Apple’s iCloud IAM Challenges – Does Match Need ABAC?

I swear this is not just a hit grab. I know that’s what I think every time I see someone write about Apple. But the other day I was clearing off files from the family computer where we store all the music and videos and such because the disk space is getting tight. I’ve been holding off upgrading or getting more storage thinking that iCloud, Amazon Cloud Drive, or even the rumored gDrive may save me the trouble. So the research began. Most of it focused on features that are tangent to IAM. But Apple’s proposed “iTunes Match” got me thinking about how they would work out the kinks from an access standpoint in many use cases. If you don’t feel like reading about it, the sketch of what it will be is you have iTunes run a “match” on all the music you have you did *not* get from Apple and it will then allow you to have access to the copies Apple already has of those tracks on their servers at their high quality bit rate via iCould instead of having to upload them.

iTunes Match fiddled with by me.

All the string matching levels of h3ll this old perl hacker thought of immediately aside, it became clear that they were going to use the existence of the file in your library as a token to access a copy of the same song in theirs. Now, my intent is to use this as a backup as well as a convenience. So maybe I’m not their prime focus. But a number of access questions became clear to me. What happens if I lose the local copy of a matched song? If I had it at one time does that establish a token or set some attribute on their end that ensures I can get it again? Since they have likely got a higher quality copy, do I have to pay them a difference? I had to do that with all the older songs I got from iTunes for the MP3 DRM free versions, why not this? Of course, if the lost local copy means that I can no longer have access to the iCloud copy, then this cannot act as a backup. So that would kill it for me.

But these problems have bigger weight for Apple than users not choosing them for backup features. There is a legal elephant in the room. How can Apple be sure they are not getting the music industry to grant access to high quality, completely legit copies of tracks in exchange for the presence of tracks that were illegally downloaded? In an industry supported by people paying for software, I’m always shocked at how lonely I am when I say my entire music collection is legal – or, at least, as legal as it is to rip songs from CDs for about 40% of the bulk of it. It’s one thing for a cloud provider to say “here’s a disk, upload what you like. And over here in this legal clean room is a music player that could, if you want, play music that may be on your drive.” But Apple is drawing a direct connection between having a track and granting permissions to a completely different track. Then pile on a use case where some joker who has the worst collection of quadruple compressed tracks downloaded from Napster when he was 12 and pours coffee on his hard drive the day after iTunes Match gave him access to 256 Kbps version of all his favorite tunes.

If this were a corporate client I was talking to, I’d be talking about the right workflow and access certification to jump these hurdles. Can you picture the iTunes dialog box telling you that your music request is being approved? That would be very popular with end users…

OBVIOUSLY Fake iTunes Dialog Box (please don't sue me)

What I learned at @kuppingercole’s #EIC11: #identity #IAM #privacy and secrets

I must admit to being very selfish at this year’s EIC. Instead of going to the sessions that would likely have been most useful to Quest, I went to those that spoke most strongly to my own curiosities. The first thing I did was explore how vendors, users, and analysts feel about standards. It seems like it’s a chicken and egg subject – still. Users wait for vendors to adopt standards. Vendors wait for users and analysts to put force behind them. And in the mean time, only obvious success (SAML) and obvious need (XACML) seem to get standards investment and attention. The most interesting moment of this leg of the journey was when @OASISopen‘s Dr. Laurent Liscia asked from the keynote stage how many people in the audience were vendors to “make sure we’re not talking to ourselves.” Apparently we weren’t, but it was an interesting glimpse into how the whole notion is perceived even by those most dedicated to that cause of standards.

I also went to an absolutely fascinating deep dive into EU privacy and data protection law, which was hosted by Dr. Jörg Hladjk of Hunton & Williams LLP. Perhaps the most interesting thing I walked away with was a new sense of how fragile these protections really are. I think people in the US tend to think about these laws as being very intimidating and forceful. But that likely comes from the vastly complicated contract, audit, and procedure (paperwork) that is needed to deal with the laws. However, two shocking things became clear over the course of the day. First, any reasonable legal basis can be used as a basis to get at the data. A person can sign away all the protection in a single stroke – as anyone who agreed to the terms to get an iPhone in the EU has done in some part. And, because the framework is so much more comprehensive, things like a EULA, which is routinely cast aside in US cases since it’s seen as so flimsy, is much more forceful in the EU since the user is deemed to be so much better informed and protected by the framework. Second, there are cases where protections in the US are stronger than in the EU. A good example is when it comes to breech notification, where a data steward is forced to notify you of some event that may have compromised your PII. It seems that between NSTIC, efforts at the state level (like California’s new proposed “social media” law), and other things in the works, the US may actually come out ahead of the game in a practical sense within the decade.

