Burton Group Identity Blog

“Role” World Challenges

Blogger: Kevin Kampman

On Wednesday afternoon at Catalyst, we closed the Identity Management, Role and Entitlement discussion with a panel consisting of enterprise practitioners Robert Amos of NuStar Energy, Paul Rarey of Safeway, and David Laurance of JPMorgan Chase. Also on the panel were Edward Coyne of SAIC, representing both the Veterans Administration and the INCITS CS1.1 committee responsible for Role Based Access Control (RBAC), and Alan O’Connor, Research Economist with RTI International.

The purpose of the panel was to discuss the challenges and opportunities facing Role Management as a discipline, and how industry can influence continuing efforts in the RBAC standards community. In particular, Alan O’Conner was at Catalyst to learn more about enterprise experiences with roles, in order to advise the National Institute for Standards and Technology (NIST) about areas for future investment.

There were several major observations from the panel. First of all, there was agreement that roles are a business challenge, but as Paul Rarey observed, “talking to the business about roles is a non-starter.” Instead, the conversation needs to focus on business value. Robert Amos cited success in convincing the business to take ownership of roles, however the proper infrastructure must be provided to manage the relationship of roles to resources.

Another challenge is in understanding what roles are about. David Laurance identified that there were seven applications of roles discussed during the afternoon:

1. To identify expertise
2. To manage job assignments
3. For authorization
4. To abstract identities from entitlements
5. To enforce policies such as separation of duties
6. To enable provisioning, and 
7. To establish accountability.

NIST and INCITS are interested in addressing implementation issues in organizations; this list represents a good starting point for future activity. It is not just the integration of attributes into applications that needs to be addressed, but guidance for organizations that want to characterize what people do in a meaningful context. 

David contributed three challenges for role management:

• Definition
• Analysis and interpretation, and
• Assignment to individuals.

During the afternoon, Robert and Paul provided excellent case studies about how their organizations successfully accomplished these, and admitted that their efforts are ongoing and would benefit from more consistent processes, procedures, and more effective role management applications. Alan observed that NIST needs these recommendations from industry in order to provide direction to their committees, and both Ed and Alan are soliciting participation of this nature.

Organizations wishing to provide input to RTI’s NIST survey can contact Alan O’Connor (oconnor@rti.org). Those interested in investigating revisions to the RBAC standard (INCITS 359-2004) can get more information about participation by contacting Ed Coyne (ed.coyne@va.gov) or Rick Kuhn (kuhn@nist.gov).

Transparent or Translucent?

Blogger: Ian Glazer

Last week I was at the recent Department of Homeland Security’s Government 2.0 Privacy and Best Practices conference. Not surprisingly the subject of transparency came up again and again. One thing that definitely caught my attention was a comment by one of the panelists that efforts towards government transparency are too often focused on data transparency rather than process transparency. While we have Data.gov as one of the current administration’s steps towards furthering government transparency, we do not have an analogous Process.gov. Said another way – we get the sausage but don’t get to see how it is made. This isn’t transparent government but translucent government.

From what I’ve seen I’d say that enterprises have achieved the opposite kind of translucency with their identity management programs. Though enterprises have achieved some degree of process transparency by suffering through the pains of documenting, engineering, and re-engineering process, they haven’t been able to achieve data transparency. Identity information has yet to become readily available throughout the enterprise in ways that the business can take advantage of. Identity information (such as entitlements) has yet to achieve enterprise master-data status. Worse yet, the quality of identity data still lags behind the quality of identity-related processes in the enterprise.

For those of you attending the Advanced Role Management workshop at Catalyst this year, you’ll hear me and Kevin present the findings from our recent roles research. Throughout our interviews we heard identity teams discuss their struggles with data management and data quality. Finding authoritative sources of information, relying on self-certified entitlement information, and decoding arcane resource codes were just some of the struggles we heard.  No one said that identity data transparency was easy, but without it enterprises can only achieve identity translucency and not true transparency.

Zen Mind, Newb Mind

Blogger: Ian Glazer

Being the new-ish addition to the IdPS team is, well, an interesting place to be.  Besides the requisite induction activities (ask me at Catalyst how you pick up the dry cleaning for a team who lives all across the country), I’ve been working with my peers on vastly different pieces of research.  And being curious by nature, I’m loving the chance to not only dig into different topics, but also observe how different people go about the actual process of analyzing a topic or a market.  One technique that Burton Group uses is Contextual Research (CR).  Essentially, the CR process is meant to challenge an analyst’s knowledge of a subject and their associated preconceived notions as to what problems enterprises face and how they are facing them.  It turns seasoned veterans, experts in the field, into beginners again.  This is what practitioners of Zen Buddhism call “beginner’s mind.”

