| |
 Subscribe in a RSS reader • Subscribe via Email
March News Round-Up
Catch the round up of recent updates from Kantara Initiative:
- Featuring Paul Trevithick, co-founder and co-chair of the Universal Login Experience (ULX) WG
- Announcing leadership of Kantara Initiative Work Groups: Consumer Identity WG, P3WG, Healthcare Identity Assurance WG, IdP Selection WG, Telecommunications Identity WG
- Public workshop: Making the world safe for user-managed access at EIC, May 4, Munich
- Kantara Initiative’s RSA Security Pre-Conference Workshop, March 1 2010
- A round up of work from DG/WGs at the recent Kantara Initiative Conference in Oregon: Concordia, eGov, IdP Selection, ID-WSF Evo, TelCo ID, UMA
- Identity Assurance, an everyday life issue – articles from the IA WG Chair
- Concordia DG Authz and LOA Surveys
- Executive Director Search: Job Description
- Identity Matters: eGovernment
- Kantara Initiative’s UMA WG webinar: UMA explained – listen and watch the recording
- Identity Matters: User Managed Access
- Announcing Government of Canada Consultation on Cyber Authentication
- Identity Assurance WG testimony to Health IT Committee and NHIN
- Industry events – contact Dervla O’Reilly regarding discounted conference rates: Gartner Security & Risk Management Summit June 21-23 Maryland, Hacker Halted October 9-15 Miami, WHIT 6.0 Nov. 8-10 Washington D.C., Gartner Identity & Access Management Summit November 15-16 San Diego
Subscribe in a RSS reader • Subscribe via Email
Announcing leadership of Kantara Initiative’s Telecommunications Identity WG (TI WG)
Congratulations to Jonas Hogberg of Ericsson, Gael Gourmelen of Orange-FT and Jose Luis Mariz of Ericsson.
All three gentlemen will serve as co-leading chairs for Kantara Initiative’s Telecommunications Identity WG (TI WG). As co-leading chairs, they received a majority of WG voting participants with all votes in favor of their appointment. The TI WG work has transitioned from Liberty Alliance’s TelCo SIG – we look forward to the continued work to come.
Subscribe in a RSS reader • Subscribe via Email
Featuring Paul Trevithick co-founder and co-chair of Kantara Initiative’s ULX WG
In 2009 Paul Trevithick co-founded and began co-chairing the Kantara Initiative’s Universal Login User Experience Working Group (ULX WG) alongside Bob Morgan, Internet2 and Michael Graves, JanRain/OIDF.
The Universal Login User Experience Working Group (ULX WG) looks at the Universal Login Experience – we all know how to sign in to a site using username and password. But what if the site also wants to offer SAML, OpenID, or Infocard? Or all three! What’s the experience then? How can we make this understandable and measurably workable by mere mortals? What’ the UX with and without an active client? We’re trying to answer questions like these. Lots of details like, is the button that kicks this off called “log in”, “sign in” or “connect”? Find out more here, sign up for the group here.
Paul Trevithick is also the co-founder, with John Clippinger, of Parity Communications, now Azigo, and has served as its CEO and CTO since 2003. He initiated and is the technical leader of the work that is now the Eclipse Foundation‘s Higgins project. Supporting this effort, he also co-founded SocialPhysics.org, IdentityGang.org, IdentitySchemas.org. In 2008 Paul founded the Information Card Foundation and is currently its chair.
Since 2003, Paul’s work has focused on creating open source identity infrastructure that give people more control, convenience, and privacy with respect to their digital identities and social networks on the internet. A key focus has been the development of active client software. He co-authored the paper Identity and Resilience that was one of the 100 papers cited as informing the 2009 White House CyberPolicy Review.
Follow Paul blogs at InContext
Subscribe in a RSS reader • Subscribe via Email
Kantara Initiative Public Workshop: Making the World Safe for User-Managed Access
Join us for the Kantara Initiative Public Workshop: Making the World Safe for User-Managed Access managed by Eve Maler, PayPal Inc. at the European Identity Conference 2010, Munich, Germany.
When: Tuesday, May 4, 2010, 09:00-13:00
Where: European Identity Conference 2010, Munich, Germany
Description: To get useful service at many websites, we’re forced to “hand over the data” — data that’s sensitive, valuable, and personal — and we end up paying a price in both privacy and convenience. The new User-Managed Access web protocol promises to help web users share their data more selectively using a central digital footprint dashboard, while helping websites get access to fresher and better-quality data when they need it. This workshop will review UMA benefits, use cases, progress to date, and next steps.
