| |
 Subscribe in a RSS reader • Subscribe via Email
Reporting From RSA 2010: Identity, Health Care, and a Higher Realm of Credentials
Written by Mike Kirkwood. Read the full article.
This week we are reporting from RSA, the security conference in San Francisco. We’ve seen hackers, threats, and industry leaders roaming these halls – and among these we found leaders of the identity community, people who are thought leaders focused on creating a safe Internet for all individuals.
This includes folks who in the Identity Commons and OASIS workgroups, and the 1-year-old Kantara Initiative. The latter was announced to the public at RSA 2009, and this year it hosted an all-day workshop that brought cloud computing into the forefront of the dialog.
Diverse Community of Interests Coming Together
Today’s all-day workshop offered by the Kantara Initiative focused almost exclusively on identity services and included viewpoints from several perspectives: enterprises (CA, Ping Identity, Aetna, Oracle, HP), service providers (NTT), consumer applications (Paypal, Google), and government agencies (NIH).
The room was packed – standing room only. After the kickoff we had a chance to ask Trent Adams, chair of the Kantara leadership council, to share his thoughts about identity, cloud computing and year one of the new organization.
He talked about the potential big win that existed for the organization because of its involvment in preparing standards for federal government approval. These are in historic times, he said, and embracing openness at the federal level was an opportunity the organization decided was valuable for the community. We’re keeping our ears open to learn more about how identity services will be enabled and approved through the government.
Landscape Change: Cloud Computing Invigorates Identity Efforts
One thing that is clear is that things get more complicated when combining identity services with cloud computing. We were reminded that many of the technologies that have been developed, including things like OpenID and SAML were designed around the same scenarios of sharing across domains. Identity can be solved in a multi-vendor, multi-protocol, and multiple-infrastructure world.
Matthew Gardiner of CA summed the importance of the link between identity solutions and cloud computing in his talk, “Identity as Security Glue for the Cloud”:
“I want to say the phrase cloud security in the first few moments of my talk because you’ll be hearing it a thousand times before the end of the conference. Cloud security can be viewed as a Rubik’s cube of security implications, when identity services and combining them within the vectors of Iaas, PaaS, and SasS combined with private, public, and hybrid clouds.”
The West Coast Perspective on Health Care
 RSA and HIMSS fall on the same week this year. While nearly all of the healthcare IT leadership headed to Atlanta, several companies also came to San Francisco.
Yesterday, MEDecision presented their solution and connections to different Web applications and health care records and systems, and gave a very tangible set of scenarios showing how cloud computing and identity meet around sharing information about a person who is a patient.
At the same time on the East Cost, MEDecision was also at HIMSS demonstrating open exchange of health information in a HIE product offering that helps connect services across providers in order to aggregate a view of an individual. The company offers software and services to insurers to negotiate their cloud-based work flow, including moving private data across pharmacy, doctors, insurers, and the entire health care landscape.
No Passwords in the Cloud
 Patrick Harding of Ping Identity spoke about his company has learn about cloud computing in this session, “How the Cloud is Changing Federated Identity Requirements”. A few of his observations:
- Software is no longer build vs. buy. It now includes subscribe, which by definition is a shorter term relationship.
- Cloud computing is an evolution of architecture. It arrives after Web services, which evolved from Web, client server, and mainframe.
- Complexity of the identity layer is harder than ever for the simple reason that there are more apps per user than ever before.
- Services are becoming any-to-any, where internal (employee) and external (customer) classifications don’t matter nearly as much as before. Because of this firewalls are losing their usefulness.
- Audit is no longer an afterthought. Auditors don’t care how or where applications hosted, but hey do need their reports! This includes Sarbanes-Oxley, HIPAA, Gramm-Leach, Bliley, and more.
A core theme of this session was how the consumer mindset is driving requirements for application experience. Consumers expect it to work on any device, be secure, and be portable. To deliver on this, it must be easy to use. At the same time, password risk must be reduced.
