[Log In] []

Exploring the science and magic of Identity and Access Management
Thursday, April 19, 2018

Pay with My Identity via Apple Watch

Author: Mark Dixon
Friday, August 18, 2017
4:07 pm


I am reading a fascinating book, “Identity is the New Money,” by David Birch. The book was published three years ago, but I find it extremely relevant today.

I just read this paragraph:

Identity becomes the key to transactions and a crucial individual resource that needs to be looked after by responsible organizations.  We all need to start planning for the transition to identity based transactions.

This triggered a thought – isn’t paying for something or enabling some action via my Apple watch a good example of an identity-based transaction of the type Mr. Birch speaks?  It kind of amazes me that paying via phone or watch is still something of a novelty in many circles.  But for me, I am always on the lookout for somebody that accepts that sort of identity-based transaction.

Here is a list of some of the places where I have recently paid with my Identity via Apple Watch:

  • Walgreens (An early adopter – the very first place I used Apple Pay)
  • Trader Joe’s
  • Whole Grain Bread
  • A&P Nursery (the tree and plant kind of nursery)
  • Church cafeteria
  • Taxi
  • Airport news/convenience store
  • Gas station / convenience store
I also nearly always use my watch to present my boarding pass as I go through airport security and board a flight.  Isn’t that also “paying” with my identity?

It is interesting how often the point of sale clerk will comment on the “high tech” or “newfangled” way I pay. Several times, they have said I was the first person they had seen pay with a watch.

I am really disappointed that the major retailers I often visit – Home Depot, Lowes, Walmart, Sam’s Club, Fry’s (Kroger), etc., haven’t jumped on the bandwagon.

I just find it so incredibly easy to pay with my watch – to pay with my identity.  I just wish the pace of adoption would accelerate!

Comments Off on Pay with My Identity via Apple Watch . Permalink . Trackback URL

InfoSec Evolution – At What Cost?

Information Security
Author: Mark Dixon
Friday, August 4, 2017
12:00 pm


As I read a recent Risk Management Monitor article “Companies Must Evolve to Keep Up With Hackers,” I couldn’t help but think – at what cost?  Perhaps you can calculate the amount a company spends on tools and processes to defend against cyberattacks, and perhaps even justify that expense by attempting to estimate the cost of a data breach were it to occur.

But what about cost of lost opporutunity?  Has anyone tried to estimate how much time, attention and resources are diverted from managing and innovating in the core business to defend against cyberattacks? I would guess that such diversion robs more from the overall business than the more visible expenses that show up on a balance sheet – which is growing at an alarming rate.

So, Mr. or Ms. Hacker, whoever you are, you are robbing our society blind – in ways that are really tough to measure. Man up and do something productive for a change!


P.S., Jerry Dixon, author of the article, is not related to me that I know of, but he writes a good article!

Comments Off on InfoSec Evolution – At What Cost? . Permalink . Trackback URL
WordPress Tags:

Banks as Identity Service Providers?

Author: Mark Dixon
Wednesday, August 2, 2017
4:53 pm


Yesterday, I blogged about the inherent conflicts of interest that exist with most current or potential Identity Providers.  Is it just coincidence that today I would read a post on LinkedIn by Gary Rowe, CEO/Principal Consulting Analyst at TechVision Research, highlighting the TechVision Research report, “Banking on Identity?

The report offers a compelling case: “The opportunities for banks to become identity service providers.” I was impressed when I read the downloaded report.  Here are a few excerpts:

Identity data in all its forms is going to power the global economy of the future and will become increasingly highly prized and sought after. Services that help manage the safekeeping and distribution of identity data could dominate that future.

This is certainly in harmony with the statements in my recent blog, “The Future of Digital Identity,” in which I quoted David Birch  author of “Identity is the new Money.”

For banks to proactively create a new set of identity services would not be that far removed from what they are required to provide today to comply with KYC (know your customer) and other regulations, both in Europe and the rest of the world. It would also offer a welcome opportunity to strengthen customer relationships and encourage customer loyalty at a time when other aspects of the banking business are being disrupted.

Yes, Identity is about relationships, and banks do seek to strengthen relationships with their customers. I place trust in the banks with which I do business.  Can I also trust them to safeguard my identity information, the “new money” of the global economy?

From a consumer perspective, the major initial attraction [in banks as identity service providers] will be convenience. Not having to repeatedly undergo the tiresome process of producing hard copy documentation verifying identity, as well as proof of residence, will be very attractive and remove an irritating barrier to getting business started as quickly as possible. Being able to use the trusted services of a bank will, in the majority of cases, likely be far more attractive than using the services of a social media or any other company.

As a consumer, I would definitely prefer my bank as identity provider over Facebook or Twitter!

