Burton Group Identity Blog

Catalyst Tickets: Get 'em While They're Hot

Blogger: Bob Blakley

Somebody asked me this today:

Is it true that the Burton Group Catalyst conferences have been cancelled now that we've been acquired by Gartner?

Um, how shall I put this...

DON'T BE SILLY: THE CATALYST CONFERENCES ARE ABSOLUTELY HAPPENING!

Gartner bought Burton Group because they love our content, including our Catalyst content.

In fact, here in IdPS we're betting that Catalyst - both in Europe and in North America - is going to sell out early, because as a result of the acquisition we're going to have more customers.

And you're not going to want to miss the IdPS content at Catalyst this year.  The team's been taking advantage of our (ahem) unexpected get-together this week to work on our presentations.  What we're going to lay out for you at Catalyst is that 2010 marks the beginning of a revolution in the enterprise's identity architecture.  We're going to tell you what we think is coming, and we're going to show you a roadmap to help you get from the identity infrastructure you have today to the one you'll need to have in the future.

Book your tickets now; we already have.  See you in Prague, or in San Diego, or both.

Identity and Leadership: Sorely Lacking the Latter

Blogger: Kevin Kampman

Last weekend, my wife and I conducted a whirlwind friends and family tour of western Washington State. Starting Friday morning in Seattle, we drove to Marrowstone Island, then to Glacier via Port Townsend, Deception Pass, and Bellingham.  Saturday we drove to the top of Mt. Baker, then back to Tukwila. Sunday, we were off to Carnation (just east of Redmond) to visit a horse we helped the Cowgirl Spirit Rescue Drill Team save from slaughter. We met with Juliane and JJ, and turned out Bazkheno DaVinci (you thought only people had naming issues) onto a 20 acre lot with five other rescue horses. It is a sad situation that trained horses like Baz turn up at auction; sadder still that many of them turn up as someone’s dinner.  

Sunday evening we had a fine Italian dinner with my wife’s family in Seattle; no pets were on the menu. I did have a conversation about the IT and business divide with one of my cousins, from a business perspective. More about that, later.

Bazkheno DaVinci (grey horse at center) and other rescues, Carnation WA

So, where am I going with this? Burton Group has been following identity, privacy, and electronic health records (EHR) for some time. In particular, the issues around liability and the potential for damages that could occur if patient records aren’t properly managed and protected. There are a variety of solutions coming to market to capture and maintain EHRs; some employers are mandating the use of these services. Microsoft and Google are making significant strides in this area, and Microsoft just made a significant acquisition of Sentillion that bolsters its health care portfolio. Even the government is in the act, providing substantial stimulus money for health records automation.

However, the record on these efforts is not encouraging. In a recent blog: Electronic Health Records: Are They Worth It or Not? by Robert Charette, the author cites research that indicates that while certain efficiencies may be realized by implementing EHR, larger concerns are surfacing about data mining of these records, primarily to benefit insurance and government  entities. The blog goes on to state that EHRs may have little or no impact on the quality of or reducing the cost of health care.  And, the risk remains that this information will be used for purposes other than originally intended. With the large government investment being made to implement these systems, the possibility exists that the investors, managers, and the government will ride roughshod over patient privacy unless powerful oversight over this information is established.

At dinner Sunday evening, we discussed an IT project that is being rolled out to meet an arbitrary schedule. This is in spite of misgivings on the part of business representatives about project preparedness and the potential impact of failure. The point was made that while the project had known issues, there was no one influential or powerful enough to stand up and question the current state of the effort. No one wants to take the fall. The horse is ready to run, so to speak, if only on three legs.  

As part of our current research on governance, we are learning that strategic, shared perspectives about business value and risk throughout projects, programs, enterprises, and communities is frequently lacking. For a business, this is regrettable. When there are life-affecting issues at stake, this is clearly unacceptable. In these situations, governance may not be enough. Leadership skills, advocacy, and authority for those least able to protect themselves are critical. Whether it’s a new financial or patient records system, nothing less is acceptable. Once the horse (or EHR, or any other personally identifiable information) is out the gate, there is little likelihood of bringing it back.

Hopes and concerns for identity

Blogger: Ian Glazer

A friend in the industry recently asked me for my thoughts on OpenID, InfoCards, and the US federal government's work to consume non-government issued credentials. Letting the question rattle around in my head for a while, here's what I've got so far.