A key trend that Harding pointed out is moving identity systems from “push” models into “pull” models. Instead of updating partners and directories by batch services, companies need to be building real-time identity resolution in applications.
We asked Harding if he had any predictions for where that type of service will come from. His response led us to the conclusion that the leader will be a brand and service that people trust and understand the motivations of. It will likely enter the market from a higher realm of credentials than Twitter or Facebook – perhaps from financial services.
Context is Fundamental: Person, Father, Employee, All of the Above
One thing we learned today is that Google’s App Engine is worth watching as this space evolves. Several interesting things are being done in this sandbox that haven’t been accomplished other places, including how to connect consumer services to enterprise login discovery using domain.
Google has inserted itself into the sweet spot by getting consumers and enterprises alike hooked on their applications, giving the company a unique view of the challenges and solutions in joining identity with cloud computing. We’ll be taking a closer look at these offerings and where Google is headed.
Another thing we observed is the power of the network. NTT gave a demonstration of the power of mixing identity protocols (SAML and OpenID) for the purpose of connecting social, information, and financial transactions in the browser with one login. It starts to show how the next generation Internet might work, where the application requests profile from the cloud rather than a user typing it in.
A summary of overlapping-world-multi-protocol integration has been shared on Google’s site.
Subscribe in a RSS reader • Subscribe via Email
Announcing Liaison with OASIS eGov MS
The Kantara Initiative (KI) and OASIS are pleased to announce that the KI eGov Work Group (WG) and the OASIS eGov Member Section (MS) have established a Liaison relationship.
Scope:
The scope of this liaison relationship is to foster the aligned interests of both groups such that the OASIS eGov MS becomes the first point of contact/filter for works coming out of the KI eGov WG that flow into OASIS Technical Committees (TCs) and other Member Sections. Likewise, the KI eGov WG shall become the first point of KI contact for works flowing out of the OASIS eGov MS. This informal relationship will enable the KI eGov WG and the OASIS eGov MS to build a view of the landscape of identity and access management standards within KI and OASIS that have an ‘eGov’ factor.
The liaison relationship between the KI eGov WG and the OASIS eGov MS is seen as the first of a number of such liaisons. Near-term communications revolve around the eGov Profile v2 work underway, and any impact it might have for the OASIS Security Services TC regarding SAML use in eGov scenarios. Some discussions to this effect have already been raised.
To foster the discussions between the OASIS eGov MS and KI eGov WG, each group will appoint a joint liaison officer and generate a monthly report/update of each other’s activities including pointers to work on the horizon.
The Kantara Initiative and OASIS extend congratulations to both groups on their efforts to foster what will be a meaningful and productive liaison for eGov standards. We look forward to exciting work from both groups.
For more information on how to become involved in the KI eGov WG please visit their home page here http://kantarainitiative.org/confluence/display/eGov
For more information on how to become involved in the OASIS eGov MS please visit this page www.oasis-egov.org/join
Subscribe in a RSS reader • Subscribe via Email
A Windfall for Identity Assurance
On behalf of Frank Villavicencio, chair of the Identity Assurance WG. Also published at Frank Villavicencio’s blog page.
First off, I would like to would like to express my sympathy to those affected by the terrible earthquake that hit Chile this past weekend.
Envio mi palabra de aliento y de optimismo al pueblo Chileno. Tengo muy buenos amigos Chilenos y a todos les deseo lo mejor en vista de estas circunstancias, a sus familias y a todos los afectados… Las cosas de Dios son sin duda alguna indescrifrables.
In this blog post, I would like to share with you some recent developments in the world of identity assurance, which as you know from my recent blog posts: “Identity Assurance, an everyday life issue” part 1 and part 2, is a top of mind issue for me and for us here at Identropy. Quite frankly, I could not hope for better timing for these blogs to come about.