For the banks, the principal advantage of becoming identity providers is about cost mitigation. Banks are already spending large amounts on KYC and other identity-related issues. Any opportunity to begin to monetize that sunk cost would provide a welcome additional income stream.

The report lays out a compelling case for benefits to banks in providing identity services.  The new ability to “monetize that sunk cost” is a benefit I hadn’t considered before.

Until recently the requirement for a customer-centric identity service was the stuff of long-term visions, and the idea that a bank would provide such a service would have been considered outlandish. But the demands of today’s heavy dependence on the Internet for every aspect of daily life has made the absence of safe, secure and reliable personal credentials one of the barriers to the growth of the digital economy.

I admit that I was one with long term dreams, if not visions, of a good identity service provider.  BofA, Chase, Wells Fargo — which of you will have the vision and courage to make it happen?




Comments Off on Banks as Identity Service Providers? . Permalink . Trackback URL

Identity Providers – Conflict of Interest

Author: Mark Dixon
Tuesday, August 1, 2017
4:05 pm


After uploading yesterday’s blog post, I realized that I had again made a statement about a problematic “conflict of interest” inherent in many Identity providers.

What do I mean by that?

For many years, I have dreamed of the concept of a broadly used Identity Provider enabling each of us to leverage one set of identity credentials to reach service providers, with personal control over which bits of our personal information would be shared with each service provider.  

I just checked way back on my blog to find a few examples of my early yearnings:

Well, now we are in 2017.  The technology is widely available to make that happen. Can’t we just use Facebook, Google, Twitter or Amazon? Well yes, sort of. However, I propose that the biggest problem with any of these organizations really filling the role of a universal identity provider is that they all have massive conflicts of interest.

Facebook, Google and Twitter really just want to sell my eyeballs and mouse clicks to the highest bidder in an advertising war.  Amazon just wants to sell me stuff. 

Why would any of these companies ever really want to allow me to use the relationship I have developed with them to establish a relationship with a competitor?  Only if it is calculated to benefit their their interests, to be sure.

Such conflicts of interest are grounds for employee termination in many companies (or should be), yet it happens all the time on the Internet.  I suppose that only when truly independent identity providers like Sovrin are widely adopted will we escape these conflicts of interest. 

Comments Off on Identity Providers – Conflict of Interest . Permalink . Trackback URL
WordPress Tags:

The Future of Digital Identity

Author: Mark Dixon
Monday, July 31, 2017
4:59 pm


Following a blog post recommendation by Emma Firth, Communications Director of Digi.me, I just read an insightful article, “Transforming the Digital Identity Landscape,” in the June 2017 issue of Leo, an e-magazine published by Luxembourg for Finance.

It was particularly interesting to read the viewpoints of four Digital Identity thought leaders who spoke at the Fintech Stage Luxemourg conference:

A few excerpts:

David Birch, Director of Research at Consult Hyperion and author of “Identity is the new Money.”

To me, digital identity is the bridge between the world of virtual identities that only exist on-line and the things that exist in the real world.

You can think of the problem as being that there are two sides to that bridge: we need to connect the bridge to the real world, and that´s complicated and time-consuming and expensive. Nobody wants to have to manage personal data. Especially because you have new data protection laws coming, and the costs of having to manage this ‘toxic waste’ and deal with it when it is tangential to your business are not what you want to do.

Connecting the bridge to the virtual world, in contrast, is easy. We should have many virtual identities, one for each of our online relationships.

I like the concepts of Identity being a bridge (or set of bridges) between the virtual world of online identities and reality.

His comment about the difficulty of managing the “toxic” waste of personal data which is only tangential to real business is particularly relevant in the GDPR countdown to May 25, 2018.

Julian Ranger, Chairman and Founder of digi.me

We have always been multi-dimensional. The question is, are our financial services able to support that multi-dimensionality and work for me across all of those dimensions?”

If you consider identity not to be just identification of data, but all the things that I do, then it’s a holistic through-life process, and you should be using digital identity by engaging directly with me and looking at me across all aspects of my life.

I liked how Mr. Ranger described Digital Identity as a “holistic through-life process,” challenging financial services companies to embrace the inherent multi-dimensional reality of the customers they serve.

David Brear, Founder and CEO of 11:FS, a FinTech consultancy

When you look at digital identity there is no de facto listing globally. 

This is so critical to identity that if you don’t trust the system that the identities are being captured and contained within, it makes it tough for that system to be very useful within the realms of what you are trying to do. This is why people have started to look at irrefutable databases. Things like distributive ledgers and blockchain-like identity schemes are very interesting for this.

