ian glazer's tuesdaynight

As always Bob has an interesting post out there. Taking up the issue of authentication, he issues this challenge:

“I believe that this community should commit itself to achieving the goal, before this decade is out, of providing every computer user with a strong authentication device and the infrastructure required for its universal acceptance.”

The post started my mental wheels turning. I 100% agree with Bob that current state of affairs for user authentication is unacceptable. He provides some great guiding points on what a better authentication system should look like. He says:

Given a little time and some distance from the RSA Conference last week, I feel ready to comment on all the fun. First, I can’t wait for RSA to be back in San Francisco next year… for a lot of reasons. The “last call at 11:00” on Thursday harkened back to drinking in England. 11? Ask anyone in OASIS or the IETF and they’ll tell you, you can’t collude to make a new standard any time before midnight. Bob has an interesting conspiracy theory on why closing time is 11. Second, RSA is always great to help put faces with names. I got to sit and chat with a bunch of interesting people. Granted, with all the people running around the convention center, it can get a bit overwhelming. Third, I got to try out some new ideas on a variety of people from the press to analysts to other vendors in our space. Two things came up in these talks: policy interfaces and the second thing. (The second thing will be a separate post.) Reading Sara’s post on policy was refreshing. The Identity lexicon is a strange one. We use words that have multiple meanings. We use terms to hide the realities of market segments. Policy is definitely high on the list of overused and under-defined terms. Combining some trends I have seen in the market and reflecting on my post about Yet Another Management, I think it is time to highlight another problem with the P word - the management of policy. Quick, vendors, count how many policy management interfaces you have? I spent last week asking a variety of vendors how many different policy management interfaces they have for their products. I think the average for a decent sized identity management vendor is around 5. (One vendor told me of over 10 different policy management interfaces for their suite of products.) Customers are being overwhelmed with different policy tools. Multiple policy management interfaces from multiple vendors. This wouldn’t be so bad if:

Roles, Courion and Trusted Network Technologies Between Rob and Dave, we’ve started a nice little set of discussions on roles. Since the boss and the CTO have weighed in, I figured it was my turn. Roles have been a touchy subject. The industry has wandered a bit over the years to get to where we are now. I remember when role based access control (rbac) was losing a bit of steam and being upstaged by rule based access control (rbac). I used to tell customers, “NIST has it easy. They don’t have to sell anything. If you find that the first idea you had isn’t working, replace it with a new one with the exact same abbreviation. That way you can change what you are talking about without having to reprint the marketing material.” Now this was back in the day that Access360 and Waveset were going head to head. (Ah… the good old days.) The industry has grown a lot since then. We (the industry and customer base) are ready to have more meaningful discussion about role lifecycle management. The US market is starting to come around to roles as new forms of technology can turn role lifecycle management from a painful expensive task into an ongoing dynamic process. We can talk about bottom-up versus top-down. We can look at the way policy and role definition intermingle in various applications. It is a great time to be working in this space. Dave’s post on roles as the fuel for something more than identity management and security addresses the real end goal of customers: IT governance. How does a company turn business process into IT operations into operational efficiency? I’m with Dave here in saying roles can help. However, if role definition is static and done in isolation then it is a wasted effort. Enter our announcement with Courion. Between Courion’s abilities to mine their data to build roles and our abilities to observe identity interactions on the network, we can turn role lifecycle management from a painful expensive task to an ongoing dynamic process. If the process is not ongoing, then any IT governance decision based on role decisions will be using stale data. If these decision are not made on valid data from the identity map of the enterprise, then they are made in isolation and will be suspect. Together Courion and Trusted Network Technologies can do role mining in a timely fashion based on the identity interactions of the enterprise. A Prediction for 2006 It’s a bit late to be making predictions for the year, but better late than never. The Identity Management market is a broad market. It encompasses everything from two-factor authentication to role lifecycle management to federation and beyond. There, as you would expect, are a lot of vendors in this space, with more coming every day. My gut tells me we are going to see a more and more of the smaller vendors in this space teaming to bring better more meaningful solutions to the market. Instead of having a flurry of market consolidation and large companies acquiring smaller ones, 2006 will be a year of seemingly unrelated companies coming together with products that simply work better together. This space is finding natural resonance with verticals like health care, higher education, and retail banking. Smaller vendors are nimble and can bring joint offerings to these spaces quickly. We’ll see how this prediction pans out as the year progresses. RSA Finally, we are headed, along with just about everyone else in the space, to the RSA conference next week. I’ll be hanging around our booth (#1816) along with the rest of our bloggers: Dave, Rob, and Doug. Come on by and say hi. Put a face to the blog entries. Tags: identity, IdM, identitymanagement

