[Log In] []

Exploring the science and magic of Identity and Access Management
Saturday, July 13, 2024

Identity Enables NHIN or Health Internet

Author: Mark Dixon
Thursday, December 10, 2009
1:47 pm

Jonathan Gershater recently published an interesting blog post exploring the conceptual differences between the National Health Information Network (NHIN) infrastructure, “a collection of standards, protocols, legal agreements, specifications, and services that enables the secure exchange of health information over the internet,” and an alternate approach known as the Health Internet, “an open-market standards-based approach to enable the exchange and sharing of electronic health data, using existing Internet standard protocols and web technologies.”

Jonathan referenced two informative posts on The Health Care Blog and Practice Fusion’s blog.  I’m still trying to wrap my mind around the significance of these two architectural directions, but it certainly appears that Identity is a critical part of the solution, regardless of what alternative approach or derivatives thereof may emerge.  Any Electronic Health Record (EHR) system must be based upon secure, flexible and scalable Identity Management system.

Thank, Jonathan, for the excellent reference.

Comments Off on Identity Enables NHIN or Health Internet . Permalink . Trackback URL

Trufina: Tackling the Tough Issue of Identity Assurance

Author: Mark Dixon
Thursday, December 10, 2009
1:18 pm

trufina Last week I had a stimulating conversation with Jim Kinchley and Chris Madsen, executives of Trufina, a “provider of online identity verification and identity management services, enabling individuals to verify their identity attributes online, and providing the identity management tools for sharing that verified identity information with individuals and websites across the Internet.”

In October, I posted an article entitled Identity Trend 4: Identity Assurance, one of a series of posts about important trends in the Identity Management industry. In that post I proposed, “With the continual expansion of online fraud and other threats to online security and privacy, the need for Identity Assurance methods are rising.  Being able to certify the that the correct Identity credentials are issue to the correct user before access is attempted is an increasingly critical issue.”

A few days after I authored that post, I became aware of Trufina, signed up for an account, paid a small fee, and had my Identity verified through a series of online questions drawn from publicly available information about me that presumably only I would know.  As evidence of that successful vetting process, I posted a Trufina badge on this blog (see right column).  This badge visually represents that my identity had been verified by Trufina, and provides a way that blog visitors could request a Trufina ID Card with details I elect to share.  Do you want to see how it works?  Please click on the Trufina badge or click here, enter your email address, and I’ll send you a link to see my Trufina-verified Identity Card.

Trufina provides a public API to allow websites to take advantage of Trufina identity validation services.  For example, the Naymz online Professional Reputation Network allows members to link their Trufina Verified ID to the Naymz profile.  In such a case, the Trufina Verified ID badge is shown on the Naymz member profile.  I don’t use the Naymz network as extensively as LinkedIn or Facebook, but neither of those more popular social networks have validated my Identity as well as Naymz has done, thanks to the Trufina process.

I look forward to seeing how Trufina progresses in the marketplace.  We really need a critical mass of easily accessible, yet secure, Identity validation services to increase the level of trust and confidence in online relationships.


Video: Identity Management – Pathway to Enterprise Agility

Author: Mark Dixon
Wednesday, November 25, 2009
10:52 am

After the CIO Frankly Speaking Breakfast event in Toronto on November 17th, Michelle Dennedy and I fielded questions about Identity Management from John Pickett of IT World Canada on camera.  A short video emerging from that interview was published on the IT World Canada website today.


I couldn’t figure out how to embed the video on this blog post, but clicking on the image will take to you to the IT World Canada website where you can view the video.


IAM is a Journey, not a Project

Author: Mark Dixon
Tuesday, November 24, 2009
5:26 am

In our recent CIO Roundtable tour, a question about Identity and Access Management that emerged in every session was, “where do I go from here?”  It is one thing to talk about the theory of IAM; it is quite another thing to actually implement it in your enterprise.

My advice to the Roundtable participants and to you is this, “IAM is a journey, not a short-term event. Enterprises must begin to approach compliance as a long-term program, not a single project.  Take stock of where you are now, set objectives for where you want to be in the future, and execute your strategy in stages.”

