Burton Group Identity Blog

Rounding out the privacy agenda at Catalyst: US-VISIT

Blogger: Gerry Gebel

We are very pleased to have Bob Mocny, director of DHS’s US-VISIT program speaking during the privacy track next Friday, July 31. Bob’s abstract, listed below, fills out an incredible privacy agenda and ensures that you will be handsomely rewarded if you stay for the full Catalyst conference. Privacy debates abound in many circles and you’ll hear several next week as speakers from Covisint, Future Identity, UCLA, Georgetown University, and Google share their issues, concerns, and opinions of privacy.

Mr’s Mocny’s session info:
A Dual Mission: Identity Management and Privacy Protection in the Federal Government

Advances in identity management technology are providing significant security benefits to the U.S. government. At the same time, federal privacy statutes require the protection of personally identifiable information collected, stored and accessed by government officials. Learn how one federal program is successfully integrating the use of biometric technology and privacy protection requirements to enhance the nation’s security. Robert Mocny, director of the U.S. Department of Homeland Security’s USVISIT program—one of the world’s largest biometric identity management systems—will discuss how the program’s privacy strategies earn public trust and contribute to the overall success of the program. The practices employed by USVISIT are applicable in both public and private sectors and important for everyone involved in developing and implementing identity management systems.

Personal Privacy Impact Assessments for Facebook

Blogger: Ian Glazer

I’m reading Canada’s Assistant Privacy Commissioner Elizabeth Denham’s recently released findings into complaints levied against Facebook. (Report of Findings into the Complaint Filed by the Canadian Internet Policy and Public Interest Clinic (CIPPIC)against Facebook Inc. Under the Personal Information Protection and Electronic Documents Act.) My first reaction to this is, frankly, one of jealousy. I wish we had a similar commissioner/czar/wonk here in the US. I suppose elements of the FTC work in this regard but without the same charter, which is too bad.

Section 4 of the report is, for me, where the action is at. Section 4 is concerned with 3rd party application in Facebook and use of personal data by those applications. As the Facebook platform grows with new additions like Facebook Connect, issues of third-party access to user information will continue to be a concern to those who pay attention to such things. There’s a challenge here as the ways in which 3rd party applications use user information is hard to decipher, as it is, from an end-user perspective, a fairly black-box operation.

I wonder if Facebook could build a personal privacy impact assessment (PPIA) app. The PPIA would analyze the action you are about to take on Facebook, your privacy settings, the 3rd party apps you’ve allows access to your profile, and the privacy settings you have set for those apps. The PPIA could give you a quick read on which applications would be privy to the action you are about to do. It could indicate which groups of friends (based on your privacy settings) would see what you are about to do. Essentially, it would let you see across how much of your social graph a certain action (like posting a link or photo) will travel.

We all have PPIAs built in - one that is cultivated through social interactions schooled by social norms. When it comes to dealing with large systems, like Facebook, big business, or the government for that matter, we all can use a little help.  I wonder if someone can get a PPIA prototype up ahead of Catalyst to at least give me a warning about potentially embarrassing photos being posted somewhere…

Cloud SSO Interop Demonstration

Blogger: Gerry Gebel

If it's time for Catalyst, then it must be time for another interoperability demonstration! This year we are focusing on standards-based single sign-on to off-premise or cloud hosted applications. Of course cloud computing is all the rage this year and many enterprises are pursuing the benefits of utilizing SaaS applications plus directly accessing with more of their partner's applications. Such application scenarios can create additional usability and administrative burdens - and the purpose of this demonstration is to highlight how federation standards address the usability concerns.

Federation standards, such as SAML, WS-Federation and even OpenID and information cards can and are being used for authentication of users to off-premise applications. This demo focuses the attention to SaaS or cloud hosted applications and attempts to meet several goals, including:

- Show that federation standards are mature technologies, usable in many scenarios
- Illustrate that SaaS application vendors are already using federation standards
- Emphasize that enterprises should require SaaS support standards for SSO

In the past, interoperability demonstrations typically utilize a sample application during testing. This year, the demo includes real commercial applications - thanks to participants such as Cisco WebEx, Exostar (hosted SharePoint), eXpresso Corp, Google Apps, PivotLink, SalesForce, and even Burton Group's client web site. Other participants contributing from the federation software side include Arcot, CA, Cloud Identity, FuGen Solutions, IBM, Microsoft, Novell, OpenIAM, Ping Identity, RSA, Siemens, Sun Microsystems, Symplified, and TriCipher. FuGen Solutions and JanRain have also been developing some advanced scenarios to demonstrate how higher levels of assurance can be achieved in a federated authentication. Other organizations that have also participated include Azigo, Information Card Foundation, Microsoft Live ID, MySpace, Plaxo, and Yahoo!. Many thanks to all the participants who have been working over the last few months to bring this interop together!

A special shout also goes to Ping Identity, TriCipher, Symplified, and CA for their sponsorship to help cover interop expenses! Other sponsorships still available...

So, the interop demonstration is another reason to join us in San Diego for Catalyst - hope to see you there! Catalyst takes place July 27-31 and the demonstration will occur on the evening of July 29.

Are you authorized?

Blogger: Kevin Kampman

For over two years, the Identity Services Work Group (ISWG) has been holding a private forum to establish common requirements and architecture for interoperable identity-related capabilities. Progress has been made on service differentiation and an authentication model, and the Group’s work continues. In order to develop a broader perspective, the ISWG is holding an open meeting at Catalyst. This working meeting will focus on authorization and identity suite integration. If you would like to interact with other organizations and Burton Group analysts about your identity services needs, this meeting is for you.

NCR Leaves Dayton: It's About Time

Blogger: Kevin Kampman

Last week I was at the Novell Analyst Briefing in Waltham, the type of event where intellectual competitors are on their best (if somewhat restrained) behavior. It’s an event where we find things to discuss that aren’t contentious and that don’t reveal what we are really thinking. We save that for later.

At the dinner reception, I shared a conversation with a fellow analyst about other companies we knew. Since I live near Dayton and once worked for NCR, we had a nice chat about former CEOs, in particular, Charles Exley. She recalled that he was one of the last “true gentlemen” and how she was impressed about his collection of antique timepieces in his New York office. The passing of the hours was notable, in that the chimes all went off together.

Upon my return, I learned that NCR has decided to pull up its Dayton roots after 125 years and move everything to Georgia. Following upon the demise of several automotive facilities in the area, this is not good news. But, it was a long time coming and not without indication. Many former NCR employees believe it was the ill-fated 1990’s acquisition and divestiture of the company by AT&T that signaled the end.

I learned many things at NCR, among them: Managers do not speak “IT”, politics run rampant, and nice guys finish last. The Governor of Ohio and Mayor of Dayton both cited inaccessibility of NCR CEO Bill Nuti as part of the problem. He didn’t come to Dayton; they didn’t visit him in New York. Lesson learned: “There’s your sign”. It’s obvious that Georgia did a better job than Ohio of communicating with NCR about its future needs than its legacy. For that reason, NCR is moving on. 

In our recent role management customer inquiry project, Ian Glazer and I interviewed many companies and heard over and over about how important communications and governance are to project success. We’ll be discussing this at Burton Group’s Catalyst Conference in San Diego. In the meantime, if you aren’t having effective conversations with management, remember that silence may not be golden.