The last lesson was a pleasant surprise: nearly all identity minded people are closet philosophers. Anyone reading this is likely to know my undergraduate (and only) degree is in philosophy, and perhaps also that I still indulge that impulse heavily as often as I can. Dr. Emilio Mordini, CEO of the Centre for Science, Society and Citizenship (CSSC), gave a keynote on the nature of secrets that was a HUGE hit. Not to say everyone agreed with all his views. In fact, @NishantK and @ggebel both took shots at his ideas from the same keynote stage later. The idea that drew the most criticism was Dr. Mordini’s very unpopular conclusion that one shouldn’t worry about securing data, but rather tracking data. He feels it’s less important to worry about keeping a secret than keeping track of who knows the secret. All of this flows from his central thesis that all secrets are Pulcinella secrets – not really secrets but rather, like a secret in a small town, something everyone knows but no one says so long as the parties involved have the power to motivate everyone to not say it in the town square. Tim Cole goes into all the details of the Pulcinella story on his own blog. The truth of all of it is left as an exercise for the reader. But the thing that made me happy was the abstract conversations in the hallways and bars for the rest of the conference as everyone digested the deeply interesting issues that were raised and what they meant in our shared context of identity, access, privacy, and technology.

Policy Translation – The Art of Access Control Transcends RBAC, ABAC, etc.

After some holidays, lots of internal meetings, and some insane travel schedules, things are settling back down this week just in time for me to head to TEC. So I can get back to spending time with Quest’s customers, partners, and having great discussions with people. In the last week, I had three excellent conversations, one with a panel of folks moderated by Martin Kuppinger from Kuppinger & Cole set up by ETM [link to podcast site], another with Don Jones and an audience of folks asking questions set up by redmondmag.com [link to webcast], and the third just today with Randy Franklin Smith [link to webinar site]. All these discussions revolved around managing identity (of course); they focused on the business’s view of IAM, wrapping proper security controls around Active Directory, and controlling privileged user access, respectively. Even though the subjects seemed quite far apart, a common question emerged: how do you translate the policy the business has in mind (or the auditor has in mind) into something actionable which can be enforced through a technical control? Put another way, the problem is how to take wishes expressed in business terms and make the come true with technology. To me, this is the central question in the IAM world. We have many ways to enforce controls, many ways to create compound rules, many ways to record and manage policies. But the jump from a policy to a rule is the tricky bit.

Let’s take an example and see what we can do with it. Everyone in the US and many around the world know SOX, and most that know it are familiar with section 404. There is a great wikipedia article about SOX section 404 if you want to brush up. Section 404 makes the statement that it is “the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting.” While this makes sense, it’s hardly actionable. And businesses in the US have relied on many layers of committees and associations to distill this. What is that process? It’s lawyers and similarly minded folks figuring out what executives can be charged for if they don’t do things correctly in the face of vague statements like the one above. So they come up with less and less vague statements until they have something they feel is actionable. Of course, what they feel is actionable and what some specific IT department sees as actionable may be quite different.

From the filtering at the high levels of the interbusiness activities you get a statement like “Understand the flow of transactions, including IT aspects, sufficient enough to identify points at which a misstatement could arise,” which comes from the work done by the SEC and POCAB to interpret SOX section 404. That approaches something IT can dig into, but it’s hardly actionable as is. But now a business can take that, bring it inside the organization, and have their executive management and IT work out what it means to them. Of course, there are scads of consultancies, vendors, and others who would love to assist there. Your results may vary when it comes to those folks, or your own folks, being able to make these statements more or less actionable. With this specific statement about the “flow” of data and not allowing “misstatement” to arise, there is general agreement that having IT staff with administrative powers that could, in theory, alter financial data is a risk that needs to have a control. And from that general agreement has risen an entire market for privileged access management products that allow you to restrict people who need administrative rights to do operational tasks in IT infrastructure from using those rights to somehow change data that would be used in any kind of financial reporting (or use that access to do any number of other things covered by other sections of SOX or other regulations like PCI, etc.).