You can register for this free workshop independently from EIC & CLOUD registration. If you are registering for the EIC or CLOUD Conference, you do not need to register separately for the workshop as the conference registration process will as you about the workshop. Find out more about the week-long Conference agenda here.
Subscribe in a RSS reader • Subscribe via Email
Gov of Canada RFI – Cyber Authentication Renewal
The Government of Canada announced a Request For Information, titled “RFI – Secure Channel”, including a call for Accrediting External Credential Service Providers. As can be read from their release below, they are interested in the Kantara Initiative Service Assessment Criterion and Assurance Assessment Scheme and the related supporting Kantara Initiative Assurance Accreditation and Certification Program.
Respond to the RFI:
Request for Information – Cyber Authentication Renewal
Accrediting External Credential Service Providers
March 11, 2010
Industry consultations on Cyber Authentication Renewal and IT Security Services were held on February 16 and 17, 2010, with Public Works and Government Services Canada (PWGSC) and Treasury Board Secretariat. Following that consultation session, the Government of Canada (GC) would like to inform private-sector organizations that a Request for Information (RFI) on Accrediting External Credential Service Providers is now available on MERX at this link.
The GC is investigating solutions that would allow individuals the option of using their existing credentials in order to gain online access to government programs and services. This proposed approach would provide flexibility to both departments and agencies, and to individuals who access GC services. It would allow departments and agencies to use credentials that are appropriate to the sensitivity of their service offerings, while allowing individuals to choose the credential they wish to use to access any online GC services.
The GC is considering asking external credential service providers to join its credential federation, with an accreditation framework based initially on the Kantara Initiative‘s Service Assessment Criterion and Assurance Assessment Scheme.
Industry organizations are invited to participate in this RFI in order to validate and refine the GC’s approach to electronic authentication and to provide additional information on how to solicit and accredit external credential service providers using a federated model.
Demande d’information – Le renouvellement de l’authentification électronique
Accréditation des fournisseurs externes de justificatifs d’identité
11 mars 2010
Les consultations avec l’industrie à propos du renouvellement de l’authentification électronique et les services de sécurité de TI ont eux lieux les 16 et 17 février dernier avec Travaux publics et services gouvernementaux (TPSGC) et le Secrétariat du Conseil du trésor (SCT). Afin de donner suite aux séances de consultation, le gouvernement du Canada (GC) désire informer les organisations du secteur privé qu’une demande d’information (DDI) au sujet de l’accréditation des fournisseurs externes de justificatifs d’identité est maintenant disponible sur MERX, au lien suivant.
Le GC est à la recherche de solutions qui offriraient aux utilisateurs la possibilité d’utiliser leurs justificatifs d’identité existant afin d’accéder à des services et à des programmes gouvernementaux en ligne. Cette approche proposée offrirait une plus grande flexibilité aux ministères, aux organismes et aux utilisateurs. Elle permettrait aux ministères et aux organismes d’utiliser les justificatifs d’identité appropriés en fonction de la sensibilité des services offerts tout en permettant aux utilisateurs de choisir le justificatif d’identité qu’ils veulent utiliser pour accéder à tous les services gouvernementaux en ligne.
Le gouvernement du Canada envisage de demander aux fournisseurs de justificatifs de joindre sa fédération d’authentifiant avec cadre d’accréditation basée initialement sur les Service Assessment Criterion (critères d’évaluation de service) et l’Assurance Assessment Scheme (programme d’évaluation de l’assurance) de l’initiative Kantara.
Les organisations de l’industrie sont invitées à participer à cette DDI dans le but de valider et de raffiner l’approche du gouvernement du Canada à l’égard de l’authentification électronique et de fournir des renseignements sur la manière de solliciter et d’accréditer les fournisseurs externes de services de justificatifs en utilisant un modèle fédéré.
Subscribe in a RSS reader • Subscribe via Email
Reporting From RSA 2010: Identity, Health Care, and a Higher Realm of Credentials
Written by Mike Kirkwood. Read the full article.
This week we are reporting from RSA, the security conference in San Francisco. We’ve seen hackers, threats, and industry leaders roaming these halls – and among these we found leaders of the identity community, people who are thought leaders focused on creating a safe Internet for all individuals.
This includes folks who in the Identity Commons and OASIS workgroups, and the 1-year-old Kantara Initiative. The latter was announced to the public at RSA 2009, and this year it hosted an all-day workshop that brought cloud computing into the forefront of the dialog.