Here’s how it works in a nutshell.  Kevin (seasoned vet) and Ian (newbie) identify a bunch of organizations to talk to.  So far nothing out of the ordinary as compared to our other approaches to research.  That being said, the conversations we have with these organizations is very different from typical research techniques.  Instead of coming to the conversation with a fixed hypothesis that we want to prove out, we come to the conversation with nothing.  No leading questions.  No surveys.  No preconceptions.

In these conversations, we, the analysts, are newbs. We let the people that we are talking to teach us what is important to them about a subject, how they have approached a problem, what wisdom they’d like to share with others.  The analysts furiously take notes, listen, and try not to talk.  Having listened to as many people as we can, we bring the whole team together to find affinities among the statements, identify trends and common techniques, and evaluate the state of a market through the eyes of a customer.

Right now, Kevin and I are in the midst of a role management CR.  Although, we are far too early in the process to comment on what we’ve found, some of the anecdotes we have learned along the way are really fascinating.  Discussions about the needs of the business, efficiencies gained, and methodologies for conducting role analysis – all of these conversations have been grounded firmly in the realities of today’s economy as well as current state of identity management in the enterprise.  You’ll see some of the results of this beginner’s mind approach to analysis at Catalyst this summer.  In fact, the Catalyst workshop on Advanced Role Management is going to be a master-class of a sort, shaped by what Kevin and I learn during this CR process.

Stay tuned for more on our roles CR.  Towards the end of April, I’ll be updating you on how the process has faired.

New Year’s Resolution: Let’s Talk More about SPML

Blogger: Mark Diodati

Jackson Shaw and James McGovern have been blogging recently about one of my favorite topics: Service Provisioning Markup Language (SPML).  I’d like to contribute to the discussion.  You can find Jackson’s blog entry from December 20 here, and James McGovern’s blog entry from January 5 here.

One thing that organizations using SPML should do is to secure the service from an authentication, authorization, and encryption perspective.  In most instances, because the number of SPML requestors and providers (this is terminology specific to SPML) are small, most organizations are opting to manually configure the requesting authority and the provisioning service provider with static passwords or certificate lists to establish trust between the provisioning services components.  These authentication techniques don’t provide authorization services in any meaningful sense.  A large SPML implementation requires authorization services to determine the rights of the requesting authority to manage the specific user on the respective provisioning service target.  In our opinion, the multi-tenancy (call it cloud-based if you like) use case is an example of a large SPML implementation – one must build the requisite authorization and authentication services to support the provisioning service.

SPML’s lack of authentication and authorization capabilities highlights the broader issues we see with the emergence of identity services.  An authorization service requires authentication services in order to have any utility whatsoever.  The authorization and authentication services may be consolidated (one big authorization and authentication service) or discrete (two separate services).  One example of a discrete authorization service is a XACML authorization service that leverages the user’s SiteMinder SMSESSION ticket for authentication.

As for federation and federated provisioning, the lack of provisioning capabilities remains an operational impediment.  Several years ago, a Liberty Alliance Technical Expert Group began working on a way to “harmonize” SPML and SAML.  While the services would remain separate “pipes”, the TEG was working on a way to harmonize the user attribute schema across the two services.

James’ blog entry discusses the inter-enterprise standardization of roles.  From talking to my colleague Kevin Kampman, there's been little if any traction to date.  It really highlights the fact that a role is a representation of responsibilities coupled to a relationship, and getting common agreement on this is problematic.

If you are interested in more detail, we published a research document on SPML.  The document discusses the v2 specification in depth, as well as the differences between the v2 specification and the v1 specification.  It also discusses the barriers to the ubiquitous use of SPML.  You can find the document at http://www.burtongroup.com/Client/Research/Document.aspx?cid=848 (client subscription required).

Last but not least…

Blogger: Kevin Kampman

Today CA announced the acquisition of Eurekify. Eurekify is the last of the original “big three” general purpose role management firms (Bridgestream, Vaau, Eurekify) to be acquired by a major identity management vendor. Oracle acquired Bridgestream and Sun acquired Vaau over the last 12 months. CA’s acquisition underscores the importance of roles in IdM, security, and related concerns, such as governance. At this point, integrated role management has become a competitive necessity for IdM offerings.