On Friday February 26th, 2010 the US Federal Government’s Identity, Credential, and Access Management (ICAM) Trust Framework Evaluation Team (TFET) reviewed Kantara Initiative’s latest submission and granted it Provisional Approval as a Trust Framework Provider at Levels 1, 2 & non-crypto Level 3 under the Open Identity Solutions for Open Government program. The removal of the provisional status will hinge on the release by TFET of additional guidance for assessors concerning privacy and Kantara’s adoption of this guidance.
This is for me an extraordinary milestone, not only in my role of Chair of the Identity Assurance Work Group, but as an identity assurance activist altogether. Kantara submitted its application for the US Federal Government adoption of the Identity Assurance Framework (IAF) in November of 2009. Prior to that date, the IAWG has been working very hard, collaborating with Kantara and the Assurance Review Board (who oversees the Kantara Initiative Identity Assurance Certification Program) to achieve this important goal (albeit still under provisional status).
The significance of this milestone is that it represents an important step towards fostering the adoption of identity-enabled Government services at known levels of assurance, relying on identity credentials issued and managed by non-Government parties (referred to as Credential Service Providers in the IAF). It will create the right conditions for the certification program to be adopted in real-life scenarios and for the industry to benefit from a proven, best-of-breed certification program that effectively enables interoperability and trust. This means that the IAF will not be just a “paper” standard, incarnated in a compendium of documents, but an actual technology-agnostic program that organizations can certify against.
With the adoption of risk-based models, identity federation can achieve Internet scale, and facilitate public access to online information at specific levels of assurance. With adoption will also come economies of scale and further collaboration and interoperability across industries and Governments.
As someone who has been involved in identity management and identity assurance for quite some time, I cannot help but feel excited about the times I live in, and optimistic about what is to come.
I do anticipate and hope for more endorsements of the IAF in the near future by other organizations, and more importantly, the start of a paradigm shift in the way we all think about identity, both within the Enterprise and in a federated environment. Ultimately, this path will allow the identerati to focus on the real end goal: delivering identity-enabled solutions and services with the level of trust and confidence that is appropriate for the transactions being performed.
But this is just a first step…
Frank
Subscribe in a RSS reader • Subscribe via Email
Announcing the formation of the Interoperability WG – Call for Participation
Below is a call for participation sent to the Kantara community@ list by Ari Kermaier, co-chair of the Interoperability Review Board. Please feel free to pass this note on to colleagues or friends who may be interested.
—————————————————-
The Kantara Initiative is expanding its focus beyond SAML 2.0 and is working to cultivate and manage new certification programs covering a broad spectrum of developing identity and access protocols. Some of the emerging standards currently under consideration for testing are:
- WS–Trust
- WS–Security
- OpenID
- InfoCard
- Oauth
- XRD
To support the development of the new test procedures needed for this program, the Kantara Initiative is announcing the formation of the Kantara Initiative Interoperability Work Group (IOPWG) – chartered to support the Kantara Initiative Interoperability Program through the development of Test Procedures to be used by the Interoperability Review Board, regardless of protocol. The IOPWG will work closely with the Interoperability Review Board (IRB), the Kantara Initiative sub-committee responsible for member oversight of the Interoperability Program.
In addition, the IOPWG will be available to provide expertise and technical support to the IRB during the course of any of the Kantara Initiative Interoperability events, and will assist in resolving questions of protocol interpretation that may arise among test participants.
If you’d like to get involved in the Kantara Initiative Interoperability Program to recommend test procedures for such emerging standards as WS–Trust, WS–Security. OpenID, InfoCard, Oauth and XRD, the IOPWG is the group for you!
