The second Identity Management session in the Burton Group Catalyst Conference was led by Lori Rowland, Senior Analyst, Burton Group Identity and Privacy Strategies. Lori offered leading remarks, followed by remarks by other members of the Identity and Privacy Strategy team:

Lori Rowland: Identity Management Overview

• The Identity universe is expanding in three dimensions:
• Scale – expanding downward from large enterprises to small and medium business and upward to Internet scale
• Control – expanding from central control by enterprise administrators beyond traditional enterprise boundaries
• Focus – expanding from protecting businesses to protect the rights of people (e.g. employees, customers)
• Although compliance is still main driver, there is a shift toward risk management
• We need to move toward Relationship Model
• The industry is moving toward a services based model. “Identity as a Service” is a trademark held by Fischer International. Burton has encouraged Fischer to “give back” the “Identity as a Service” term to the industry.
• Customers should seek to really understand vendor roadmaps.
• The vendor with most momentum in the market is Oracle because of aggressive acquisition. Other vendors with market momentum are Sun, CA and Novell. Others are stagnant or retreating.
• What will happen if Google tries to enter the Identity market offering Identity as a Service (sorry Fischer)?

Gary Goebel: Federation and Distributed Control

• Product advancements in federation include Sun’s Fedlet and Ping’s Autoconnect.
• We should think of federation in business terms. Technology is just a building block.
• OpenSSO is an example of open source federation advancement.
• Federation services and hosted models such as offered by FuGen and others will help accelerate broader consumption.

Gerry Goebel: Entitlement Management

• IBM, Oracle, and Cisco have expanded entitlement management functionality through acquistion, but demand hasn’t grown as much
• A recent meeting hosted by Concordia entitlement management brought up many questions, including
• Is XACML protocol adequate?
• Are other standards needed?
• What performance is required?
• When will a conformance program be offered?
• Who will provide interoperability testing?
• Could Liberty Alliance help with standard way to test?

Mark Diodati: Authentication

• Although the authentication field is very broad, some things missing, including general customization flexibility and strong provisioning capabilities.
• Privileged account management is not owned by anyone and often falls through the crack. We need new products in this area.
• Personal and portable security devices are emerging, including USB devices that couple smart card and flash memory technology, and consumer tokens in the form of wallet cards.

Kevin Kampman: Roles and Provisioning

• The provisioning market is reaching maturity. Many projects have gone through multiple iterations. Success predominates – primarily as a result of realistic expectations.
• Role Management advancements through acquistion include Oracle + Bridgestream and Sun + Vaau
• Role discovery is improving. For example, Oracle is combing data warehouse analytics with Bridgestream discovery capability.
• Provisioning and roles may not converge into a single product. These are parallel, complementary endeavors.
• In the provisioning market, IBM, Sun and Oracle lead. The European market is different than the US market. Microsoft Identity Life Cycle Management may be dark horse.

Kevin Kampman: Identity 2.0

• Although the Identity 2.0 market is maturing very rapidly, technologies like OpenID and InfoCard have more Identity Providers than consumers.
• Trust hierarchies are needed.
• How will industry pay for identity? What is the business model?

Technorati Tags: Identity,
Digital Identity,
Identity Management,
BurtonGroupCatalyst08