My hope is that the overall ICAM initiative is successful—not because I have been eagerly waiting to interact with the federal government using some form of authenticated credential—but because we (citizens, enterprises and government) are at a pivotal moment in the history of the web. With the US government working with both the OpenID and InfoCard Foundations, there exists an opportunity to change how individuals interact with large organizations, both public and private. For the first time, individuals would be able to (even encouraged to) interact with a large organization (such as the US federal government) using an identity asserted, not by the large organization, but by the individual. In this case, the State is no longer the sole provider of identity. This breaks the monopoly that the State has had on credentials and is indicative of the future to come.

But there is a long road to walk before getting there. There are numerous concerns with these plans. Among these are notable security concerns, especially with OpenID, that the identity community is not blind to. These are not my primary concerns.

My primary concern is with the establishment of standard user behavior that could prolong existing problems. Today, after decades of enterprise training and a decade of consumer training, people naturally expect to see two text boxes on web sites. One is for their username and the one with the little stars is for their password. This behavior is ingrained. Changing this behavior is no small feat - just ask the OpenID and InfoCard groups. But it is a change that must occur to normalize people using something stronger than username and passwords to authenticate themselves.

My concern is that the behavior that is being established as a norm - the use of either an identity selector or some other user interface means - will become the username/password for the next generation. This isn't a hypothetical problem; the writing is already on the wall. Currently, OpenID will only be accepted for low-value transactions with the government known as Level of Assurance 1 (LOA1). Activities like filing tax returns requires a far greater assurance that the person is who they claim to be and thus require a Level of Assurance 3 identifier. And there is problem. The way people use an LOA3 credential may be very different than how they do so with an LOA1 credential.

If we, as an industry, normalize user behavior that meets LOA1 needs but not LOA3, we are training in behavior that has to get untrained in a near future. What the government and its partners are on the path to doing is effecting real cultural change. This kind of change doesn't happen often and is hard to do, and especially hard to undo.

I definitely want a future in which I can assert my own identity without validation from the State, but I am very willing to wait for that future to assure that the behavior the industry normalizes is one that will work for generations to come.

Death of the Attribute

Blogger: Kevin Kampman

Last week, I received a request from one of our Burton Group consultants for help in identifying where data breaches had occurred. When he saw the list, his response was unprintable. In another comment about data breaches, University of Colorado student Carrie Roll indicates that exploitation of this information is a disaster in waiting: "If anybody thinks their information hasn't been stolen yet, then they're pretty naive. Your information is gone, and it's just a matter of time until someone decides to use it."

This dismal outlook is closer to the truth than we want to admit. Industry has played fast and loose with identity information, and now we are all paying the price. Using common identity information for trustworthy business transactions is becoming more and more difficult, since much of the information has either been compromised or is available for a price from identity aggregators. Just doing a phone number lookup on the Internet introduces you to sources of identity information that may know more about you than you know yourself (see “The End of Secrecy”) . Not to mention the inconvenience and personal hardship that identity thefts create for those who have been compromised. Without identity attributes, we’ll soon find ourselves in a situation where interpersonal relationships are the only viable mechanism to assert that someone is who they say they are.

Businesses, educational institutions, and others have only themselves to thank for this morass. Early in my IT career (last century, enough said) I learned that Social Security numbers (SSN) weren’t unique and “not for identification” purposes. All you have to do is read the bottom of the card, which apparently, no one does. This issue is especially relevant for multi-national firms, since not every government has an identifier for their citizens. However, I quickly discovered that SSN was the common attribute for identity purposes in both North American commerce and education. So, on we went, blindly and full of faith that this would work forever. We didn’t realize that attributes were only protected to the extent that the systems that used them are secured. Although many attributes aren’t “private”, their publication or exposure lessens their value as a means to uniquely identify someone, or to assert their intent to enter into some form of relationship. 

Today, the security of individual attributes like SSN and even attributes in combination are increasingly suspect. Financial institutions are leveraging information that only the individual asserts to know (unverified in many cases) for challenge/response identification purposes. Their usefulness becomes less viable as they are used in more and more cases, and eventually subject to compromise. Since biometrics represent just another attribute, the chance that someone will compromise these is just as likely as any other information. Just a matter of time.

The pool of identity attributes is much like any other natural resource, something to be protected and preserved. As this pool diminishes, we’ll lament their passing and the perils and inconvenience their absence creates. The creation of new identity attributes will be costly, in terms of their integration with systems that consume them and the retrofitting of legacy applications. Not to mention the inconvenience to individuals. This makes the case for disciplined protection handing of personal information, risk management, and the assumption of liability for those who disclose and misuse it (see Bob Blakley’s post on the identity oracle). It also makes the case for identity services, so that the information is handled in a more controlled and manageable environment. Otherwise, we’ll be counting on birthmarks and the word of our neighbors when it comes to identity assertions.