Before every major Apple event, a gaggle of rumor mills spin into action. From home media stations, to tablet devices, to spreadsheet applications, to Steve Jobs being declared iMaster of the Universe. Yup, everyone with a crazy idea for an Apple product makes their equally crazy predictions. But, there is definitely one announcement that they did not see coming. Ours. Today we announced the public availability of our Identity Driver for Mac OSX. Granted, Steve wasn’t on stage talking about it, but we are going to work on that for next year. Okay, okay, so it isn’t an Apple product, but it does run on a Mac. The rumor mills shouldn’t be ashamed about not anticipating our release. No one expects identity management news out of Macworld. Heck, people don’t expect identity management news about Apple at all. That doesn’t seem right to us. Macs in the enterprise are more and more common. And it’s not just the design staff and the cool people who have them; it’s regular people too. We have customers with Macs in their enterprise. They wanted to be able to establish pervasive identity in their Mac communities just as they can with their Windows and Linux environments; they required a complete view of their world. Our customers asked and we delivered. And that was that… less getting some new Macs in the office and a bit of development work. With all the regulatory and operational pressures of todays world, our customers realize that having an incomplete view of the enterprise is unacceptable. A partial audit will only keep your CFO partially out of jail, which gets the CIO partially fired and CEO partially indicted. All said and done, I am glad we got Apple endorsed this press release. It demonstrates their commitment to enterprise customers. Identity management in the enterprise cannot have any gaps, no clump of disparates users of kinds of machines can be excluded. We are giving our customers complete vision into their enterprise and this new driver furthers our cause. Technorati Tag: identity, mac

The creepy thing about this article is not that government websites are using cookies. The creepy part is that most of them claim that they just took the defaults for their web authoring and serving software. We have seen time and time again that simply installing software and letting it run with default settings it nowhere close to a good security practice. With all those Security Configuration Guides out there, you’d figure someone would have read one. Technorati Tag: securtiy

Mark Dixon nailed it with his post on software being only a part of identity management. He sums with two great points.

1. Accept the fact that Identity Management projects are inherently complex. This is not because the software to be implemented is complex, but that Identity is at the core of how a business is operated. Many people will use the system. Many disciplines must be involved in making it work.

Bruce Schneier found this study of the nature of the insider threat as reported by The Register. Two of the points jump out at me:

• Two thirds (62 per cent) of those quizzed admitted they have a very limited knowledge of IT Security.
• More than half (51 per cent) of those polled had no idea how to update the anti-virus protection on their company PC.

Taking the second item first, that half of those polled have no idea how to update their anti-virus protection. My question is, why should they know? Given that a security system is as good as its weakest link and that time and time again users are that weakest link, it seems to me functions like this have to be taken out of end-users’ hands. Making end-users responsible for their the security administrator of their IT assets is a recipe for disaster. Security and identity management solutions, in order to be effective, have to be invisible from the end-user perspective. Like my Mac… they should just work. Despite what a lot of companies think, the majority of users out there are not computer savvy. They treat computers as a necessary tool, not unlike how people treat cars. They get you from point A to point B and you don’t have to know how they work to drive them. Computers get my draft budget up to finance and then my group gets money next year; I don’t want to know how the virus scanner peeks through my inbox looking for bad things. It is irresponsible to put the administration of security and identity management products on the end-user community. Yes, I know that the IT department is understaffed and overworked. Vendors know this too. IT departments have to hold their vendors more accountable. Demand easier to install and maintain solutions. Search out products that do not put the administrative onus on the end-user. The other bullet point is troubling. I don’t have access to the raw data from this study, but I’d love to know how that other point was derived. 62% admitted they have a very limited knowledge of IT Security. My first question is: a limited knowledge of IT Security administration or best practices? Companies need to train their users on safe computing, how to avoid phishing and other social attacks, not how to update their anti-virus protection. Knowing which icon to click to start a VPN session does not make the computing world safer for anyone. Teaching people what the little lock means in Firefox and to look for it, teaching them not to disclose their passwords for a candy bar, teaching them that not all websites are full of happy loving downloads: these things help make users safer. They help make corporate computing environments safer too. (They help make home computing safer as well.) We have trained users over the years to disgorge their username and password into any fields labeled username and password. We haven’t given our end-users a more transparent way to be more secure. We haven’t truly embraced the education and self-assessment side of security and identity management; we need to. Take security administration and related decisions out of users’ hands. Foster a security-aware culture in the enterprise. Educate users; don’t inundate them with products that throw yet another icon in the system tray. Make their lives simpiler, educate them, give them less security (administrative) choices, and we will start finding our IT environments safer and more secure.