What should be apparent is that things like RBAC, ABAC, and rules based approaches to access control are all simple and straightforward when compared to taking policy and making it actionable. Putting an RBAC system into place is taking action. But, as anyone who has been through an RBAC roll out will tell you, the hardest bit is figuring out the roles. And figuring out the roles is all about interpreting policies. So what is the answer for all those folks on these webcasts who wanted to know how to master this art? The short answer is like the old joke about how you get to Carnegie Hall: practice. The medium length answer is to find a consultancy and a vendor that you trust and that have had the right amount of practice and make them do it for you. The long answer is to follow the path I took above trying to explain the question. You need to analyze the requirements, break them down, and keep doing that until you start getting statements that look slightly actionable. Of course, that takes a huge amount of resources, as evidenced by all the money that’s been spent on SOX alone in the US (that same wikipedia article quotes one study that says the cost may have been 1.7 trillion USD). And the final trick is to take your actions and breakdowns back to the top, your auditor or CISO or whomever started the chain, and validate them. That’s a step that gets skipped all too often. And then you see million dollar projects fail with one stroke of an auditor’s pen.

Identity Myth: SSO is Hard; Truth: Old Apps Suck

I sat down with a very smart group of folks and they were saying how they think SSO is very, very hard. If your world is all Active Directory (AD), it’s easy. But that is true in a tiny percent of the world. Everywhere there is some odd ball application and in most places there are just as many applications not using AD as there are using it (even if they buy Quest solutions, sadly). The cloud, something everyone is forced to mention in every tech blog post, also complicates this. How do you do SSO when the identities aren’t under your control? Or, reverse that, how do you get SSO from your cloud vendor when your on premise applications aren’t under their control? But every time I have the SSO conversation at length with people the conclusion is always the same. If all you have are applications from the last 10 years and some cloud stuff, there are approaches, including Quest’s, that can fully solve that problem. You can integrate into your commodity AD authentication, put up SSO portals, or use widely adopted standards like SAML – or all of the above in a clever combination. Even thick client GUI applications can be tamed with enterprise SSO (ESSO) solutions at the desktop. The things that always end up falling through all the cracks are older applications. Things that are often the crown jewels of the business. Applications that are so old because they are so critical that no one can touch them without huge impact to the business. But the older technologies resist almost every attempt to bring them under control. Even ESSO, which is the catch all for so many other laggards, can’t tame many of the odd green screens, complex multi field authentications, or other odd things that some of these applications demand at the login event. When I’ve spoken to our SSO customers, they always seem happy with 70-80% adoption on their SSO projects. They know they will never get that last group until the applications change. But there doesn’t seem to be any compelling event for those applications to be changed. So SSO continues to seem hard, but we all know that’s not exactly true.

2010 #GartnerIAM – the rise of identity intelligence

If you attended Gartner’s IAM Summit in San Diego last week, you may have a few lumps on your head. They’re from being beaten over the head with the identity intelligence stick. Earl Perkins led a charge up the slope of business importance for identity management that hopes to secure it a place in the highest levels of business intelligence and decision support. I’m all for it. One thing that was said on stage more than once was that if the IAM professionals of the world keep concentrating their efforts on plumbing like provisioning connectors they are going to be out of a job as vendors make those bits of pipe commodity. A bit melodramatic, but not entirely untrue. But what didn’t float down from the high minded discussion on stage was a clear set of examples for this identity intelligence. Even in the final session of the conference’s second day, the audience was asking in several forms for the panel of analysts to give some clear use cases. And in the very last session folks commented that they felt like most of this intelligence stuff was too high minded to use in practice. Of course, it’s not really fair to ask for all that. Partly because it’s not the place of the analysts to put things into a final form and partially because it breaks their business model to give you the whole picture in the conference. The conference is that start of a process they would like to draw you into – a process the people who can’t see it all clearly probably need more than those who can.

