Thanks to the Marketoonist for the insightful drawing!
Author: Mark Dixon
Friday, September 4, 2015
I was recently introduced to a powerful new tool created by the folks at Persistent Systems, a long time Oracle development and systems integrator partner. The Oracle Identity and Access Management platform has a very rich set of Java APIs that enable developers to access nearly all of the functionality this platform from external applications. The challenge is not completeness, but complexity. To take advantage of this rich API set, external developers have to know much about the internal workings of the IAM products and the intricacies of writing the Java code to access the APIs.
The Persistent Systems engineers have developed a REST API on top of the Oracle Identity Governance Java API that exposes OIG capabilities in a much simpler, more “process friendly” way. For example, a few services available are:
- User Access Request
- Get User’s Provisioned Roles
- Acting on Pending Authorizations
- Authenticate User
- Authorize User
… and the list goes on.
How would you like to translate those “business level” requests into Java API calls?
To demonstrate the capability of the REST API, a developer at Persistent Systems created the application shown in the image below, with a clean, easy-to use interface for OIG approvals and certifications – all without being an expert in Java or the detailed processes within OIG. The iPhone and Apple watch images include screen shots from my phone and watch. It really does work!
The most important thing to consider is not the neat user interface – although it has some cool features – it is how an intelligently constructed REST API can provide development agility, application flexibility and rapid deployment, all essential enablers for digital transformation.
Leonardo Da Vinci has been credited with the wise statement, “Simplicity is the ultimate sophistication.” I think Leonardo would like this approach.
Sixty two years ago today, as I was commencing my junior year in high school, the first Automated Teller Machine, called the “Docuteller,” began dispensing cash at Chemical Bank in Rockville Centre, New York. According to a Wired article,
It marked the first time reusable, magnetically coded cards were used to withdraw cash.
Nowadays, ATMs are ubiquitous. Mag stripe cards are widely used for identification at ATMs and in many other applications. EMV chip-and-PIN cards are becoming more broadly used in the US, although they have been used widely in Europe for many years.
Wide proliferation of ATMs dramatically changed the consumer banking industry. I suppose that mobile banking apps and mobile payments are now changing banking as dramatically as ATMs did over the past sixty years!
By the way, the Chemical Bank ATM was not the first ATM in the world. The British beat the US by a couple of years, albeit without the mag stripe plastic ATM card. According to Wikipedia,
It is widely accepted that the first ATM was put into use by Barclays Bank in its Enfield Town branch in north London, United Kingdom, on 27 June 1967. This machine was inaugurated by English comedy actor Reg Varney This instance of the invention is credited to John Shepherd-Barron of printing firm De La Rue, who was awarded an OBE in the 2005 New Year Honours. This design used paper cheques issued by a teller or cashier, marked with carbon-14 for machine readability and security, which in a latter model were matched with a personal identification number (PIN).
We have come a long way!
Do you ever wonder why in the world you receive the ads you do on Facebook or other online venues? Methinks personalized, targeted advertising still has a long way to go.
It is quite amazing to me how many customers I visit who are really struggling with how to handle mobile devices, data and applications securely. This week, the following cartoon came across my desk. the funny thing to me is that the cartoon was published in 2011. Here is is 2015 and we still struggle!
Martin Kuppinger, founder and Principal Analyst at KuppingerCole recently spoke in his keynote presentation at the European Identity & Cloud Conference about how IT has to transform and how Information Security can become a business enabler for the Digital Transformation of Business.
He presented eight “Fundamentals for Digital Risk Mitigation”
- Digital Transformation affects every organization
- Digital Transformation is here to stay
- Digital Transformation is more than just Internet of Things (IoT)
- Digital Transformation mandates Organizational Change
- Everything & Everyone becomes connected
- Security and Safety is not a dichotomy
- Security is a risk and an opportunity
- Identity is the glue and access control is what companies need
I particularly like his statements about security being both risk and opportunity and that “Identity is the glue” that holds things together.
Wish I could have been there to hear it in person.
Author: Mark Dixon
Monday, May 4, 2015
Recently I heard a executive who had been newly hired by a company describe their current Identity and Access Management System as an “Opportunity Rich Environment”. Somehow that sounds better than “highly manual, disjointed, insecure and error-prone,” doesn’t it?
