Federation v ESSO

It's well understood that achieving single-sign on in the enterprise is an admirable target. The complexities of rolling out such an infrastructure may mean that integrating all enterprise applications with a common security infrastructure will take some time (if it is even possible).

But what happens when single-sign on to a third party is a target?

Readers will already be aware that I am a fan of the concept of security federation but how many organisations have federation-aware applications? Over the last 2 years I have been met with a consistent answer to this question when broaching the subject of federation with third-parties. None!

Maybe we have just been unlucky with the third-parties we have been dealing with but I suspect the real answer to the question is still pretty close to "none".

So, do we force these third-parties to migrate to a federated security approach or do we just accept that our employees will have to have a separate UserId/Password for the third-party site/application? Or is there another way?

Well, I'm quite sure with just a little bit of effort we could provide a mechanism to automate the sign-on process on behalf of the employee. I'm quite sure that with a bit more effort, we could automate the process of changing passwords upon password expiry. I'm also reasonably confident that with (considerably) more effort, we could automate the provisioning process. And everyone is happy once more... until the third-party changes the various screens used for each of these functions.

You see, it would seem that most of these third-parties haven't even exposed an API catering for these functions.

However, the idea of scripting the logon process seems like a reasonable stop-gap until full federation is achievable and this is the focus of applications like Passlogix's V-GO suite (available at http://www.passlogix.com/). Indeed, this little application seems to tick so many boxes that the guys at Passlogix have struck deals to allow some of the big boys in enterprise computing to sell the software in rebranded form: IBM Tivoli and Oracle to name just two.

Are there any downsides?

• It is a client application that needs to be deployed onto the desktops/laptops within the organisation
• It is a Windows only application
• It doesn't seem to support Firefox

The upsides, of course, are that is should be a relatively quick and easy approach to achieving SSO with a third-party. I can't help thinking that an amalgamation of Password Safe and Auto-It could achieve the same thing.

• http://passwordsafe.sourceforge.net/
• http://www.hiddensoft.com/autoit3/

So, do I feel compelled to develop a freeware alternative to Passlogix's offering? No, I'm afraid not despite the fact it would be an interesting exercise. The additional features of V-GO would sway me towards buying the off-the-shelf package (although I have no idea how much it costs!)

And what about our federated security solution? Unfortunately, we are faced with a tricky situation. This type of solution requires both parties within the federation to have security federation aware systems. Deploying such systems is a "leap of faith" - faith that others will follow suit. Within my experience, none of our third-parties are ready to take that leap... yet!

Identity & Behaviour

I spend my working day devising ways of consolidating people's identities in order to help them minimise the number of UserIDs/Passwords they have to remember and in order to help them portray a consistent online "persona".

I have to admit that I have assumed that this is what people want. But is it?

It would seem that the younger generation are more fickle than that. The BBC, in a recent "bill board" article (available at http://news.bbc.co.uk/1/hi/technology/6234663.stm), reported that research in the US suggests that teenagers are happy to ditch their UserIDs or eMail Addresses in favour of new ones on a quite random basis.

Indeed, it would also seem that they are quite keen on having multiple identities portraying very different personalities. This, I can understand. After all, I have my "Identity Management Consultant" persona online in the form of this blog but I also have my "Sporting Athlete" persona online in the form of my hockey club website (available at http://www.eastantrim.co.uk/). I am very much the same person but the personality I portray through each is very different.

I can also understand that teenagers don't know who they are and will constantly change their online identity until they find an identity that they feel comfortable with. Maybe I have aged sufficiently to either be happy with my current identity or just too busy to attempt to alter it.

I will readily admit to having had the same email address and the same phone number for as long as I can remember. The kids at my hockey club seem to change both quite regularly.

So, maybe the world of Identity Management has a new challenge. Maybe there are users who would be horrified at the thought of only having a single identity? Thankfully for those users, Identity Management is still struggling to gain momentum within the enterprise world. The world where multiple identities are common place (and where those users live) is a social world within which Identity Management is not yet welcome. Does anyone remember Microsoft Passport?

Identity Theft

It's New Year's Eve (or Old Year's Night as we like to call it) and yet my thoughts are focussed on Identity Fraud/Theft. Why?

Yesterday, a credit card statement turned up - post Christmas credit card statements are grim! Stuffed into the envelope was a leaflet informing me of the growing problem of identity theft. Of course there were the usual helpful tips on keeping your identity safe: shred your statements & use different passwords for each of the websites you visit. It was a gripping read.

But I also got a letter addressed to my 2 year old daughter from another financial institution advising her that Identity Theft was on the rise. It too had similar hints and tips for Identity Theft prevention.

The two institutions that sent these leaflets were purpoting to be eager to help my daughter and I the combat against Identity Theft. Of course, this assistance would be provided for a small monthly charge - what cost your identity after all. I must admit, though, that I struggled to see what these companies were actually doing for the money that they were demanding.

Of course, these companies are relying on our fears and perpetuating the notion that the world is a dangerous place. Of course it is... but one of the safest places to be is in an electronic world. I feel quite safe purchasing goods with a credit card via the wonder of the internet with reputable suppliers. I feel quite safe looking after my financial affairs online. And I still believe that if someone is going to steal my identity, they won't necessarily do it online - they will do it the old-fashioned way.

"The old-fashioned way?" I hear some of you say, "surely identity theft is a new phenomonen?"