So another player in the identity market has been absorbed. HP is acquiring Trustgenix Reading Andre’s blog entry on this subject got me a nostalgic. Maybe its the season. Maybe its the leftover turkey’s tryptophan. Being part of the 1st generation of user provisioning tools in the market, and having been acquired by a “suite” vendor, I’ve had a ringside seat to watch the industry expand and contract. There was the first wave of expansion with Access360, Business Layers, Waveset, BMC for provisioning and Oblix, Netegrity, Securant, DASCOM, Entegrity for web access control. There was Courion and M-Tech for password management. Among the meta-directory group you had iPlanet, Novell, Siemens, Zoomit. OctectString and RadiantLogic were there for virtual directory services. Then there was the first major market contraction. The bubble had burst. We had blown through our cash. The dreams we had of making a squillion dollars vanished… now we had to actually work for our money. In this first major contraction, we saw CA eat Netegrity who ate Business Layers. IBM swallowed Access360, DASCOM, and Metamerge while Sun consumed Waveset. RSA bought Securant. Microsoft got Zoomit. Oracle bought Oblix and, recently, Thor and OctectString. (The ink has barely dried on this one but I consider the tail end of the first market contraction.) As the first market contraction was going on, the second wave of expansion was beginning. This centered around web services, federation, SOA, and the like. In this second wave, there are players like: Trustgenix, PingIdentity, Sxip, SOA Software, Layer 7, Symlabs. We have started to see the second contraction as HP acquires Trustgenix. There will be more to come. The real question is will the identity suite vendors buy companies from this wave, or more traditional middleware vendors snatch these players up? Federation and web services deals more with a business interaction as it happens. They deal with identity issues on the fly. Vendors from the first wave focused on the setup and tear down of identity around the business interaction. The BEA Weblogics and IBM Webspheres of the world deal with business interactions in flight and probably are more interested in the second wave vendors than the pure identity suite vendors. What’s going on now? The third wave of identity is rolling along now. The third wave focuses on activity in applications, information governance, identity in the network, and role / privilege analysis. Here we find us, Eurikify, Bridgestream, Prodigen, TIzor, Consul, Virsa, and others. This wave brings a new perspective, an identity-focused perspective, to old subjects like network and application activity. This new perspective was long in coming. Where is this market going? We have yet to see a second and third wave of contraction in the market, and we are bound to. The quest for the complete identity suite is winding down as vendors realize how hard it is to stitch together all the peices they need. Instead of unifying policy tools, we’ll get unified reporting in the name of compliance. Business orchestration tools will consume a lot of the federated and SOA players out there. As one vendors gets absorbed into another, new ones spring up. We are starting see a lot of activity reputation, portable identity, Identity 2.0, etc. As this market matures, it keeps getting more and more interesting. Technorati Tag: identity

Bruce Schneier posted an essay he wrote on Surveillance and Oversight over on his blog. He compares the FBI’s actions over a potential terrorist threat during Christmas 2003 to the response to a potential riot by the Rotterdam police force. He illustrates how the FBI’s lack of judicial oversight coupled with FISA warrants and national security letters leads to its ability to consume massive amounts of data about people without their consent and knowledge.

I was thinking about the role management panel at Digital ID World in New York this weekend. My first reaction to the panel discussion, which consisted of BearingPoint, Prodigen, Bridgestream, and Thor, was that roles are finally growing up. The idea that roles require lifecycle management just as identities do is, at first, a little shocking but then makes a great deal of sense. Working in the enterprise provisioning market for years, I got used to hearing how hard it was to complete a role deployment. At the same time you had Burton Group and others professing the value of roles. Customers were fighting both the difficulties in deploying identity management solutions as well as the difficulties in understand and leveraging roles. As the industry provided better automation for the provisioning problem, we saw deployment times go down. But, roles were still tough to deal with. We are now seeing tools to help truly automated the role lifecycle management problem. One of the points that was agreed upon by the panel members was that business roles are separate from IT roles. Who I am in a company is very different than my privilege sets in target systems. Some provisioning products attempt to make this distinction. By elevating roles to a discipline that truly needs its own tooling, we will be able to manage that distinction far better than we can today. I do wonder if potential customers will still look at roles as too difficult and not address them appropriately. “Roles are hard. See… they have to have tools to deal with them,” I can hear a potential buyer say. To this, I often respond with a wink, “IT would be simple if we didn’t have end-users.” My concern with role lifecycle management is not with the concept itself. I think this is a space that was long in coming. My concern is role lifecycle management is yet another “Management” or YAM. Our industry is full of YAMs. We’ve got the access YAM, provisioning YAM, strong authentication YAM, network security YAM, federation YAM. As we look forward to 2006, I think we are going to see pushback against YAMs. Customers are growing weary of yet another policy tool, yet another reporting tool, and another YAM. I think that some of the false hope in the past market consolidation and the IdM suite vendors was that they would cut down on the YAMs. The dream of a single tool that translated business goals and regulations into their various IdM components: access, privacy, provisioning, etc, has yet to be realized. I worry that the number of YAMs keeps increasing without unfiying language and tooling. I worry that the industry is over-specializing without having generalist tools to link these specializations together. It’s good to see these vendors working together to tackle the role lifecycle management problem from different sides. In their own way, they are fighting the YAMs. We need more impromptu collaborations between solution vendors, deployment specialists, and visionaries. We need less YAMs. With Thanksgiving fast upon us, I leave you with a yam recipe that will leave your guests in a food coma. If we can’t help fight YAMs in our products, we can at least fight yams one fork at a time! Technorati Tags: identity