For more information on the Interoperability Workgroup, please visit the IOPWG home page at http://kantarainitiative.org/confluence/display/iopwg to see:
- The Charter
- Mail list and Archives
- Designated IPR Policy options for operation
- “Join this Group” Button
ANYONE may participate in a Kantara Initiative Work Group. If you or your colleagues would like to join this group, you will simply need to complete the Group Participation Agreement here:
http://signup.kantarainitiative.org/?selectedGroup=23
(NOTE: joining Kantara Initiative as a Member does not automatically enroll you as a Participant in any particular WG or DG–you must specifically join those groups in which you choose to participate):
Of course, if you encounter any problems on our Website, the Kantara Initiative Staff is always happy to assist! If you have any questions about the Kantara Initiative or how to get involved please don’t hesitate to send us a message (support[at]kantarainitiative[dot]org) or use our contact form here: http://kantarainitiative.org/confluence/display/GI/Contact+Us
Please join us in congratulating the IOPWG on its formation!
Regards,
Ari
Subscribe in a RSS reader • Subscribe via Email
Identity Assurance, an everyday life issue – articles from the IAWG Chair
Frank Villavicencio, Kantara Initiative’s Identity Assurance Work Group (IAWG) chair, has posted a very interesting 2 part blog article called “Identity Assurance, an everyday life issue”. In this 2 part series of articles Frank provides an excellent overview of Identity Assurance concepts as well as examples of how Identity Assurance applies to everyday life experiences. The intro to the articles is copied below and the full series can be read from the links provided.
Read the full articles:
Part 1
Part 2
——————————-
Introduction
The notion of identity assurance is to establish, with a level of certainty, that the human being represented by a credential in an electronic transaction is in fact the alleged person. Whether you realize it or not, whenever you perform an electronic transaction, you are making some kind identity assurance tradeoff.
Identity assurance does not only apply to scenarios in the extranet in which consumers or users from one organization interact with systems in another. It also applies within the enterprise where you need to view identity lifecycle management holistically, as opposed to fragmented steps, such as provisioning, authentication, single sign-on, etc.; and how they contribute to creating and maintaining identity assurance.
——————————-
Thanks for the great articles Frank!
Subscribe in a RSS reader • Subscribe via Email
Announcing leadership of Kantara Initiative’s Healthcare Identity Assurance WG
Congratulations to John Fraser of MEDNETWorld.com, Rick Moore of eHealth Ohio & Pete Palmer of Surescripts. All three gentlemen will continue to serve this year as co-leading chairs for Kantara Initiative’s Healthcare Identity Assurance WG. Previously, John, Rick and Pete led Liberty Alliance’s Healthcare SIG.
We look forward to more great work to come out of the Healthcare Identity Assurance WG in 2010 and encourage you to become involved.
Subscribe in a RSS reader • Subscribe via Email
Diverse Market Leaders from the Identity Ecosystem Converge on March 1 at RSA
Diverse Market Leaders from the Identity Ecosystem Converge to Stage Kantara Initiative’s RSA Security Pre-Conference Workshop on “Technology, Policy and Compliance for Identity Services in 2010 and Beyond”
Gain State-of-Identity Insight of common Cloud/SaaS scenarios and recent developments in assurance, multi-protocol interoperability, privacy-enablement and more from Enterprise and Consumer Market Leaders.
Piscataway, NJ, 8 February 2010 Kantara Initiative announced today its annual public Identity Workshop at the RSA Security Conference. The one-day event to be held on March 1st from 8:00am- 5:00pm in the Moscone Center in San Francisco is designed to equip attendees with the vital information required to ensure success in employing the right identity management approach with the proper considerations. Recent developments in identity assurance, multi-protocol interoperability, liability models, usability, privacy-enablement and identity services certification will be spotlighted by key market leaders including Google, Oracle, CA, Aetna, NTT and Ping Identity.
“If you run a login system of any type (Enterprise, Consumer, SaaS vendor) you will find this workshop to be packed with information about major changes in the space, both in terms of security design and new functionality that can improve your identity infrastructure,” reveals Eric Sachs, Product Manager for Google Security.
“Since its inception nearly one year ago, Kantara Initiative has built momentum for service deployment across the identity ecosystem,” says Roger Sullivan, Oracle. “This workshop will help deployers understand how to connect the dots between cloud computing and identity management”.