Eurekify provided one of the earliest discovery mechanisms for roles by examining the relationship of entitlements to users. Being first is not always beneficial, however. Early role management projects frequently became ensnared in, and failed, due to the difficulties of reconciling user entitlements to roles. Eurekify bore the brunt of the fallout of these challenges, even as it tried to address data quality issues, which continue to be the biggest challenge to these bottom-up discovery efforts. Fortunately, Eurekify’s persistence, willingness to engage the business, and subsequent focus on a sustainable management model brought clarity to the challenge.

The value of Eurekify’s initial vision was apparent. A number of IdM firms have, or have had, partnerships with the company. In the true nature of partnerships, many of these have expired or gone away; Eurekify’s most recent partnership with CA has become permanent. This leaves IBM and Novell among those still dating; Eurekify has moved on.

Eurekify’s influence has spawned competition and new development. Today we have a number of established and emerging role management solutions (such as SailPoint and Aveksa), who have participated in and benefited from the change in role management’s focus from administrative efficiency to business alignment. In reality, Eurekify may not be the last of the acquisition announcements, but it certainly underscores the importance of role management to identity initiatives. 

Thinking about Matt’s Simple Question: Correlating accounts and people

Blogger: Ian Glazer

Matt Hamlin, over at Sun, mentioned a conversation we had last week about a topic in identity management which doesn't usually get a lot of airtime: the correlation of accounts to people.  The exercise is the first step in answering Matt's simple question of "Who has access to what?"  Matt writes:

This step is the foundation for Access Certification, Role Mining, Entitlements Management, Policy Evaluation, Identity Auditing, and numerous other custom services developed by our customers.

There were two major omissions in his list: password management and user provisioning.  The reality is the correlating of accounts to people is a requirement for all identity management exercises.  This correlation isn't glamorous work and isn't a one time affair.  None the less, it is crucial "Identity Gold" for identity management projects, but also as the foundation for risk mitigation exercises as well.

Here's a tip to enterprises out there - ask your software vendors and deployment teams what capabilities they have to help facilitate this correlation.  Ask early and before you start down the path of an identity project.  Make it an on-going process governed by your overall identity management program.

I'll be touching on this a bit in an upcoming Telebriefing I am doing.  On October 1st and 2nd, I'll be giving a sneak peak of my research on access certification and will cover this and other topics.  If you are a Burton Group subscriber, you should check it out.  If you aren't a BG customer, you should become one.  ;-)

The Elephant Parade: Relationships, Role Management, Provisioning, and Identity Services

Blogger: Kevin Kampman

Catalyst 2008 went by so quickly, but that’s always the case when you are having a good time. It started off well, particularly when Bob Blakley couldn’t tell me (Kevin Kampman) apart from Mark Diodati on stage during the Market Overview. It helped that we had “Anonymizer 2008” bags over our heads, but Bob’s confusion is a good sign that lifestyle changes are at hand.

Conference attendees indicated their appreciation for the new presentation format; however, the changes are more than cosmetic. Several perspectives were presented that offer the potential to change the identity industry for the better. In particular, Bob introduced “relationships” as an overarching theme for the establishment and continuity of interactions.

Tim Weil, Vice Chair of the INCITS CS 1.1 Role-Based Access Control (RBAC) Working Group discussed their effort. His group is developing a standard for the implementation and interoperability of RBAC components described in INCITS 359-2004. Widespread adoption of the standard has been impeded by a lack of practical guidance; this effort is an attempt to resolve these issues. A military perspective was provided by Russell Reopell of MITRE, who discussed ABAC, or Attribute-Based Access Control. This approach requires qualitative attributes, such as roles and other characteristics, that can be evaluated singly or in combination by policies to make access decisions in real-time. It is particularly relevant in situations where pre-registration of users is not possible.

A practical need for role interoperability has been expressed by Darran Rolls of Sailpoint, who recently established the Open Role Exchange Forum. This forum was discussed during the Role Management and Provisioning vendor panel (including Rolls, Aveksa’s Jim Ducharme, Sun’s Nick Crowne, Oracle’s Jeff Shukis, and Eurekify’s Ron Rymon). The exchange represents an opportunity for more seamless enterprise role implementations by addressing how to normalize role definitions across multiple platforms. The panel concluded that role management and provisioning represent parallel complementary initiatives that will benefit both the business and administrative communities, respectively.

