Burton Group Identity Blog

Catalyst Europe call for papers extended

Blogger: Gerry Gebel

Here's a reprieve for all of you busy with Christmas shopping and holiday preparations: the Catalyst Europe call for papers has been extended until January 4th. Please consider sharing your identity management experiences with your peers in Prague this coming April! All the information you need can be found at the Catalyst web site.

Facebook privacy revisited: Privacy Mirror version 2

Blogger: Ian Glazer

Facebook's recent changes to its privacy system has been garnering a lot of attention and not a lot of it is good. Both the EFF and Kaliya Hamlin (via ReadWriteWeb) have written up their takes on the matter and, all in all, I think they are decent assessments.

With all the supposed changes in Facebook's privacy system, I decided to revisit my work with Privacy Mirror (you can catch the backstory: here and then here). Having retested PM with both friends and strangers, here's what I've learned: Plus ça change, plus c'est la même chose.

The more things change, the more they stay the same.

Facebook's inconsistent treatment of privacy still remains. In a nutshell, what a 3rd party developer can see in your profile, having been granted access to you via your friends, directly depends on whether you have the same application they do. If you and your friends use the same Facebook app, then the 3rd party developer will see your profile (and photos and posts, etc.) as if that developer was your friend. If you do not use the same Facebook app that your friend does, then the 3rd party application is subject to a different set of constraints.

I question whether the recent changes Facebook has instituted have even remotely satisfied Commissioner Stoddart's concerns with Facebook, specifically 3rd party access to user information. Although users can control the scope of disclosure of their posts a bit better, defaulting settings to "Everyone" access as well as potentially making user's social graphs public undermines any attempt to cast Facebook in a pro-user control light.

There's also a nit I'd like to pick with the privacy settings system in Facebook - inconsistent save behavior. In some cases, Facebook automatically saves changed to privacy settings. In some cases, you have to press Save. This is a small point but it points to a larger issue. If service providers do not provide their users with meaningful, usable choices when it comes to controlling privacy and disclosure controls, but instead heap more controls in hard to find places, then these service providers have not aided their customers in the least. More user choices only equals more user control if those choices are clear, consumable, and centralized.

If you want to conduct some of your own testing of Facebook's privacy system, feel free to play with Privacy Mirror. The following are new features I've added:

• PM tests to see if the person your are pointing the Mirror at is a Privacy Mirror user. If they are you'll get results based on their privacy settings with respect to you as a person. If they aren't you'll get results based on their privacy settings with respect to Privacy Mirror being a 3rd party application. This behavior is core Facebook Platform behavior which I feel is inconsistent and puts people at a disadvantage.
• PM tries to find some photo albums that the person may have added
• PM tried to find some photos that are tagged with the person in question
• Added the ability to point the Mirror at a specific person better using their username

ActivIdentity acquires CoreStreet

Blogger: Mark Diodati

You may have seen that ActivIdentity Corporation will acquire CoreStreet Ltd. Since its de-emphasis of its enterprise single sign-on business (primarily the result of the Protocom acquisition in 2005), ActivIdentity has focused on strong authentication. While ActivIdentity has one-time password solutions, its technological crown jewels are its smart card offerings. Its smart card management system and smart card middleware products have a significant footprint in the US Federal Government.

CoreStreet’s products complement ActivIdentity’s smart card solution. CoreStreet provides a PKI certificate validation solution, which is arguably a requirement for large-scale smart card deployments. CoreStreet also has a handheld device that enables the authentication of Federal agency personal via their PIV smart cards. The device is handy in scenarios where emergency first responders arrive at a disaster site. Finally, CoreStreet offers a solution which enables the PIV card to be used in an unmodified physical access control systems (PACS). It is pure conjecture on my part, but I am guessing that the solution involves hashing or truncating the PIV card’s Card Holder Unique Identifier (CHUID) to make it compatible with Wiegand-based PACS. CoreStreet’s products are aligned with the Federal Government smart card market, which co-incidentally is ActivIdentity’s primary focus. The certificate validation solution is appropriate for large smart card deployments in the enterprise, too.