“Identity protocols like SAML, OpenID, OAuth, and Information Cards continue to evolve,” says Paul Madsen, Identity Management Researcher at NTT. “This workshop will discuss recent developments, and present opportunities for combining the protocols in useful ways.”
“Identity Assurance is the key to successful, secure transactions across the emerging National Health Information Network, “ explains Mark Coderre, Head of Security Architecture for Aetna. “At this workshop we will be showcasing what the healthcare industry is doing with Kantara Initiative programs to improve the security of sensitive data transactions across operational boundaries.”
The identity workshop will feature a series of presentations, panels and demonstrations of common Cloud/SaaS deployment scenarios and innovations from various market leaders.
Technology, Policy and Compliance for identity Services in 2010 & Beyond is open to the public and to all RSA Conference attendees. To register for this free Kantara Initiative workshop, please click http://www.emc.com/microsites/rsa-conference/2010/usa/registration-and-rates.htm and use the code: 131 0KANEXPO for the Expo only pass and select Kantara Initiative from the ‘Registration Package’ page. Note that this pass only allows access to the Kantara Initiative workshop on March 1.
About Kantara Initiative
Kantara Initiative is a global, open, public-private, technology-agnostic forum comprised of identity ecosystem stakeholders. Co-founded by Liberty Alliance, Internet Society, and the Information Card Foundation, among others, its inspired mission is to promote technical interoperability and harmonization; to develop policy frameworks for operational interoperability and; to provide certification and assessment programs to grow trust in the standards, products, and service deployments. Kantara Initiative freely provides the governance and resources whereby diverse members of the ecosystem successfully collaborate on a diverse portfolio of common policy frameworks, technical specifications and deployment guidelines driven by the identity community, industry and governments from around the world. For more information about getting involved in Kantara Initiative, visit www.kantarainitiative.org.
Media Contact
Michelle Hunt
Kantara Initiative
Michelle.Hunt@ieee-isto.org
(732) 981.3434 (o)
###
Subscribe in a RSS reader • Subscribe via Email
Announcing Philippe Clement as Kantara Initiative’s Identity Provider Selection WG Chair
We’re happy to announce the continued leadership of Philippe Clement as Kantara Initiative’s Identity Provider Selection Working Group Chair. Philippe works at Orange-FT Group and has been involved with Kantara Initiative since it’s inception as Chair of the Identity Provider Selection WG. In previous years, Philippe actively worked with the Business Marketing Expert Group (BMEG) to move the work of IdP Selection MRD forward.
We congratulate Philippe with his ongoing leadership and look forward to more great work coming from the Identity Provider Selection WG this year.
Subscribe in a RSS reader • Subscribe via Email
Executive Director Search: Job Description
Organization: Kantara Initiative
Job Title: Executive Director
Job Type: Full Time Contractor
Date Posted: February 6, 2010
To Apply: Send a cover letter and resume to ksearch@elists.isoc.org
Description:
The Executive Director (ED) of the Kantara Initiative is responsible for the successful operation of the organization, including aspects of Operations, Strategy, Business Development, Member Relations, and Marketing. This includes the cultivation of strategic relationships and member recruitment as well as personnel management, all conducted internationally. Additionally, the ED shall perform other activities as required by the Board of Trustees that are commensurate with the duties customarily provided by an Executive Director.
The ED shall be appointed in accordance with the Kantara Initiative Bylaws, report to the Board of Trustees, and operate under guidance provided by the Leadership Council. All permanent Kantara Initiative staff will report directly to the ED, with the reporting relationship of paid contractors depending on the particulars of the project.
The ED position is for a full-time contractor. The Kantara Initiative is flexible regarding work location given the highly distributed and global nature of the organization U.S. residency is not a requirement. In support of the organization’s mission, the ED is expected to travel regularly, both domestically as well as internationally.
Primary Roles & Responsibilities Include:
- Administrative & Infrastructure Operations
- Oversee the daily operation of the organization according to the Bylaws and Operating Procedures.