Ken Anderson, of Burton Group’s Executive Advisory Program, helped me to address a topic of significant interest to the business community: representing the value of role management. In a role play that featured Riley the Cat (a loose metaphor about conversations with executives), Ken and Kevin moved from a technical discussion of administrative trivia to a strategic overview of Return on Organization. The bottom line is that role management is a discipline, one that provides a relationship-driven perspective about the social dynamics of organizations. The point of the role play was how to speak to executives about business transparency and effectiveness, rather than administrative efficiency and compliance. The former is beneficial to the business, the latter to administration.

From a customer-centric perspective, it was standing room only for the Friday presentation and customer panel on identity services. The panel included Gavin Illingworth from Bank of Montreal, Susan Staples-Holt, MassMutual, Chris Harvison, ScotiaBank and Andrew Cameron, representing General Motors. Burton Group facilitated this year’s effort to establish the rationale and requirements for interoperable identity services. The multinational membership has grown to include contributors from financial services, manufacturing, telecommunications, and government agencies; additional interest has also been expressed by health services, pharmaceutical and educational institutions.

The current vendor efforts towards identity services are more project- than community-driven. Customers are challenged to deal with the development and integration of identity services, particularly for cross-platform and legacy purposes. While there is a general perspective about what the services should accomplish, there is no agreement on their demarcation or specifications for how they should do this. In order to develop this guidance, and to prioritize development activities, the participants have agreed to invite vendors and standards community representatives to contribute to the effort.

The area where there has been significant traction has been federation, but it has been challenged by supporting capabilities and agreement on information at the endpoints. Given the breadth of opportunities, one area for investigation includes authentication, authorization, and attribute services. Another is session and context management. Each of these represents an elephant-sized task; by working together we hope to line them up trunk to tail in short order.

Interested parties should contact me at kkampman@burtongroup.com for information on how to become involved. Our goal will be to develop shared requirements, a development plan, and an interoperability schedule to present during a joint customer-vendor panel at Catalyst 2008 in Prague.

Identity Management in Retrograde Motion: Thoughts from Burton Group Catalyst North America 2008

Blogger: Ian Glazer

I’ve been to many Catalysts but this was my first as a Burton Group analyst.  Besides seeing how the sausage gets made, so to speak, this Catalyst was different in that I got to speak to a lot of enterprises on their struggles and successes with identity management.  It was in these conversations that I heard a disturbing theme: "I’m not ready to do roles, so I won’t attempt user provisioning." This is truly a disturbing theme for both enterprises and vendors alike.

Before delving into why this theme scares me, let’s look back at the history of the market.  Role management products got their start five plus years ago.  At that time, user-provisioning tools had poor permission policy (entitlement) management capabilities.  Although user provisioning tools did provide some means to aggregating account permissions for given systems and a semi-automated way to dole those groups of permissions out, they were a bit cumbersome and difficult to report on.  Because these permission policies were difficult to deal with early adopters struggled getting automated provisioning projects off the ground.  Role management (and here I am speaking of IT or technical roles) tools filled a vital gap allowing enterprises to speed up their user provisioning deployments by accelerating and strengthening the entitlement management process.  At that time in history, there was something to the argument that role management tools were needed to deploy user provisioning.  That argument is no longer valid.  User provisioning tools have greatly improved their permission policy management capabilities and provide the enterprise adequate tooling.

Implicit in the idea that an enterprise cannot attempt user-provisioning because it is not ready for role management is the notion that user provisioning has no value to the enterprise without role management.  This is an outdated argument that is simply not true.  By delaying a user-provisioning program (and I say program here and not project), the enterprise cannot reap the benefits of more automated deprovisioning, password management, self-service account requests, and basic user provisioning itself.  Most importantly, by putting off user provisioning and waiting for role maturity to spontaneous happen, the enterprise risks putting off the most important part of any identity management program (role management or user provisioning alike) and that is establishment of governance.  Establishment of governance is the most critical success factor to identity management programs and if it is not established up front, future programs and projects have a nearly 100% chance of failure.

As I said earlier, the wrongheaded notion that user provisioning requires mature roles contains danger for vendors as well.  Vendors who have role management tools will find their bigger deals delayed as the enterprise waits for a sign that they are mature enough to begin their user-provisioning program.  Further, vendors will end up with more shelfware deals as there are significantly more implementation teams familiar with user provisioning tools than they are with role management tools.  Lastly, this disturbing theme constrains identity management to being viewed as a series of projects and not holistic programs and thus a lack of governance.