Overall, the acquisition is a good move for ActivIdentity; it will enable ActivIdentity to market a broader smart card solution to the Federal Government. For customers of both companies, the acquisition provides a single vendor relationship. For more information on PACS and Federal Government smart card initiatives, please see our research documents “Let’s Get Logical: The Convergence of Physical Access Control and Identity Systems” and "U.S. Federal Authentication Programs Making Progress, but Much Work Remains" (subscription required).

Microsoft acquires Sentillion

Blogger: Lori Rowland

Today Microsoft announced its plans to acquire Sentillion, Inc., a privately held identity management (IdM) company based in Andover, Massachusetts. Sentillion is exclusively focused on offering identity and access management products for the healthcare industry. Its portfolio of products includes single sign-on, provisioning, context management, advance authentication, and desktop virtualization capabilities. Sentillion is well known for its single sign-on (SSO) and clinical workstation solutions. Through these solutions Sentillion enables various activities including SSO to common health care applications, proximity based authentication, advanced audit capabilities, and streamlined workflow processes. 
According to the announcement, the Sentillion portfolio will be combined with Microsoft Amalga Unified Intelligence System (UIS), a data unification tool that allows health care professionals to aggregate data across multiple patient records.  These products are a component of Microsoft’s growing Health Solutions Group. This move is no surprise as investments in healthcare technologies are expected to grow particularly given that the US recently passed a $38 billion bill designed to make it easier for hospitals to invest in technology. 

The acquisition of Sentillion was initiated through Microsoft’s Health Solutions Group. That said, it may have wider reaching implications on Microsoft’s overall IdM strategy. Microsoft’s IdM portfolio has been lacking an enterprise single sign-on (eSSO) solution; Microsoft has relied on partners for this capability. Obviously with the acquisition of Sentillion, the Microsoft IdM product group may have an opportunity to utilize the capabilities provided by Sentillion’s SSO products. But, Sentillion has designed its products specifically for the healthcare industry and they may be lacking some of the functionality required by enterprise organizations. 

Although Sentillion brings some unique IdM functionality, there is some duplication between Sentillion’s provisioning solution and Microsoft Forefront Identity Manager.  It is not likely that provisioning was the primary focus of this acquisition, but it will be interesting to see what Microsoft does with Sentillion’s provisioning technologies. While Sentillion’s ability to integrate with AD and Microsoft’s identity infrastructure was probably a consideration by the Microsoft Health Solutions Group that sponsored this acquisition, there is no indication (as of yet) from Microsoft that any of the identity technologies offered by Sentillion will be added to the general identity and security portfolio for use outside of the healthcare vertical. Rather, it appears that this solution will be optimized for the healthcare vertical and may not fully leverage the more general provisioning and claims-based access control features available from Microsoft Forefront solutions.

The acquisition of Sentillion is a positive move for the Microsoft Health Solutions Group and may present an opportunity for the Microsoft IdM group. In the short term it does not appear that the acquisition will have an impact on the Microsoft Forefront Identity products, but it remains to be seen what impact it will have on Microsoft’s longer term plans. The company does run the risk of running two separate, but related, IdM strategies if the Microsoft Health Solutions Group continues to develop out its IdM capabilities without coordinating its efforts with the IdM development group. As the acquisition closes, the company must develop a unified IdM solution and message. 

Identity and Leadership: Sorely Lacking the Latter

Blogger: Kevin Kampman

Last weekend, my wife and I conducted a whirlwind friends and family tour of western Washington State. Starting Friday morning in Seattle, we drove to Marrowstone Island, then to Glacier via Port Townsend, Deception Pass, and Bellingham.  Saturday we drove to the top of Mt. Baker, then back to Tukwila. Sunday, we were off to Carnation (just east of Redmond) to visit a horse we helped the Cowgirl Spirit Rescue Drill Team save from slaughter. We met with Juliane and JJ, and turned out Bazkheno DaVinci (you thought only people had naming issues) onto a 20 acre lot with five other rescue horses. It is a sad situation that trained horses like Baz turn up at auction; sadder still that many of them turn up as someone’s dinner.  

