Role Up-Role Up

Today I attended a CIPCOG event, these events are not normally my bag but this one carried the strap line “Identity Management” overall the event was very informative, particularly for the target audience whose main interest seemed to be in and around the information assurance arena. There was one presentation that I thought highly thought provoking, the presentation was delivered by Tony Colling’s, who leads the information assurance team within the National ID card program. Colling’s is a seasoned presenter, whose approach was refreshingly frank, honest and open. The guts of his presentation centered around, how, we the citizens in  the UK prove our Identity.

It is widely accepted that a birth certificate, in most instances will be accepted. For a passport a birth certificate will be needed and a photo signed by a responsible person, like wise for a driving licence, an application form and a birth certificate will suffice. Colling’s challenged the concept that a birth certificate is a suitable documentation to use for authorisation purposes. He went on to provide and example of when he registered his child’s birth, he went it to an office informed them he now had a child, they hand wrote him a birth certificate. Easy as that. From my own experience things have not changed much, I think that I was given a letter from the hospital and my wife and I had to produce our passports. Job Done.

The point being made, challenges the rights/wrongs of UK residents being issued with a National ID card on the basis that they have a birth certificate, when we know for a fact that the system of issuing them is flawed, and susceptible to fraud, with out a great deal of sophistication. I am sure we would all say no that’s “terrible”. But what is the answer? What mechanisms and checks and balances should be used? Lots of challenges, one of Colling’s analogies is “juggling chain saws” in this instance I think he could be right. This presentation is yet to be published but an earlier one of a similar ilk can be found here. 

As a pure coincidence, tonight, one of my 16 year old relatives came to me bragging about there ability to go out boozing, when I challenged this fact, they openly admitted to acquiring, shall we say less than genuine ID. I have no intention of doing an advertising job here, but to appreciate the extent of the potential problem have a look at this site http://www.photo-id.co.uk/. This loosely links with one of my earlier blogs around roles. There is one thing for sure, with the ease that fake identification is readily available, Tony Colling’s dilemma seems to grow and grow. 

In this weeks Economist (25th November 2006) there are a couple of really good articles. First, the ongoing Murdoch v Branson ITV saga. The second, around the NASDAQ’s envisaged takeover of the London Stock Market. Maybe of more interest are 2 separate advertisement features I thought note worthy. Both of these are centred on Collaboration. A full briefing paper can be downloaded at http://www.economist.com/sponsor/bt/.

The first is by BT and is titled “Why firms are collaborating” it identifies a number of key areas where collaboration can give huge business benefits, it goes on to talk about the sophistication of organisations technology and that technology is simply an enabler, it falls short of mentioning the word federation, but that’s the crooks of the article. 

The second is by Capgemini and titled “Collaborative Business Experience” a slightly different feature as it is more to do with working in partnership, with Capgemini to transform your enterprise. Should keep Paul Toal busy.

As 2006 draws to a close, the buzz word “Collaboration” in lots of different contexts seems to be growing in popularity. It is destined to get hammed during 2007 as I am sure we will see a massive uprising in the take up of federation as well as the realisation that jointed up working can offer huge savings and significant business gains. 

I read with a great deal of interest an article by Erin Norlin headed up Roles: driving network access control, full article can be found at http://blogs.zdnet.com/digitalID/?p=55. To sum up the article talks about sharing role information gathered at the application layer and utilising this information to control access at the network layer, in effect simplifying administration and enhancing policy enforcement, as well as adding to the security mechanisms. 

 I am sure that anyone who has daily dealing’s with products like CA’s Access Control or looks after ACL’s on Cisco routers or firewalls will see massive benefits in this approach, the article does identify the challenges of vendors in “The defining of, management of and refining of” roles. 

This is another (hidden) area where huge business benefits will be gained by the adoption of a provisioning solution and incorporating it with roles based access control. Once this information has been gathered, the steps to extend it beyond traditional applications to the network layer should be relatively painless.   

I guess its well recognised that the UK are about 12 to 18 months behind the US when it comes to the up take of technology, my colleague Brent Thurrell and I had a lengthy discussion around this topic with a customer  last week. The UK’s lagging can be clearly highlighted when you look around at the number of UK companies embarking on IAM projects, to say the least it’s been limited. The drivers to deploy the technology and reap the benefits are not the same; excluding US listed organisations we do not have the dreaded SOX as a driver in the UK. It would appear that is about to change.  

The EU has tabled its Capital Requirements Directive (CRD), which is the EU’s transposition of Basel II into European law. It will become effective in each country once every EU member state has ratified CRD into its own national legislation. Ratification of the EU’s interpretation of the Basel II framework in the CRD directive means that financial institutions must comply with its rules by 2007, or by 2008 for the most advanced set of internal risk ratings provided.

 Although many financial institutions put their plans for complying with Basel II on the back burner while the accord’s effective date was in question, the impending ratification of CRD means that compliance strategies have been brought back to the budgeting table - for European companies at least.   

Pure speculation at the moment but this may happen as soon as April, for those in the IAM space in the UK, we should find ourselves a whole lot busier. Bring on the legislation……. 

For those that are interested this link is worth a read http://www.it-director.com/business/compliance/content.php?cid=8031

I recently attended my first Oracle architects club event; I was particularly interested as the main strap line was around Identity Management Strategies. I fully expected some kind of sales pitch and was pleasantly surprised when it became apparent that was not the case.

John Madelin was a fantastic speaker; I felt a great deal of his material was from a slightly more academic stand point rather than practical, but it gave a great deal of insight in to the future of IM and federation, supplying plenty of food for thought.  

The Q&A session seemed to be steered towards ID cards and privacy, both were fascinating subjects and even more compelling when brought together. The closing conclusions summed up that roles would be a fundamental part of IM moving forward, due to time the session was brought to close.  Post the event I have spent some time reviewing a number of the blogs from other attendees, I have found 2 of particular interest-:  I agree with Paul Squires in his Identity Discussion, he writes about how roles rather than identity could be used to establish either an “under 18” or “over 18” year old, thus entitling that individual to buy and consume alcohol. The individual’s personal details other than age are irrelevant in this instance so a role fits perfect.

 On the other side of the fence I tend to disagree with Drew Wagar when he writes in his Identity Increases Privacy blog. I would argue that once an individual’s identity has been exposed his privacy has gone to some degree. To add privacy, that identity should be wrapped up in a role, so in Drew’s example, “entitled” or “not entitled” would suffice. Utilising the EMV as Drew says would enhance that privacy, again in this example the users identity is totally irrelevant, the card reader does not care who they are, its only concern is the card holder’s entitlement (role). 

All in all the entire event was very thought provoking; I hope the next one in March is as good. 

So, here goes my first steps in to the world of blogging. The intention is to start slow and build up.