To illustrate this process, the white paper I recently wrote, Identity and Access Management: Enabling HIPAA/HITECH Compliance, proposes thirteen best practices for approaching the application of IAM to HIPAA/HITEC compliance efforts.  Recognizing that IAM is a journey, not a project, is one of the best practices.

Think program, not project. HIPAA/HITECH compliance is a journey, not a short-term event. Enterprises must begin to approach compliance as a long-term program, not a single project. An effective and holistic compliance program should also incorporate governance and risk management. Boards of directors and executives are frequently being held to higher standards than ever before as they are expected to be knowledgeable about, and held liable for, everything going on within the enterprise.


The step-by-step process depicted above doesn’t fit everyone.  It only serves to illustrate the need to for defining your IAM journey as a series of phases subdivided into measureable steps.  Our experience has shown that those enterprises who follow this basic process usually succeed, while those who attempt to do much all at once, or focus on one small tactical project, often fail to realize the benefits of a well-executed IAM strategy.

Happy trails!  (I couldn’t resist that last comment, even though the “happy trails” comment in my previous post dealt with airline travel, not IAM journeys.)

Comments Off on IAM is a Journey, not a Project . Permalink . Trackback URL

Lax Identity Enforcement with TSA. Really?

Author: Mark Dixon
Tuesday, November 24, 2009
1:48 am

I read a disturbing article by Dan Schwab of Fox Chicago News this morning entitled “Probe: ID rules lax at Chicago airports.” Perhaps the fact that I will board my 13th flight segment in two and a half weeks this afternoon fueled my interest in the article, which reported “a Fox Chicago News investigation discovered a major loophole at TSA checkpoints at O’Hare and Midway.”

During the past two months, Fox flew multiple employees – male, female, black, white, and Muslim – to different destinations around the country on different airlines.

The only requirement: They were not allowed to bring a photo ID. No passport. No driver’s license.

On every occasion, these Fox employees were allowed through security without a hitch as long as they showed that the name on their boarding pass matched the name on a couple of credit cards, according to Fox Chicago News.

Credit cards for identification?  What happened to the requirement of a photo ID?  This shows a remarkable lack of TSA compliance with recommended policy:

The federal Sept. 11 Commission’s final report included 10 pages that focused solely on the issue of terrorism and identity fraud. The report states: “Travel documents are as important as weapons. Fraud is no longer just a problem of theft. At many entry points to vulnerable facilities, including gates for boarding aircraft, sources of identification are the last opportunity to ensure that people are who they say they are.” …

By checking credit cards rather than a photo ID, TSA simply was following its own rules, which vaguely state that passengers without an acceptable ID will have to provide “information” to verify their identity, according to Fox Chicago News.

I’m not a big fan of the TSA.  To me, it is at best a huge, bumbling bureaucracy, and at worst, a huge, oppressive police force.  I really don’t feel safer because of them.  However, regardless of my feelings, this is a clear example about how poorly executed identity policy can lead to easily exploited security breaches, even as a false aura of safety is provided for the law-abiding majority, who obediently shed shoes and jackets, empty pockets and briefcases, and subject themselves to humiliating searches while many obvious loopholes remain.

Just one example … next time you go through the TSA screening process, notice how closely (or not) airport employees’ ID badges are examined. 

Happy trails!

PS.  The Dave Granlund cartoon reminds me of the time I brought exercise weights with me on a trip.  My luggage was manually searched every time – on each of four flight segments that week.  I now keep those dastardly weights safely at home with my horribly dangerous one-inch pocket knife.  Bitter?  Nah!

Technorati Tags: , , , ,

Dilbert on Cloud Computing

Author: Mark Dixon
Friday, November 20, 2009
2:04 am

With all that is being said about cloud computing nowadays, perhaps we should pause and listed to what Dilbert has to say on the subject

… as he receives the assignment …

… and starts the project.


Technorati Tags: , ,

Telcos and “On Demand” Computing

Author: Mark Dixon
Wednesday, November 18, 2009
3:27 am

Ten years ago, while employed by Oracle, I worked on a project where we tried to convince the large North American telcos to act as Application Service Providers (ASP) and host Oracle applications for their customers.  We proposed that the combination of existing telco data centers, network connectivity, business customer base and billing infrastructure provided an ideal foundation for such services.  At that time, we didn’t get much traction with the telcos, but Oracle went ahead and launched their own ASP service, now known as "Oracle On Demand.”