Diverse Community of Interests Coming Together
Today’s all-day workshop offered by the Kantara Initiative focused almost exclusively on identity services and included viewpoints from several perspectives: enterprises (CA, Ping Identity, Aetna, Oracle, HP), service providers (NTT), consumer applications (Paypal, Google), and government agencies (NIH).
The room was packed – standing room only. After the kickoff we had a chance to ask Trent Adams, chair of the Kantara leadership council, to share his thoughts about identity, cloud computing and year one of the new organization.
He talked about the potential big win that existed for the organization because of its involvment in preparing standards for federal government approval. These are in historic times, he said, and embracing openness at the federal level was an opportunity the organization decided was valuable for the community. We’re keeping our ears open to learn more about how identity services will be enabled and approved through the government.
Landscape Change: Cloud Computing Invigorates Identity Efforts
One thing that is clear is that things get more complicated when combining identity services with cloud computing. We were reminded that many of the technologies that have been developed, including things like OpenID and SAML were designed around the same scenarios of sharing across domains. Identity can be solved in a multi-vendor, multi-protocol, and multiple-infrastructure world.
Matthew Gardiner of CA summed the importance of the link between identity solutions and cloud computing in his talk, “Identity as Security Glue for the Cloud”:
“I want to say the phrase cloud security in the first few moments of my talk because you’ll be hearing it a thousand times before the end of the conference. Cloud security can be viewed as a Rubik’s cube of security implications, when identity services and combining them within the vectors of Iaas, PaaS, and SasS combined with private, public, and hybrid clouds.”
The West Coast Perspective on Health Care
 RSA and HIMSS fall on the same week this year. While nearly all of the healthcare IT leadership headed to Atlanta, several companies also came to San Francisco.
Yesterday, MEDecision presented their solution and connections to different Web applications and health care records and systems, and gave a very tangible set of scenarios showing how cloud computing and identity meet around sharing information about a person who is a patient.
At the same time on the East Cost, MEDecision was also at HIMSS demonstrating open exchange of health information in a HIE product offering that helps connect services across providers in order to aggregate a view of an individual. The company offers software and services to insurers to negotiate their cloud-based work flow, including moving private data across pharmacy, doctors, insurers, and the entire health care landscape.
No Passwords in the Cloud
 Patrick Harding of Ping Identity spoke about his company has learn about cloud computing in this session, “How the Cloud is Changing Federated Identity Requirements”. A few of his observations:
- Software is no longer build vs. buy. It now includes subscribe, which by definition is a shorter term relationship.
- Cloud computing is an evolution of architecture. It arrives after Web services, which evolved from Web, client server, and mainframe.
- Complexity of the identity layer is harder than ever for the simple reason that there are more apps per user than ever before.
- Services are becoming any-to-any, where internal (employee) and external (customer) classifications don’t matter nearly as much as before. Because of this firewalls are losing their usefulness.
- Audit is no longer an afterthought. Auditors don’t care how or where applications hosted, but hey do need their reports! This includes Sarbanes-Oxley, HIPAA, Gramm-Leach, Bliley, and more.
A core theme of this session was how the consumer mindset is driving requirements for application experience. Consumers expect it to work on any device, be secure, and be portable. To deliver on this, it must be easy to use. At the same time, password risk must be reduced.
A key trend that Harding pointed out is moving identity systems from “push” models into “pull” models. Instead of updating partners and directories by batch services, companies need to be building real-time identity resolution in applications.
We asked Harding if he had any predictions for where that type of service will come from. His response led us to the conclusion that the leader will be a brand and service that people trust and understand the motivations of. It will likely enter the market from a higher realm of credentials than Twitter or Facebook – perhaps from financial services.
Context is Fundamental: Person, Father, Employee, All of the Above
One thing we learned today is that Google’s App Engine is worth watching as this space evolves. Several interesting things are being done in this sandbox that haven’t been accomplished other places, including how to connect consumer services to enterprise login discovery using domain.
Google has inserted itself into the sweet spot by getting consumers and enterprises alike hooked on their applications, giving the company a unique view of the challenges and solutions in joining identity with cloud computing. We’ll be taking a closer look at these offerings and where Google is headed.
Another thing we observed is the power of the network. NTT gave a demonstration of the power of mixing identity protocols (SAML and OpenID) for the purpose of connecting social, information, and financial transactions in the browser with one login. It starts to show how the next generation Internet might work, where the application requests profile from the cloud rather than a user typing it in.
A summary of overlapping-world-multi-protocol integration has been shared on Google’s site.
Subscribe in a RSS reader • Subscribe via Email
Announcing Liaison with OASIS eGov MS
The Kantara Initiative (KI) and OASIS are pleased to announce that the KI eGov Work Group (WG) and the OASIS eGov Member Section (MS) have established a Liaison relationship.