Yes, Digital Identity begs for a global “irrefutable database,” perhaps using “distributive ledgers and blockchain-like identity schemes.”  I believe this type of mechanism is essential to really solve the current conflict of interest nature of Identity providers.

Sam Maule, Director, Director, Senior Practice Lead, Digital & FInTech at NTT DATA Americas

I believe we overuse and overhype the term blockchain. I believe that distributive ledger technology does serve as an excellent tool, but in the future, we are going to have components of Artificial Intelligence that we haven’t looked at before, with which we will be able to fine-tune this concept of digital identity.

Startups and FinTech can streamline and simplify the process around identity, and I believe the banks themselves can secure it and make sure it’s compliant, and the two work hand in hand together.

I agree that “blockchain” is an overhyped term, but it is interesting that Mr. Maule turned to another over-hyped term, “Artificial Intelligence,” in the quest to fine tune and simplify the problems of Digital Identity.  I expect that we will see a number of technologies converge to meet the global requirements of Digital Identity.

In all, fascinating concepts:

  • Digital identity is the “bridge” between our many online virtual identities and our real-world selves.
  • Digital Identity must be a “holistic through-life process,” accommodating the inherent multi-dimensional aspect of our lives.
  • Technologies like blockchain and distributed ledgers will be essential to enable global, irrefutable databases for Digital Identity.
  • Blockchain alone won’t solve all the problems.  Leveraging other emerging technologies such as artificial intelligence will be essential to meet real world Digital Identity demands.

I love these discussions about Identity.  We have a great future ahead.

Comments Off on The Future of Digital Identity . Permalink . Trackback URL

Identity – Critical for GDPR?

Identity, Privacy
Author: Mark Dixon
Friday, July 28, 2017
12:44 pm


How critical is Identity and Access Management to GDPR Compliance?

The somewhat radical, but underlying philosophy of GDPR is that enterprises must enable individual data subjects (EU citizens) to control their own Personally Identifiable Information (PII), and grant or withdraw permission to store and use such data. Certainly, appropriate processes and technology are essential to protect the data “by design and default,” but the question remains – how can enterprises keep track of all the data subjects and their PII data?

I propose that Identity is at the heart of the matter.  How can an enterprise:

  1. Know who all data subjects are and what personal data is being maintained?
  2. Know what rights of data use each data subject has granted? 
  3. Know PII data elements are being maintained and processed for each data subject?
  4. Enable data subjects to edit (rectify) any of the data elements being maintained?
  5. Allow each data subject to grant or withdraw consent?
  6. Securely authenticate and authorize data subjects when they desire access to their PII?
  7. Guarantee that only people with legitimate need-to-know can access PII?
  8. Enable data subjects to request erasure?
  9. Audit and certify processes for consent, use and erasure?
  10. Notify data subjects of any breaches?

There are probably more reasons, but this list is a start. In my opinion, Identity at the heart of effective GDPR compliance.

By the way, as of today, there are only 300 days left.

Comments Off on Identity – Critical for GDPR? . Permalink . Trackback URL
WordPress Tags:

Oracle White Paper: Helping Address GDPR Compliance

Information Security, Oracle, Privacy
Author: Mark Dixon
Thursday, July 27, 2017
12:00 pm


May 25, 2018 is bearing down on us like a proverbial freight train. That is the date when the European Union General Data Protection Regulation (GDPR) becomes binding law on all companies who store or use personal information related to EU citizens. (Check out the count down clock on the GDPR website).

Last week, Oracle published a new white paper, “Helping Address GDPR Compliance Using Oracle Security Solutions.”

Leveraging our experience built over the years and our technological capabilities, Oracle is committed to help customers implement a strategy designed to address GDPR security compliance. This whitepaper explains how Oracle Security solutions can be used to help implement a security framework that addresses GDPR.

GDPR is primarily focused on protecting fundamental privacy rights for individuals. By necessity, protection of personal information requires good data security. As stated in the white paper, 

The protection of the individuals whose personal data is being collected and processed is a fundamental right that necessarily incorporates IT security.

In modern society, IT systems are ubiquitous and GDPR requirements call for good IT security. In particular, to protect and secure personal data it is, among other things, necessary to:

  • Know where the data resides (data inventory)
  • Understand risk exposure (risk awareness)
  • Review and, where necessary, modify existing applications (application modification)
  • Integrate security into IT architecture (architecture integration)

Oracle proposes the following framework to 

… help address GDPR requirements that impact data inventory, risk awareness, application modification, and architecture integration. The following diagram provides a high-level representation of Oracle’s security solutions framework, which includes a wide range of products and cloud services.

OracleGDPR SecuritySolutions july17


The paper primarily focuses on the “Enforcement” portion of this model, postposing that:

… four security requirements are a part of many global regulatory requirements and well-known security best practices (i.e. ISO 27000 family of standards, NIST 800-53, PCI-DSS 3.2, OWASP and CIS Controls).