I think intelligence, on every level of IT and security and especially in the world of IAM, is poised to make a big impact. It only makes sense. The technology is there to do it. Intelligence is all about saving time and effort, which means saving money. There is no better time for money saving ideas than right now. Some in the hallways were very unconvinced. But it reminded me of the quote from Gandhi: “First they ignore you, then they ridicule you, then they fight you, then you win.” I’d say the majority of the people in the halls were somewhere between the ignoring and the ridiculing. Few seemed prepared to fight. And just a handful came by the Quest booth asking about that label “Identity Intelligence” on our signs like it was a good thing. We’ll be rolling out our vision of a way to apply intelligence to IAM soon enough. And the idea that there is too much emphasis on plumbing is exactly the right mindset. Those seeking use cases really ought to look in the pantheon of classics. Because intelligence won’t be about doing different things in most cases. It will be about doing the same things in a better way. Intelligence will also deliver on goals in IAM project plans that, in the past, seldom became reality.

Not every session was focused on the intelligence theme. The sessions with Bob Blakley and Lori Rowland were much more practical, of course, having the Burton Group spin to them. My personal favorite session was one presented by Perry Carpenter called “Innovative Plumbing: Five Out-of-the-Box Ideas for Leveraging Your IAM Investment in Unexpected Ways“. Perry took the audience through some counter-intuitive sounding pieces of advice that were very practical. You can get the slides online, but the gist of the list was this:

• use a virtual directory for easier migrations & application development
• use ESSO usage statistics to provide BI/DSS for roles & provisioning
• save on cost with identity graveyard outside directories where you’re paying per user fees
• use your web proxy to deliver policy detail that explains effects of bad behavior like malware just in time as users commit out of policy offenses

All of it is sound advice. It all stresses something we don’t hear enough in IAM – KISS (keep it simple stupid).

Administration of identity & access must level up due to cloud.

First of all, I’ll define what I mean by cloud in 10 words: cloud is outsourcing some layer of services from you infrastructure. This thought comes after meeting a large healthcare organization that’s putting their “back office” operations in an MSP. This is having a significant impact on how they are viewing administration of IT. When you own operations and administration, you can easily blend the two. If you have an administrative issue that would be made easier by shifting something about the operations of your IT resources, you do it. But when operations is a black box, then you actually have to make your administration solve all your challenges. That is new for many.

This organization is putting most of the non-clinical systems in an MSP, or in the cloud if you prefer, and that means there are many IAM challenges. Where do accounts originate? Who controls the authoritative data about users? Because so many clinical and other applications require it, they are keeping much of the directory infrastructure in house. How do changes flow in both directions when there are automated process and human admins and operators on both sides? How can all the changes from both ends be tracked? How can the state, the changes and the policies be kept in line with regulatory requirements? It’s a daunting set of challenges.

Right now they have their hands full just making it all happen. And they have plenty of parties (each site, the central IT organization, various consulting organizations, all the vendors) that are all involved in the project as it’s ongoing. When I sat down with them and many of these parties, it was hard enough just playing catch up to see who was responsible for what. We were there to discuss many of the pains they are experiencing in the phase they are in now and where Quest can help. What I immediately started to envision were the pains of the next phase. I think Quest can help with those, too, but I’m hoping they were receptive to my suggestions about it all. My basic message was that they are going to have to arm their administrators with a new kind of toolset and those administrators were going to have to have a new, leveled up approach. They were going to have to think less like technologists and more like data architects. What will matter most going forward is having very sound and robust models for data, policies and processes. Otherwise they would fall back into old ways of thinking and likely find themselves without the ability to make those level of changes to the MSP hosted systems. Or, even worse, waste time fighting with the MSP to change operational details – a fight where they finance both sides of the battle and take both sides’ losses as well.

real time risk for IT operations and business process

Unless you’re living in a tech cocoon, you’ve seen the google real time search buzz (no pun intended). What I immediately envisioned was a system where you could have the same type of feedback for your actions, but applied to operation of IT and business interactions with IT managed resources. As one article I read wisely noted:

The reason this is a game changer is feedback. When you get feedback, you change your behaviors. Think about it. When you push a door and it doesn’t open quickly, you push harder. When you try to drive a car up a hill and it doesn’t go as fast as you would like, you step on the gas. Feedback changes your behavior.

The emphasis is mine. I’m thinking about a system where an administrator who wants to put a new statistic on a dashboard, a statistic drawn from the monitoring systems they have in place, may hit the button to do so and get a message stating that if she does it it will result in the following enterprise roles seeing this statistic. If the statistic reveals data that is not appropriate for all those roles it may immediately give the administrator pause. The proper remediation may be to examine what roles have been associated with those dashboard resources, or perhaps to examine who is associated with those roles in more detail. But that feedback would surly have some effect on how the administrator decides to do their work.