Scope:
The scope of this liaison relationship is to foster the aligned interests of both groups such that the OASIS eGov MS becomes the first point of contact/filter for works coming out of the KI eGov WG that flow into OASIS Technical Committees (TCs) and other Member Sections. Likewise, the KI eGov WG shall become the first point of KI contact for works flowing out of the OASIS eGov MS. This informal relationship will enable the KI eGov WG and the OASIS eGov MS to build a view of the landscape of identity and access management standards within KI and OASIS that have an ‘eGov’ factor.
The liaison relationship between the KI eGov WG and the OASIS eGov MS is seen as the first of a number of such liaisons. Near-term communications revolve around the eGov Profile v2 work underway, and any impact it might have for the OASIS Security Services TC regarding SAML use in eGov scenarios. Some discussions to this effect have already been raised.
To foster the discussions between the OASIS eGov MS and KI eGov WG, each group will appoint a joint liaison officer and generate a monthly report/update of each other’s activities including pointers to work on the horizon.
The Kantara Initiative and OASIS extend congratulations to both groups on their efforts to foster what will be a meaningful and productive liaison for eGov standards. We look forward to exciting work from both groups.
For more information on how to become involved in the KI eGov WG please visit their home page here http://kantarainitiative.org/confluence/display/eGov
For more information on how to become involved in the OASIS eGov MS please visit this page www.oasis-egov.org/join
Subscribe in a RSS reader • Subscribe via Email
A Windfall for Identity Assurance
On behalf of Frank Villavicencio, chair of the Identity Assurance WG. Also published at Frank Villavicencio’s blog page.
First off, I would like to would like to express my sympathy to those affected by the terrible earthquake that hit Chile this past weekend.
Envio mi palabra de aliento y de optimismo al pueblo Chileno. Tengo muy buenos amigos Chilenos y a todos les deseo lo mejor en vista de estas circunstancias, a sus familias y a todos los afectados… Las cosas de Dios son sin duda alguna indescrifrables.
In this blog post, I would like to share with you some recent developments in the world of identity assurance, which as you know from my recent blog posts: “Identity Assurance, an everyday life issue” part 1 and part 2, is a top of mind issue for me and for us here at Identropy. Quite frankly, I could not hope for better timing for these blogs to come about.
On Friday February 26th, 2010 the US Federal Government’s Identity, Credential, and Access Management (ICAM) Trust Framework Evaluation Team (TFET) reviewed Kantara Initiative‘s latest submission and granted it Provisional Approval as a Trust Framework Provider at Levels 1, 2 & non-crypto Level 3 under the Open Identity Solutions for Open Government program. The removal of the provisional status will hinge on the release by TFET of additional guidance for assessors concerning privacy and Kantara’s adoption of this guidance.
This is for me an extraordinary milestone, not only in my role of Chair of the Identity Assurance Work Group, but as an identity assurance activist altogether. Kantara submitted its application for the US Federal Government adoption of the Identity Assurance Framework (IAF) in November of 2009. Prior to that date, the IAWG has been working very hard, collaborating with Kantara and the Assurance Review Board (who oversees the Kantara Initiative Identity Assurance Certification Program) to achieve this important goal (albeit still under provisional status).
The significance of this milestone is that it represents an important step towards fostering the adoption of identity-enabled Government services at known levels of assurance, relying on identity credentials issued and managed by non-Government parties (referred to as Credential Service Providers in the IAF). It will create the right conditions for the certification program to be adopted in real-life scenarios and for the industry to benefit from a proven, best-of-breed certification program that effectively enables interoperability and trust. This means that the IAF will not be just a “paper” standard, incarnated in a compendium of documents, but an actual technology-agnostic program that organizations can certify against.
With the adoption of risk-based models, identity federation can achieve Internet scale, and facilitate public access to online information at specific levels of assurance. With adoption will also come economies of scale and further collaboration and interoperability across industries and Governments.
As someone who has been involved in identity management and identity assurance for quite some time, I cannot help but feel excited about the times I live in, and optimistic about what is to come.
I do anticipate and hope for more endorsements of the IAF in the near future by other organizations, and more importantly, the start of a paradigm shift in the way we all think about identity, both within the Enterprise and in a federated environment. Ultimately, this path will allow the identerati to focus on the real end goal: delivering identity-enabled solutions and services with the level of trust and confidence that is appropriate for the transactions being performed.
But this is just a first step…
Frank
Subscribe via email
|
|