In conclusion, the paper states:

The path towards GDPR compliance includes a coordinated strategy involving different organizational entities including legal, human resources, marketing, security, IT and others. Organizations should therefore have a clear strategy and action plan to address the GDPR requirements with an eye towards the 25 May, 2018 deadline.

Based on our experience and technological capabilities, Oracle is committed to help customers with a strategy designed to achieve GDPR security compliance.


May 25, 2018 is less than ten short months away.  We all have a lot of work to do.




Comments Off on Oracle White Paper: Helping Address GDPR Compliance . Permalink . Trackback URL
WordPress Tags: , , ,

Cyber Attackers – Virtual Scorpions?

Author: Mark Dixon
Wednesday, July 26, 2017
11:16 am

This morning I read a short article stating, “Arizona businesses lead the nation in malware detections.” Wouldn’t you know — Arizona leads the nation — but not in some fun way like an NBA Championship.

I immediately thought of another dubious distinction for our state – the Arizona bark scorpion is the most venomous scorpion in North America.

I propose that we begin to think of cyber attackers as “Virtual Scorpions”- sneaky, scary, venomous and treacherous.

If only we could deal with cyber attackers like our grandkids detect and obliterate scorpions in Arizona –  armed with ultraviolet lights and a blowtorch.

Enjoy the show.

Comments Off on Cyber Attackers – Virtual Scorpions? . Permalink . Trackback URL

Meeting in the Insane Asylum

History, Oracle
Author: Mark Dixon
Wednesday, July 12, 2017
11:39 am

Lots of nostalgia this week … yesterday and today, my meetings have been on the Oracle Santa Clara Campus. It is always enjoyable to come here and remember the many meetings I attended here prior to the Oracle acquisition of Sun Microsystems in 2010 and with Oracle colleagues since then.

It is fun to meet in the grand old buildings on this campus, which were first built as part of the Agnews Development Center, originally known as “The Great Asylum for the Insane.” Commentary on the present occupants? You decide.

IMG 3010

Comments Off on Meeting in the Insane Asylum . Permalink . Trackback URL
WordPress Tags: , ,

A Stroll Down [Technology] Memory Lane

History, Technology
Author: Mark Dixon
Tuesday, July 11, 2017
9:51 pm

This week, I am staying in the Santa Clara Marriott hotel for a few days while attending some corporate meetings.  As I drove to Santa Clara from the San Francisco Airport yesterday, I began to reminisce about times in my early career when I spent a lot of time in this part of the world.  

IMG 3042

I first stayed in this hotel in 1984, soon after the release of the first Macintosh computer.  For about two years, I worked closely with Apple Computer, first to recommend improvements to their manufacturing management system and then to manage the upgrade process. I can vividly remember the weekend I spent holed up in this hotel with a Mac computer (black and white screen of course) and a dot matrix printer, writing a proposal that Apple adopted to implement the Tandem-based manufacturing information system we had installed in the Fremont Macintosh factory, in their factories in Ireland and Singapore.

Now, so many years later, although some things seem just the same (think Moffett Field blimp hangars), much has changed.

  • The Santa Clara Marriott was the first hotel where I spent more than $100 a night for a hotel room. The price has risen to more than $300 per night on my employer’s discounted price schedule. (But my room does have a large flat screen TV and an NFC door lock that didn’t like my Marriott mobile app.)
  • Airline tickets back then were printed on paper and had to be picked up from the travel agency. No paperless tickets or boarding passes on my Apple watch.
  • I did not have an email address (or a blog or a website or facebook account – they hadn’t been invented yet).
  • It would be a full 8 years before I owned my first mobile phone.  
  • Before I took a trip, I had to leave specific instructions with my wife about what phone numbers she could use to reach me during the day or evening.  If I had to reach her during the day, it was most likely on a pay phone. And I actually used the hotel room phone in the evening!
  • Of course, I had no GPS.  I used printed maps from AAA and the rental car office to navigate.
  • I carried a cassette tape player in my suitcase so I could listen to music.
  • I actually took notes on paper, had a paper day planner and used a paper address book. I submitted travel expenses report — on paper!
  • I did have a first generation Compaq portable computer back home in Utah, but I usually never took it on trips with me, especially not to Apple! 
  • And the list could go on and on …

It just boggles my mind to think what changes will occur in the next 3+ decades!

Comments Off on A Stroll Down [Technology] Memory Lane . Permalink . Trackback URL
WordPress Tags: ,
Copyright © 2005-2016, Mark G. Dixon. All Rights Reserved.
Powered by WordPress.