I have hopes that this theme is, in fact, observed retrograde motion of identity management.  I hope that the market and its thinking is not reversing gains, but instead exhibiting a transformative behavior that we have yet to see.  To close, keep in mind that both role management and user-provisioning efforts can be done in parallel and each will find benefit in the other as they mature.  Provisioning requires an understanding of process and procedure, role management an understanding of relationships and responsibilities.  To be successful with either, clear scoping and small iterative projects as part of an overall well governed program are advised to ensure current success and future growth.

Does acquisition equate to evolution? Enterprise Role Management at a crossroad…

Blogger: Kevin Kampman

It’s stimulating to take a vacation and return to find that you’ve been challenged to weigh in on an issue. Late last year, Sun acquired VAAU, a role management and identity audit vendor. This followed Oracle’s acquisition of Bridgestream, another enterprise role management (ERM) vendor, earlier in the fall.

Ian Glazer posted a blog entry on enterprise role management asserting that these acquisitions would broaden the capabilities of the respective vendors’ identity management (IdM) suites, as well as raise the bar for other IdM vendors in terms of providing ERM capabilities. Since there are fewer ERM acquisition targets than IdM vendors, this promises to be an active area for development in the coming year, particularly as organizations recognize the value that ERM provides. Ian went on to question who in organizations really benefits from role management.

From my perspective, the administrative benefits of role management (efficiency and accountability) are derivative; the real benefits come from realizing new, structural perspectives on the organization. In an interview I participated in this week, I was asked about the return on investment from IdM. While there are tactical advantages to administrative efficiencies, what is more valuable in my mind and what I asserted in the interview is the potential “return on organization”.

The term “organization” can be viewed in two ways. From a static perspective, an organization represents an entity composed of people and their associated responsibilities, assembled to accomplish a purpose or objective. As an actionable term, organization represents alternatives for how people and responsibilities are structured to meet those needs.

While many enterprises follow similar structural patterns, any single enterprise is unique (by accident or design). Enabling that enterprise to understand and to refine its structure in response to changing needs is a longer term benefit of role management. Capturing that perspective in management tools is the immediate challenge, and provides the foundation to analyze and improve organizational structure. A short term benefit is the ability to leverage this knowledge to improve the administration and management of the enterprise.

In answer to Ian’s question, the entire enterprise can benefit from this return on organization. Some of this will be measured strategically, some tactically. The prerequisite for realizing these benefits is to capture and to populate the knowledge base.

With the addition of ERM capabilities, IdM can provide a more strategic and valuable contribution to the organization. The acquisitions by Oracle and Sun represent the impetus for IdM evolution, but only if these solutions are used as business enablers. Otherwise, we’ve just improved our ability to document and maintain the status quo.

There’s a Lott to be said… For Oracle’s recent acquisition of Bridgestream

Blogger: Kevin Kampman

When I became involved with the role management industry about four years ago, it was a tiny and highly specialized market, tainted by difficulties and the potential for failure. This was due in part to its focus on access related information, particularly for role mining. In order to improve role management’s probability of success, it was clear that something needed to change. The solution was to associate business responsibilities with access rights.

About this time, I became familiar with Bridgestream and its founder, Ms. Juanita Lott. Unlike its competition, Bridgstream’s product architecture was very HR-oriented and incorporated business structure and responsibilities into the solution. This was a result of her previous HR background with a software development firm. She had a vision to address the shortcomings in organizational management tools, and turned to role management as a viable solution to address the association of resources and responsibilities. Although her involvement in Bridgestream has diminished, her influence is noteworthy. 

Today, the playing field is much more level. Role management vendors all acknowledge the requirement to address business responsibilities and their alignment with technical privileges. Additionally, role management is integrally aligned with identity management solutions, a perspective that also evolved as the market became more established. In our research, role management projects are much more likely to succeed as a result of their engagement with the business community.

The potential acquisition of Bridgestream by Oracle has been a rumor since early this year. Acquisitions in the identity management space are common, but unknown for role management, until now. The Bridgestream acquisition underscores the growing importance of roles as part of a comprehensive identity management solution; it is certain that we will see additional attention to and expansion of these capabilities. At this point, it is fitting to recognize the pioneers of role management and their respective organizations. They all had a vision for role management and have seen it through to fruition.