Identity as an unpatched device

So I am sitting here at the Internet Identity Workshop and so far, I’ve been impressed with the quality of the presenter. (I’ll have more on that later.)

I was chatting with Dale Olds from Novell and came across the following thoughts. With the rise of the empowered user, as Doc Searls speaks of, we may be facing a major downside. These concepts of user-centric identity are great… if the user actively manages their identity. What happens when this empowered user isn’t actively managing his or her identity? It seems to me that an inactive empowered user’s identity is equivalent to an unpatched Windows machine. Without actively managing my identity, it becomes a great target for not nice people to do not nice things.

If we elevate identity to the same status as a domain or device, then we elevate the responsibility of the identity owners. I, as an identity owner, have to maintain that identity: update privacy choices, update demographics, geographic information, etc. I would say that maybe, just maybe, 5% of the overall web population actively maintain their identities. My grandparents, for example, are not part of that 5%. So of the nearly 1 billion web users out there, there are literally hundreds of millions of identities which will not be actively maintained. An unmaintained identity is a prime target for not nice people just as an unpatched machine is a prime target.

Will unmaintained identities become weedy vacant lots in the city of the web in which nefarious types can use to their own ends? I think so.

Which means:

  • the default settings for empowered users matter. But who creates these defaults? Communities? Governments? Insurance companies?
  • the tooling for maintaining my identity must be usable by my grandparents. We must not expose the underlying data model to the end user. We have to present identity and identity-related preferences in a way that the most basic users can understand.
  • there needs to be a way to remain un-empowered. There will be a majority of users who do not want to have to actively manage their identity. These people will not manage their identities and those identities, left unmanaged, will be perfect targets for phraud and other identity crimes.
  • we as an industry have a lot more work to do.

Technorati Tag:

If you meet your identity on the Internet, kill it

Thinking of that Buddhist koan, “If you meet the Buddha on the road, kill him,” I realized it is relevant for identities as well.

If you met your identity, would you recognize it?
When I register at a site I usually use the same username. It helps keep the catalog of things I have to remember to a manageable number. I always get concerned when my choice in username is taken. My first thought is, have I been here before? Did I already register? If so, “who” did I register as? I start scouring through offline emails trying to figure out if I saved the registration notice. 9 times out of 10, I haven’t. The next option is hoping that the Keychain or Password Manager grab the credentials for me. If the site’s login didn’t get prepopulated there’s little chance either repository of has what I need. This leads me to the annoying process of having to register with a different username which I am definitely bound to forget.

The first problem is that recognize my identity based on a login on a site. This is clearly a weak way to link me to the services I want to access on that site.

If you don’t meet your identity, how would you know it?
The following just happened to me. I went to a site to order some software. I know that I’ve used this site before. I know that I have ordered things from them before. But for the life of me cannot remember “who” I registered as. In this case, the site uses email address as identity. The problem is I have multiple email address, some of which changed over time due to takeover, domain changes, etc. I can search my old emails, Keychain, Password Manager, etc, but I am still left with little to go on to figure out who I registered as. In this case, I can try and use a “Forgot your username / password” service, if the site has it. But what if I am mistaken and, in fact, I have never used the site before?

The second problem is that my catalog of registered identities is limited, if it exists at all. Worse yet, that catalog is spread across multiple machines both personal and work issued.

How do you kill your identity?
I know I have registered at dozens of sites over the years. Some, I’m sure, don’t even exist any more. But those that do have some little piece of my identity information on them. At the very least, they contribute to some of the spam that heads my way every day. I just don’t like the idea that I am not in control of the places my identity lives. Now, I grant you, if I was that concerned I would have kept better records about where I registered and “who” I registered as. The problem is five, eight, ten years ago we simply didn’t have the problems we have now. (Amazingly though, the oldest account I can think of that I have, my CDNow account, did morph into my Amazon account. Let’s hear it for good customer identity management on Amazon’s part.)

Quick quiz, how many sites that you frequent let you delete your identity? I think I may have seen one or two in all the sites I have been too. The third problem is there is not a common facility for tracking and deleting an old identity.