- Work with the Board of Trustees, Leadership Council, and key personnel to formulate and execute on the organization’s strategy, goals, objectives and future vision.
- Continually improve the operational efficiency and financial viability of the organization.
- Develop an annual budget in collaboration with the Treasurer, Officers, Board of Trustees, and Leadership Council.
- Group / Program Support
- Participate in Executive Committee, Leadership Council and Board of Trustees meetings, providing periodic reports on all principle activities such as the Assurance Review Board (ARB), Interoperability Review Board (IRB) and other certification programs.
- Help organize and lead Kantara Initiative conferences and workshops, seeking and collaborating with co-sponsors as necessary.
- Continually work to accelerate awareness and adoption of Kantara Initiative Recommendations.
- Develop, implement, and maintain a forward-looking roadmap for Kantara Initiative that covers key milestones for the organization for a period specified by the Kantara Officers.
- External Liaison / Representation
- Act as a visible and accessible representative for Kantara Initiative, effectively representing the organization, its programs, work groups, and discussion groups.
- Actively participate in and present at Industry events, representing the Kantara Initiaive perspectives, goals and activities.
- Help coordinate activities and projects with other industry consortia, standards bodies, or professional organizations. Act as an executive liaison to other organizations.
- Help coordinate marketing and other outreach activities to spread the Kantara Initiative perspectives.
- React quickly to help orchestrate response to Industry news and events that would benefit from Kantara involvement.
- Membership Growth / Evangelism
- Recruit organizations to join Kantara Initiative as paying Members, especially at the Board of Trustees level, and encourage active participation across all levels.
- Identify and drive programs that deliver on the Kantara Initiative mission, expand the organization’s financial viability, and increase the benefit of membership.
- Continually work to expand Kantara Initiative Membership on all levels, increase participation within existing Members, and improve working relationships with other organizations.
For Reference:
Requisite Skills & Experience:
The successful candidate for the position of Kantara Initiative Executive Director will need to have proven successful experience managing a distributed organization, including budget responsibilities, preferably within a technology intensive area. This includes the skills required to build, manage, and otherwise develop an effective team, including contractors, required to support the operational needs of an international organization.
In addition to the operational aspects of the position, the ED will be required to interact appropriately with member companies, government officials, individual contributors, partner organizations, press, and industry analysts. As such, the successful candidate will be required to demonstrate an ability to act diplomatically and respectfully. A key skill of the successful candidate will be the ability to facilitate the building of consensus across stakeholders with distinctly varying points of view. The candidate will also need to have experience speaking in public and be able to react effectively to press inquiries.
Kantara Initiative is a technical organization supporting the development of open standards and related best practices and policies. As such, the successful candidate will need to display an understanding of the interplay between technologies within various standards organizations and their deployers. While the successful candidate is not required to be fluent in the details within the identity industry to be considered, proven experience dealing with similar issues will be required.
The successful candidate for the ED position must have experience:
- Managing distributed operational and technical teams.
- Developing and managing against a budget.
- Working with international entities.
- Public speaking and general diplomacy.
- Designing and executing marketing campaigns.
- Working with Internet-related issues, technologies, and businesses.
- Speaking fluent English in business settings.
The successful candidate for the ED position should have an understanding of:
- Building successful international business relationships.
- Standards development organizations and their processes.
- Technology development and adoption phases.
- Internet technologies.
- Trends within the Internet and security markets.
- How to effectively work with business and government partners.
The successful candidate for the ED position would benefit from experience:
- Working for a not-for-profit organization.
- Working in more than one country.
- Speaking languages in addition to English.
- Chairing long-running, highly distributed, volunteer committees.
- Working with one or more of the following: SAML, OpenID, IMI, OAuth, SSL/TLS
For more information or to apply for the position, please send email to: ksearch@elists.isoc.org
This job description is also available in PDF format for your convenience.
Next Page »
|
| |