I have been using the TSA PreCheck service since soon after its inception in 2011, without paying an enrollment fee, after being invited by US Airways to participate. This has allowed me to use the simpler and faster TSA PreCheck lane at airport security, rather than joining the majority of fliers in regular security lines. However a couple of weeks ago, I received a notice from American Airlines, which is merging with US Airways, that I now needed to register for a “Known Traveler Number” (KTN) so I can continue to use the PreCheck service. I don’t really know why my gratis status is no longer acceptable, but it apparently it is.
So, I filled out a pre-registration form at Universal Enroll last week, booked at a screening appointment at a registration center a few miles from my house, and went through the final process today.
Today’s registration process was unexpectedly painless. It took less than 15 minutes, including a short wait in the lobby, fingerprinting, stepping through a series of Identity Proofing steps and paying the $85 fee. Alas, I still don’t have a KTN. That is supposed to be issued in a week or two after some big computer in the sky processes my information. Then, I am supposed to be set up to use the PreCheck lane every time.
The downside? The government has me in yet another identity database. My KTN will be linked to my SSN, as well as to my fingerprints and other personal identification data. Big Brother seems closer than ever before!
Next step after the KTN? I will need to get a new Arizona drivers license that is Real ID compliant before January if I want to continue flying. Yet another Federal tentacle into my life!
Author: Mark Dixon
Wednesday, December 3, 2014
I heard my first speech from Cory Doctorow at the Gartner IAM Summit this morning. He gave an interesting overview of the history of digital copyright law and attempts to enforce limited access by schemes such as Digital Rights Management and encrypted data streams. He expanded beyond this basic overview to discuss how current laws make it illegal to reveal hidden flaws in software and devices. Some points I found particularly thought-provoking include:
- The 1998 Digital Millennium Copyright Act which criminalized breaking Digital Rights Management methods, wasn’t very effective, because people who were willing to break existing laws to steal content didn’t mind breaking another law.
- Current copyright laws designed to make it illegal to know how DRM or encrypted streaming video devices work (e.g. Netflix player devices) also make it illegal to reveal flaws in our computers.
- These laws may stop honest people, but support bad guys’ efforts to discover and weaponize vulnerabilities.
- The NSA and its British equivalent spent billions of dollars per year to find vulnerabilities in devices, but don’t reveal what they have found.
- Back doors to systems (such as government-requested back doors to encryption algorithms) have no allegiance. We must assume that such back doors will be used for evil as well as good purposes.
- Be suspicious of any software you cannot audit or inspect. How else can you know what lurks therein?
- Remember – the capacity for human self-deception is bottomless. Will technology set us free or enslave us?
Interesting ideas worthy of further investigation. The concept of unintended consequences certainly applied here.
Author: Mark Dixon
Wednesday, December 3, 2014
Yesterday, at the Gartner Identity and Access Management Summit, Earl Perkins, Gartner’s Research Vice President in Systems, Security and Risk, gave a thought-provoking talk, proposing that Identity and Access Management as it is today is not going to cut it for the Internet of Things. Some the highlights include (filtered through the lens of my interpretation):
- IoT can be described as as set of devices that can sense and interact with the world around it. Such devices can sense, analyze, act and communicate.
- Devices, services and applications are creators or consumers of information, and must join humans in having identities.
- Architectural concepts of IAM may still hold, but the scale will be vastly larger and must accommodate more than human identities.
- Perhaps the word “thing” should be replaced by the term “entity”
- Every entity has an identity
- We need a model of entities and relationships between these entities.
- We must address layered hierarchies of identities.
- We should not separate device management and identity management systems.
- Identity Management and Asset Management systems will likely converge.
- Identity and Access Management may become:
- Entity Relationship Management
- Entity Access Management
- We may think of architectures in four levels: things, gateways/controllers, connectivity, applications and analytics.
- Two major camps of consumption: Enterprise (where more money is currently being spent) and Consumer (which is hot and sexy, but not currently making much money).
- Strong year-over-year IoT growth is happening in four industry sectors:
- Automotive – 67% CAGR
- Consumer – 32% CAGR
- Vertical specific – 24% CAGR
- Generic business – 44% CAGR
- Companies are “throwing jello against the wall” to see what sticks.
I really like Earl’s ideas about convergence of “entities” and “relationships” between entities. Please note my blog post Identity Relationship Diagrams posted in March 2013.
I also favor his view that identity management should not be separate from device management.
It will be interesting to see how architectures are transformed and what “jello sticks to the wall” in the coming years.