Next Identity Trend: Governance or Cloud?

A few weeks ago I had a conversation with a friend and co-worker about the next trend in Identity Management.  My point (and a bit biased based on my interests) was that Identity in the Cloud is definitely the next trend based on the current environment of services being provided and the need.  His thought was Governance is next.  Now I really don't know what is the right answer, but I do think both are important.  Governance is driven by regulation, easier access to information and regulation cost savings, and Cloud by ease of use, faster implementation and implementation cost savings.

Matt Flynn posted an entry on his blog on "Governance - Next era of Identity" that has some interesting points and information about Governance.  Another example of this trend is Oracle with their Sun acquisition and the decision to re-brand Sun Role Manager as Oracle Identity Analytics.

What about Cloud?  Oracle on their next release of the Oracle Identity Management suite 11g is creating a framework that will allow for service-oriented security or (SOS) to be consumed by application providers with greater ease.   Tim Brown from CA posted on the CA IAM blog about "Trust and the Cloud - Identities are critical"

This tells me that that Governance and Identity as a Service (either private or public in the cloud) are in the radar of all vendors and clients are the only ones that will drive that trend.

OASIS Identity in the Clouds

I just found out that a group of folks are putting together a Technical Committee named for Identity in the Clouds.  The main function of this Technical Committee will be "to collect and harmonize definitions, terminologies and vocabulary of Cloud Computing" as it relates to Digital Identities.

I did find it interesting though, that the following is out-of-scope for the TC: Access Control, Levels of Assurance (LOA) and Personally Identifiable Information (PII) in the context of cloud computing, because these have important relations to an Identity.  An Identity is not useful if it does not require "access" to a resource and risk cannot be quantified without "Level of Assurance".  If that was the case, Identities would not be needed.   Personal Identifiable Information is in the context of any Identity, and in some cases the only unique identifier of an Identity.  So, I would like to see more information on the reasoning behind deeming these out-of-scope.

Letting Users Manage Their Online Identities - Government 2.0

The GovInfoSecurity.com posted an interview with Heather West from the Center for Democracy and Technology.  Heather explained how User-Centric Identity works and the plans the government has to allow a few websites allow user's to authenticate/register with third-party data.

This is getting interesting since it can definitely be a driver for "Identity in the Cloud".  User-Centric Identity can be beneficial for end-user's who want to protect their privacy by demanding granular controls of their data from their Identity Providers (a great example is Facebook).  Facebook, although far from perfect when it comes to privacy, has changed their privacy methods and protections based on end-user demands and market drivers (for better or worse).  Now, I am not saying Social Networks are the only option for Identity Providers, but Facebook is a good example since it holds the largest number of personal identifiable identities.

I am going to try to keep up with "Government 2.0" (Open Government) and how it affects Identity,  I think this will drive Identity Management in the next decade.

Open Trust Framework for Open Government

I was reading the Open Trust Framework for Open Government pdf released by ICF and my first thought was "why do we want government involved on this", but as I read the document it made perfect sense. And I actually agree with the concept.  Basically, the Government realizes that they don't necessarily have the best "identity data" available to satisfy industry and an "open" framework with an open market methodology satisfies their needs as a Relying Party (RP) of identities.

So, the government is not necessarily creating policy for an Identity Trust Framework, but an initial driver and our tax dollars better used... (I know, I am trying to convince myself...)

The best part is that if the government is an RP others will follow.

The other interesting fact I was not aware of, is the work of InCommon as a Trust Framework used by Higher Education mainly for federated single sign-on (not necessarily fully in the "Cloud").  This is definitely a good example (as it is stated in the document) of an "Open Identity Trust Framework."

Open Identity Trust Framework (IIW)

I think I am going to forget about "Identity Trust Network"  I like the title and work behind "Open Identity Trust Framework" being done by the folks at IdCommons at Internet Identity Workshop.  This work seems to be at a very early stage, but it is important that an open standard/framework for trust be available for the certification of identities in the cloud being provided by Identity Providers.

The concern with not having such framework would be some sort of National ID that is fully controlled by a single organization (such as the Federal Government) or some group of high profile companies.

The ideal scenario would be the use of a framework where organizations that are Identity Providers can be judged and rated on how "trusted" the services they provide are (since they certify the trust of the identities they manage).

Identity Trust Network

Identities in "the Cloud" have taken and interesting form.  When I think of my Identity on the web today, I attempt to expose data that I think will be of benefit to me (either true or not), so my Identity cannot be trusted by someone who does not really know me.  Now, when you think of my Identity you take in consideration information I provided and information others provide (true or not).  Therefore, trust is key for you and I to be able to perform a transaction.

Here is a term I have been thinking about: “Identity Trust Network”, where Identity Providers attest the claims of an Identity and allow the consumption of trusted identity data based on the Identity owner allowed usage.

This term came to mind when thinking about Identity in the Cloud and its meaning.  The following was my train of thought:

- For Identity to exist in the Cloud, it requires a provider of this data.
- Identity data represents an individual (Identity Owner).
- This individual has provided their identity data to the provider.
- The provider must attest that the identity data is trusted.
- The trusted identity data will be consumed by a third party based on the owner's allowed usage (privacy)
- Identity Owner and third-party perform a transaction

Cloud Provisioning Services using Oracle Identity Manager

I just found out that during Oracle Open World, EDS (now HP) plans to offer (or is offering already) Provisioning Services over the cloud using Oracle Identity Manager. I think it is a great idea, but I would like to see the implementation. The session at Oracle Open World was named "EDS Automates Infrastructure Outsourcing Provisioning Processes with Oracle Identity Manager"