Burton Group Identity Blog

Symark Acquires BeyondTrust

Blogger: Mark Diodati

You may have heard about Symark’s acquisition of BeyondTrust. Symark is best known for its UNIX security product- PowerBroker. BeyondTrust’s primary product is Privilege Manager. Privilege Manager provides authorization (specifically, privilege delegation) for the Windows platform. The product provides Windows Group Policy templates, which enable more granular privilege delegation.

Symark has taken the BeyondTrust corporate name. It’s likely that BeyondTrust will rename Privilege Manager to PowerBroker for Windows. The Privilege Manager acquisition enables BeyondTrust to leapfrog most of its UNIX security product competitors into the Windows access control market. Only CA has a companion product for Windows. Centrify, IBM, Novell, and Quest have roadmapped Windows authorization capabilities for next year (for most of the vendors). It’s interesting that the UNIX security market leaders – CA and BeyondTrust – now possess Windows security products.

I have been skeptical for many years about necessity of a Windows product that is analogous to the classic UNIX security product. Microsoft Windows already provides the functionality that the UNIX security products provide, including centralized IdM, privilege delegation, event auditing, and finer-grained discretionary access control lists (as compared with the standard UNIX model). Windows systems clearly have a different security model and policy enforcement points (PEPs) as compared with UNIX systems. The different PEP model results in distinctive policy sets within the UNIX security product.

Still, “I want (fill in the blank with your favorite UNIX security product) for Windows” is a common utterance from customers; I have heard it, and I know that the UNIX security vendors have heard it, too. When the conversation goes a little deeper, product requirements become more ambiguous.

Ultimately, I think that customers are looking for common activity and forensic auditing, and a single place to analyze the access rights of privileged users. It remains to be seen if a Windows PEP or if privilege restriction capabilities are required.

We’re living in interesting times. Either by acquisition or development, the AD Bridge, UNIX security, privileged account management, and Windows authorization vendors are beginning to cross over into different product classes. Burton Group will be discussing this trend in our September TeleBriefing on September 29/30 – “Markets Colliding: UNIX Security, Active Directory Bridge, Privileged Account Management, and Windows Authorization” (subscription required).

For more information on UNIX security products, please see the IdPS report “Providing a Strong Foundation: The Resurgence of UNIX Security Products” (subscription required).

US Government Identity News

Blogger: Bob Blakley

9/9/9 was a day of announcements.  You’ve already undoubtedly heard about the 64GB iPod touch, and if you’ve also heard about the new Leica M9 you know what to get me for Christmas this year.

But the identity world had its own big news today; the news is that the US Government has teamed up with the OpenID Foundation, the Information Card Foundation, the Kantara Initiative, and InCommon in creating the Open Identity Initiative. 

This is a really big deal, for two reasons.

First, as a condition of playing with the government in this game, OIDF and ICF have had to address the longest-standing and most serious defect in the open identity ecosystem: the lack of a trust infrastructure.  “What’s a trust infrastructure”, I hear you cry...

When you receive an X.509 certificate from a PKI provider, you can go to the provider’s site and read its Certification Practice Statement.  This statement provides three critical pieces of information:

1. What the provider does to ensure that the person who sent you the certificate is who he says he is.
2. What the provider does to ensure that its own systems aren’t compromised in a way that would allow people to create fraudulent certificates or steal private keys.
3. What obligations the provider undertakes and what remedies it will provide to its customers (i.e. YOU) if it breaches those obligations.

There’s never been any equivalent of a Certification Practice Statement for open identity providers.  Today’s announcement changes that.  The Open Identity Initiative has created a Trust Framework Provider Adoption Process which will allow organizations to set themselves up as roots of trust for open identity.  Organizations which serve as trust roots will assess the practices and guarantees of identity providers, and they will establish registries of providers and “score” them against a set of identity assurance criteria aligned with the Liberty Alliance Identity Assurance Framework and the OMB M-04-04 and NIST SP 800-63 guidelines.

So, if a few serious organizations sign up to become Trust Framework Providers, we’ll finally have a trust infrastructure for open identity.

The second reason today’s announcement is a really big deal is that, after years of government attempts to create identities and assign them to citizens (via such bad ideas as the UK National ID scheme and the US REAL-ID act), a government has finally recognized that individuals already HAVE identities, and that it’s a better idea, for most purposes, to use these identities than to establish a new government bureaucracy to create new identities – especially if they’re identities people don’t want.

If this initiative succeeds, and I hope it does, it’s almost certain to be a much cheaper route to government consumption of reliable digital identities of citizens than something like REAL-ID would be.  And it will preserve consumer choice at the same time as encouraging innovation in commercial identity technology.

So three cheers for Vivek Kundra and the boards of the OpenID Foundation, the Information Card Foundation, the Kantara Initiative, and InCommon.  And while we’re at it, let’s not forget to congratulate OSIS and the Internet Identity Workshop, where many of the technologies behind today’s announcement were developed and more of the ideas were born, and the Liberty Alliance, whose work on the Identity Assurance Framework is the keystone of the trust infrastructure we are finally about to see.