Of course it isn't and the online world hasn't made it that much easier really. Those that fall foul of phishing attacks are likely to be the same people that fall foul of more traditional cons. (To understand the traditional cons, "The Real Hustle" on the BBC is a very good series showing how it is done).

So will I be parting with my hard earned cash in order to protect my identity? Nope... I'll look after my identity myself by being vigilant.

Happy New Year....

Time for Fun!

It's the last working day before Christmas and therefore the time to ensure that everything is in order for the holiday period.

More importantly, it's time for some "resting" and fun.

My friends and I had great fun this morning discussing the results of the Hobbit Name Generator which can be found at http://www.chriswetherell.com/hobbit/ - it is well worth a 5 minute visit.

My Hobbit name is "Mungo Loamsdown of Deephallow" with which I'm quite pleased. We were also particularly impressed with "Minto Hamwich of Buckleberry Fern".

We all have a name yet we are known by various names & identities depending on who is addressing us. I respond to the following:

• Stephen (and sometimes Steve)
• Sir
• Son
• Daddy
• Mr. Swann
• Oi You
• (and now Mungo Loamsdown)

Nothing particularly unique in much of that unfortunately. When it comes to accessing systems (whether they be web based or not), the combination of identities that I have is even greater. I like to think I know who I am but it is a sorry state of affairs when you not only have to commit your passwords to some medium other than your brain, but you also have to have a serious think about recording (and transporting) your "name" in a similar manner.

• At my bank, I am a number.
• On my blog, I am an email address.
• At work, I am a combination of letters and numerals.
• On my web based training site, I am a nickname.

Will there ever be a time when I can be considered truly unique and known by all as a single name?

Nah... I'll always be either a son, daddy or husband. But there must be a chance that the number of identities I own can be reduced significantly. The utopian world which includes an Identity Provider as a service which can be utilised by all these various systems sounds great (if a little dangerous if it were ever compromised). The world of security federation is just around the corner and I for one can't wait - my brain is stuffed to capacity with UserIDs and Passwords!

In the meantime, I might just change all my UserIDs to "Mungo Loamsdown" :-)

Merry Christmas everyone...

My Poor Wallet

I have a Samsonite wallet that I bought at Heathrow a few years ago. Upon opening it today, however, I noticed that it was torn and will need replaced - which sounds like a good Christmas present if ever there was one.

The problem, as I see it, is that the wallet is stuffed full of cards and has been under considerable straing for far too long:

• 4 credit cards
• 2 debit cards
• 3 hotel loyalty cards
• 2 air operator loyalty cards
• 6 store loyalty cards

Note: For some reason I have Sterling, Dollars and Euros in there as well just now.

Almost all of these cards have a chip on them - I'm guessing a lot of them are only single-function chips, unfortunately. I say unfortunately because if I could in someway amalgamate the functions of these cards, then I wouldn't be in the position of having to replace my wallet!

Why can't we live in a world whereby I have a single card which has a chip capable of:

• identifying myself for cash withdrawal
• recording my spending habits (and thus accumulate cashback points from my various "suppliers")
• identifying myself when gaining access to airport lounges

The reason why I can't have this? The world of Federated Security is too immature and no one company seems to want to take the leap of faith required to change our lives.

An identity provider/service provider model would certainly ease the strain on my poor wallet. In the meantime, I will have to continue carrying the lorryload of cards I need to go about my daily business.

Practical RFID

I remember proposing to the Chief Architect at my company that we should be looking into how RFID might help our sales teams in our branch network.

How so?

Well... Picture the scene. A customer goes to their Bank's branch to lodge a cheque. While standing in the queue, they lift a brochure detailing the benefits of taking out an insurance policy or investing in the latest "fund".

If the brochure is tagged using the latest RFID technology, when the customer finally arrives at the teller position, the teller will now be armed with some vital information: the customer's details and their interest in other products. What a powerful position to be in! The teller could either log the information (or it could be logged automatically) or the teller could broach the subject of the product in question with the customer.

At the time, the Chief Architect was very interested although I'm not sure he was convinced that the technology would actually work. In short... it was not a visionary at all.

And therein lies the question. Is the role of IT within the enterprise solely to deliver on business requirements or is it there to help define opportunities for the business. Personally, I believe the guys in IT wouldn't be doing their job properly if they weren't spending some of their time investigating new opportunites. Unfortunately, the Cost Centre approach to enterprises doesn't really allow for this type of research.

Does anybody remember the days when we used to be called "Research & Development"? (Google employees need not answer that question - I'm really quite jealous of you!)

A Difficult Year

I can't believe it has been a year since I last posted!

The year has been a tremendously difficult one with many low points. The main low was the realisation that major technical decisions within organisations are rarely made by people who actually understand technology. Why didn't I previously understand this? Naiviety?

It would seem that the decision making process is typically a process which is based on the following:

• Political manouevring
• Self-interest
• Self-promotion
• Self-interest
• and Self-interest

I know there is duplication in that list...

So can people really make a difference in an enterprise? Of course they can, but only if they are prepared to play the game. There's little point in complaining about the decision making process - no amount of complaining is going to change anything! Instead, working from within the system is likely to reap greater rewards.

Unfortunately, it can be seen how the destructive decision making process described above becomes self-perpetuating - it's the only way to get things done!

Of course... I'm not necessarily talking about my own organisation!

On a positive note... I did manage to pass an exam recently which allows me to display the following image: