. Please consider submitting a paper.

More information about call for papers, Organising Committee and Program Committee is available online.

--- NOTE: my original HP blog can be found here ---

Part III - PLING: the W3C Policy Languages Interest Group

I have been asked by a few people what a new group member should discuss once involved in the W3C Policy Languages Interest Group (PLING).

I am sure that the discussions of this interest group and priorities will evolve and adapt over time, also based on the interests of this group. Of course, Renato and I will provide some input and guidance.

For the time being, I would personally encourage a new group member to start by sharing his/her own perspective/experience on:

• Which kind of policies (and languages) do you (or your organisation) use and for which purposes (e.g. security, access control, privacy, federated IdM, etc.)?
• In which contexts, environments (e.g. network, system, application, service, business levels, etc.) are policies deployed and used?
• Do you need to deal with heterogeneous set of policies? Do you have interoperability problems? How do you currently keep them consistent and up-to-date?
• Any relevant use cases and scenarios you would like to share with the group/community?
• Which issues did you come across (if any) when handling policies?
• What are the major pain points and limitations (if any) of current policy languages and related policy management systems?
• Any policy requirement or need you would like to share with the group?

--- NOTE: my original HP blog can be found here ---

Part II - Announcing PLING: the W3C Policy Languages Interest Group

In a previous post, I announced the creation of the W3C Policy Languages Interest Group (PLING) and briefly discussed the scope and mission of this group.

As a first step, I would like to invite people, interested in discussions on policies, policy interoperability, use cases, issues and requirements, to subscribe to the PLING Mailing list and start sharing their experiences and views.

We are also considering organising a PLING panel at WWW 2008. Your input on topics of interest to be discussed in this panel (along with your priorities) is welcome.

--- NOTE: my original HP blog can be found here ---