That would be a very cool thing indeed.

a new SPML? a provisioning problem.

Mark Diodati of Gartner (that was a bit hard to type right the first time) has published the results of the SPML SIG held at #cat10. I think it captures the feeling of those present very well. At about the same time the minutes of the first meeting of the SPML PSTC for a long while were published. It seems there’s a much different split there than there was at the SIG. The split is basically between folks who want to see a “clean start” with a version 3 and those who want to see version 2 revved so it’s more realistic. I’m on the latter side, and so are the folks at Quest that I’ve spoken to. In fact, both and Quest and at customers, everyone I’ve spoken to about this outside a tight circle of “identity gurus” have all agreed that SPML would best serve the larger community as means to have systems communicate. Anything beyond that is overkill. At least for now. If all the different solutions had a standard way to do CRUD operations between one another, that would go a long way to solving many practical issues in heterogeneous IT environments.

I’d like to get more involved and I’m working with Quest to see if that can happen. This is something I’d like to see done from start to end.

BF8XDEVU8PDS This is here for Technorati. If you’re seeing it it’s because you’re reading this content somewhere besides my blog site and I couldn’t hide it from you. Sorry =]

ghosts of the interscaler directory at #cat10; let’s do it!

There were a lot of points at Catalyst 2010 where Kim Cameron’s Interscaler, Federated Directory and Identity Schema came up in my mind, though went unmentioned by the speakers. I know I wasn’t alone, either. It was there like a ghost in every discussion. When Anil John spoke about Background Attribute Exchange (BAE), one of the first questions was about how to ensure schemas would be in sync. When Nishant Kaushik spoke about federated provisioning, again questions had everyone talking about how directories would be able to rely on attributes being “exchangeable” across domains. And when the folks from GM gave their talk the second or third question was about how they decided what attributes would be included in their avatar identities and which would not.

How does this move forward? I get dizzy when I look at all the standards bodies around identity. I’ve got a lot of energy to offer around this and don’t know where to push it. It’s not about a product or a vendor. I’d like to see this be an industry thing that everyone can benefit from.

mii parade – identities go marching at #cat10

I’ve just returned from Gartner/Burton’s Catalyst 2010 in San Diego (“just” returned when I wrote the first draft, not so much now that I’m finally getting to edit and post…). One of the sessions (Wednesday morning in the identity track) featured GM presenting about their fairly advanced and very well thought out identity management processes and platforms. They had a very mature outlook on what the real sources are for identity and how to empower the business to leverage the value of those identities over time and through the lifecycle.

Perhaps the best example of that was how they manage identities that are not really fully baked, management of avatars. The presenter from GM made a great analogy to explain this. He talked about the Mii parade from the Wii. If your not a Wii person, this needs a bit of context. On the Wii you have an avatar called a Mii. In many games that Mii is what you see on the screen to represent you. Since the Wii is designed to be multi player, you can of course have many Mii’s on a system. Apparently his daughters are just like mine. They make a Mii for every kid that shows up at their home; mine even make them for characters in books and people they meet away from home. What use is the Mii if there is no one to play as them? In some parts of some games, there are parades and other places where crowds appear. And these Mii’s, played with or not, show up on those crowds.

GM will make an identity for anyone that comes to their facilities, even going as far to assign them a unique identifier. If that person eventually ends up as a contractor, then they will retain that identity. If they become an employee, they keep the same identity. And if they leave, the identity is still maintained. They also do similar things for what they termed “people of interest”. These are people like an employee’s spouse, who would be in some systems to receive benefits and there for have one of these avatars or half-baked identities. So, with all these avatars in their systems, when they go through to do large reports and such, they end up with a Mii parade with all these avatars that are not users as such showing up in the crowds.

This struck me as being deeply right. Most organizations want to reduce the identities they have at all costs. But identities are data, and data has value. Of course, Quest and I are fans of reducing accounts and points of access, but that’s quite different. This is about having many singular identities that can be used to fill out your Mii parade so that it acts and feels as real as possible. The rich context can only lead to better and fuller business decisions over time.

For those of you who made it down this far, here’s a sample of what a Mii parade can be like when you just tell the Wii to have all the Mii’s go marching: