Processes of Identity and Access Management

Three new wonderfull blogs about Identity Management were announced a few weeks ago by the (in meantime) very popluar analysts Martin Kuppinger, Tim Cole and Jörg Resch.
Visit the blogs (and come back to this blog) under http://blogs.kuppingercole.de/

The strategic questions related to Identity Management are frequently repeated in every new project. Enough reason for me to write an article (in German) which gives answers to those people, who have to think in strategic dimensions (mostly CIOs).

1. When do we need Identity Management?
2. Which risks do we have today?
3. How mature are the others?
4. Why couldn´t we wait to the time we urgently need it?
5. What is different in IAM-projects?
6. What are the most common mistakes in IAM-projects?
7. Which objectives could we support ?
8. What is the most cost effectiv way for a solution?
9. Who supports the CIO?
10. What doubleSlash can do?

By the way: Corbin H. Links wrote a great post about the "Strategic System Idealism and Legacy Reality".

On the joint conference (http://www.eema.org/static/eema2007/program.htm) of the enisa (http://www.enisa.europa.eu/) and the eema (http://www.eema.org/) I not only had the chance to present our initiative GenericIAM (2007-06-13_GenericIAM_Presentation(1.0).ppt) but also to attend several workshops and round tables on selected topics from the information security field.

Although attending several conferences and less spectacular event, I seldom came across with expert communities with a comparable high level of expertise. Many of them represent a long record of intensive work on the very forefront of secure electronic communication.

They take their job serious and try to come up with good results, no, with even excellent results. And perhaps that’s the fault. Why? Well excellent sounds like near 100%. And everybody dealing with security knows, that 100% means it can’t be done as long as humans are involved – at least those still alive.

A discussion for example on the electronic identity cards revealed the full colourful picture of European differences and peculiarities – as expected. I further expected that following the very European principle of subsidiarity these local solutions would be mutually accepted. As Dr. Ingo Neumann from the German BSI (http://www.bsi.de/) pointed out: In the physical world we do have valid and mutually accepted documents – passports and national Id-cards. Why can’t we transfer this principle of mutual trust to the electronic world? In addition Anthony Whitehead from NordicEdge (http://www.nordicedge.se/) a British citizen living in Sweden demonstrated how easy this can be - by presenting his Swedish driving licence, Swedish id card, credit cards and more. The Swedish authorities simply trusted his British passport.

Instead a long discussion raged on the unification of the different levels of trustworthiness of the national enrolment processes for identity documents. Obviously this can’t be successful – at least on short timeframes. Why can’t work out in the e-world, what we practise in the physical world? Because we here traditionally and intuitively take a risk based, a risk balanced approach. Live is risky and will stay risky – at least as long as it lasts. (Afterwards the situation improves quite a bit!)

But there was an example demonstrating nearly the opposite danger: Not always it might be a good idea to transfer physical objects to the e-world unchanged. As a special indication Ulrike Linde from the Association of German Banks (http://www.germanbanks.org/) mentioned, that according to German data protection law the date of birth must not be on the Germen eID-card. But as banks require it, you would not be able to open a bank account with an eID-card, whereas by means of its paper equivalent you can. According to Kim Camerons Laws of Identity (who by the way showed up at the same conference as well, http://www.identityblog.com/) banks shouldn’t be interested in our age anyway – just in the information, that I’m over 18 years old. But that’s another story.

Another question may have even more impact. Why should this information on an eID-card anyway? Ok, I understand that in the physical world, there was no other chance to deliver this information in a comparable trustworthy way.

But in the e-world? Wim Coulier from the Belgium Certipost (http://www.certipost.be/en/homepage.php3) gave a good example in his short presentation: an electronic Identity reduced to its identifying nature without any additional attributes. Whenever these attributes are requested, e.g. for opening up a bank account, the attribute provider can decide to deliver it to the requester, a principle well known in the movement of the user centric Identity. Here the user decides if it is worth disclose the information – well, who else?

So the question arises: How much information should an identity carry? Not too much, I would say. It could otherwise unnecessarily disclose information. It could conflict with national data protection law. It could become difficult to agree on the appropriate set of information resulting in turn in an unnecessary high need for identity federation and so on.

Following Occams razor (http://en.wikipedia.org/wiki/Occam’s_Razor) and taking it to the limits, the eIdentity should be reduced to its bare identifying nature.

Every answer just raises the next question: What should this natural set of identifying data be like? “Excellent” question the hard nosed sales man would reply. But there is a natural unique set of data: Remember when you were baptised or just given your name. It was done with the idea in mind to be able to uniquely identity and address you. The name should be your and unique in the personal context.

This context is the key of course. It is made of time and location: during the moment of birth in your local context. So, the natural GUID is composed of name & time and the regional context (City, town, village, …). Ok, I understand. It is not that easy: the idea might be compelling. But fixing the local context is the weak point as it doesn’t map with the local birth registration office – at least in many cases.

But back to the minimal identifying data set: I once wrote, that there is a mismatch of the natural perception of the word “identity” which is indicating the sameness of two things and the use of the term “digital identity”. Perhaps this is the reason why Kim Cameron interdicted the use of the term “identity” internally in his team. It only causes confusion.

In the natural perception a human can only have one identity everything else is schizophrenia. Whereas in de digital world – there is a broad consensus - we can have several “digital identities”. But the relaxed view on having multiple identities is in danger. Biometrics has the potential to damage this consensus as it will uncover doublettes – even if they are considered as tolerable.

It will push for the use of a GUID instead of just an ID. But in this case the Identity must not carry any additional attributes besides the pure identifying information itself.

A lightweight Identity.

A few days ago i spoke to SAP people about the position of SAP with regard to the still growing IAM-market. At the end of the speaking i believed that SAP never followed a strategy with achieving growth due to acquesitions or mergers - Like it did the big competitor Oracle in the past years (The nutritional value of IAM-companies).
So it is for me still a secret which goals SAP is focussing on with acquisitions like MaxWare, Wicom Communications or others.

Matt Flynn guesses in his blogpost that MaXware’s products will compliment SAP’s core product architecture. That is the most obvious position. But i am sure that SAP´s hunger is not satisfied yet. See Pressrelease from SAP: SAP Extends Identity Management Capabilities in SAP NetWeaver with Acquisition of MaXware