Now, as Sun awaits acquisition by Oracle, it is interesting to see telco participation in what we now term “Cloud Computing.”  On Monday, AT&T announced “Synaptic Compute as a Service(SM), its latest innovative global cloud-based service, designed to give companies of all sizes simple on-demand access to scalable computing capacity.”  Ironically, the press release was entitled, “AT&T Unveils Network-Based ‘On Demand’ Computing for Companies of All Sizes.”  I’m not sure what Oracle might think of AT&T’s use of the “On Demand” term.

AT&T is working closely with Sun to use the Sun Cloud Open Cloud Platform, Sun Cloud APIs, cloud reference architecture and design expertise to create an environment to make it easy for developers to build and deploy value-added services.

"Sun is committed to helping our customers and partners deliver public and private clouds that are cost effective, open and interoperable," said Dave Douglas, senior vice president, Cloud Computing, Sun Microsystems. "AT&T’s network and operational excellence coupled with Sun’s Open Cloud Platform and Sun Cloud APIs delivers a revolutionary cloud offering. We’re excited to be working with AT&T to bring an enterprise-class, highly scalable offering that delivers choice and flexibility to market."

The trend towards cloud computing marches on.  I think we will see more telco participation in this market. We have long accepted utility telephony services from telecom operators.  Offering computing utility services is a logical next step.


Identity and Access Management – Enabling HIPAA/HITECH Compliance

Author: Mark Dixon
Wednesday, November 18, 2009
2:52 am

hipaa The white paper I mentioned several days ago, Identity and Access Management – Enabling HIPAA/HITECH Compliance, is now hot off the press and ready for download.  Thanks to all the great people at Sun Microsystems that contributed to this project and made it a reality.  Hopefully, the paper will be beneficial to those who are facing the challenges of how to comply with the increasing regulations surrounding management of healthcare data and information systems.

The paper’s abstract reads:

As healthcare organizations and vendors become more reliant on digital information technology, complying with increasing regulatory requirements presents a range of challenges. This paper explores the requirements that these organizations face, best practices for implementing identity management systems that help ensure compliance, and how Sun’s pragmatic approach to identity management simplifies the technology environment.

The table of contents:

  1. Executive Summary
  2. Healthcare Information Technology Challenges
  3. Health Insurance Portability and Accountability Act (HIPAA)
  4. Health Information Technology for Economic and Clinical Health Act (HITECH)
  5. Impact of HIPAA, HITECH and Related Regulations
  6. The Role of IAM in HIPAA/HITECH Compliance
  7. Sun IAM Product Introduction
  8. Best Practices for the IAM/Compliance Journey
  9. How to Get Started with HIPAA/HITECH and IAM
  10. The Sun IAM Workshop
  11. References

Please let me know if you have any questions or would like to discuss the content in more detail.

Comments Off on Identity and Access Management – Enabling HIPAA/HITECH Compliance . Permalink . Trackback URL

Count your Technological Blessings

Author: Mark Dixon
Wednesday, November 18, 2009
2:29 am

Whenever you are feeling deprived,  consider the technological advantages we enjoy today and count your many blessings!

Thanks to the Lighter Side of Technology page on ITWorldCanada.com for this gem.

Technorati Tags: ,
Comments Off on Count your Technological Blessings . Permalink . Trackback URL

Frankly Speaking: Identity Management

Author: Mark Dixon
Wednesday, November 18, 2009
2:19 am

It was nice to see a short piece covering the CIO Frankly Speaking Breakfast event in Toronto yesterday, where Michelle Dennedy and I fielded questions about Identity Management and Cloud Computing from John Pickett of IT World Canada.  I particularly liked the statement made by Michelle, “Identities are now being realized as the true assets for the organization.”

Comments Off on Frankly Speaking: Identity Management . Permalink . Trackback URL
Copyright © 2005-2016, Mark G. Dixon. All Rights Reserved.
Powered by WordPress.