Sunday evening we had a fine Italian dinner with my wife’s family in Seattle; no pets were on the menu. I did have a conversation about the IT and business divide with one of my cousins, from a business perspective. More about that, later.

Bazkheno DaVinci (grey horse at center) and other rescues, Carnation WA

So, where am I going with this? Burton Group has been following identity, privacy, and electronic health records (EHR) for some time. In particular, the issues around liability and the potential for damages that could occur if patient records aren’t properly managed and protected. There are a variety of solutions coming to market to capture and maintain EHRs; some employers are mandating the use of these services. Microsoft and Google are making significant strides in this area, and Microsoft just made a significant acquisition of Sentillion that bolsters its health care portfolio. Even the government is in the act, providing substantial stimulus money for health records automation.

However, the record on these efforts is not encouraging. In a recent blog: Electronic Health Records: Are They Worth It or Not? by Robert Charette, the author cites research that indicates that while certain efficiencies may be realized by implementing EHR, larger concerns are surfacing about data mining of these records, primarily to benefit insurance and government  entities. The blog goes on to state that EHRs may have little or no impact on the quality of or reducing the cost of health care.  And, the risk remains that this information will be used for purposes other than originally intended. With the large government investment being made to implement these systems, the possibility exists that the investors, managers, and the government will ride roughshod over patient privacy unless powerful oversight over this information is established.

At dinner Sunday evening, we discussed an IT project that is being rolled out to meet an arbitrary schedule. This is in spite of misgivings on the part of business representatives about project preparedness and the potential impact of failure. The point was made that while the project had known issues, there was no one influential or powerful enough to stand up and question the current state of the effort. No one wants to take the fall. The horse is ready to run, so to speak, if only on three legs.  

As part of our current research on governance, we are learning that strategic, shared perspectives about business value and risk throughout projects, programs, enterprises, and communities is frequently lacking. For a business, this is regrettable. When there are life-affecting issues at stake, this is clearly unacceptable. In these situations, governance may not be enough. Leadership skills, advocacy, and authority for those least able to protect themselves are critical. Whether it’s a new financial or patient records system, nothing less is acceptable. Once the horse (or EHR, or any other personally identifiable information) is out the gate, there is little likelihood of bringing it back.

The Identity Services Work Group: Coming of Age

Blogger: Kevin Kampman

The Identity Services Work Group (ISWG) has been successful identifying issues and approaches for identity management technology interoperability. This ad-hoc effort has been going on for several years and represents an international community of enterprise users and vendors. As an example of its activities, the ISWG produced an architecture and initial use case for authorization. Burton Group has published two documents summarizing these efforts (subscription required): The Challenge of Identity Services, and Identity Services Architecture: Working Toward Consensus.

In 2009, the ISWG participants recognized the need to formalize their activities. After surveying related groups and a discussion of options at Burton Group’s Catalyst conference, the decision was made to approach the Kantara Initiative. Gavin Illingworth (Bank of Montreal) led this effort, assisted by Jeff Broberg (CA) and John Tolbert (Boeing).

On December 2nd, the formation of the Identity and Access Services Work Group (IAS-WG) was voted on and approved. Among the benefits to the former ISWG and to the Kantara Initiative are alignment with and influence over related identity efforts, access to a broader and more global constituency, an open discussion of challenges and solutions, and facilitation of group activities.

The unique interaction between enterprise customers and product vendors at the ISWG was productive, and it is gratifying to see the effort move forward based on its initial success. Former ISWG participants and new members are welcome to participate, and can contact Gavin (gavin.illingworth@bmo.com) or the Kantara Initiative for more information.