And that leaves me where exactly?
I don’t have a reliable and complete catalog of my identities. I don’t have a way to discover my registered identity from a given site. And even if I did have a catalog and could find identities I forgot about, I couldn’t prune old identities I no longer wanted out there.

To some extent this problem has been solved within the enterprise. Identity Management vendors can maintain the catalog of my identities and can prune of identities as necessary. Those solutions, however, will either not work on the Internet-scale or will not be accepted by end users. We tried to building something like this at Access360 with out Access360.net offering, but that flopped horribly and completely. My gut tells me the solution is more along the lines of Identity 2.0. I can’t wait for the Internet Identity Workshop next week to hear people’s thought on problems like these.

Technorati Tag:

Being proactive without acting

After reading about the latest round of attacks against DoD and other government computers, I started thinking about the defensive, reactive nature of security world. Vendors are consistently on their heels trying to catch up with hackers and crackers. Consumers are consistently running behind vendors trying to deploy security patches, let alone adopt security-based best practices in their own applications. Yes, there are more proactive solutions, especially at the network level, but its safe to say that the computing world has yet to achieve a complete proactive stance when it comes to security.

Being proactive is hard. As a vendor, there is so much you can do to stay head of the curve, making sure that your code is a well behaved as possible. As a consumer, you are beholden to both the vendor-world as well as the particulars of your organization in terms of rolling out patches and new technology.

We, as an industry, have to make sure that there are security functions at every layer of our customer solutions. But more than that, those functions have to be able to act in concert. They have to be able to be monitored and audited in a more holistic manner. I feel that an Identity Metasystem is part and parcel to this. We owe it our customers to create a computing world which is security proactive on its own, freeing the customer to focus on their day to day business.

Shadows of Identity

I was trying to find a way to describe the greater discipline of identity management to a coworker. Because of all the terminology collisions out there, coming up with clear description wasn’t easy. The following is a riff on Plato’s Allegory of a Cave and Kim Cameron’s 4th Law of Identity – Directed Identity.

Consider that you are standing in a large room which represents the world in which your identity can be represented. In front of you are a series of three dimensional figures called targets. These targets come in a variety of shapes and sizes. Behind you are a series of lights. When a light is switched on, it projects your shadow onto one of the targets. These targets are coated with a special substance that locks your shadow onto the surface. Because of the shape and irregularities of the targets, your shadow does not look the same on every target. Furthermore, your shadow looks more like you on some targets than others. These targets are different systems that represent your identity in one way or another. Active Directory is a fairly regular shape, thus your shadow on this target looks a lot like you. I picture the Active Directory target as a convex lens. A biometric system is an irregular shape full of nooks and crannies, thus it’s extremely hard to tell that the shadow is yours. I picture a biometric system target as a spiky blob of some sort.

First Thought: The more your shadow looks like you the more target must be guarded.

High fidelity targets, those that keep a shadow that looks more like you, have to be protected differently than those that keep a shadow that looks nothing like you. It is easier to pull the “you-ness” out of Active Directory than it is from a biometric system. If an evil force wanted reconstructed a facsimile of you, it would try and steal the targets that have these high fidelity shadows. If the shadows are representative of you, then what are the lights? The lights are contexts in which you will interact with the target. The Everyday-Use Light projects your shadow on the Active Directory target. The Super-Secret-Job-Function Light projects your shadows onto the homegrown Oracle application target, and so on. Different lights can project onto the same target. This means that your shadow on a given target may actually be a composite of multiple lights shining on you. This leads to…

Second Thought: On an individual basis, you cannot determine which lights created your shadow on a given target.

If you examine your (composite) shadow on the SAP target (SAP being one of those fairly regular shapes), you cannot be sure which of the lights helped to create the shadow. To be completely sure of how your shadow was created, the target has to tell you. Yes, you can gather a large number of people and their targets (do some math) and come up with an approximation of which lights are needed and how they create which shadows. But, this is only an approximation. So where do all these Identity Management products fit in? Provisioning tools provide the lights. They project some aspect of your identity onto targets. They know how to map your shadow onto the three dimensional surface of the target. This is parallel to the idea of unidirectional identity beacons. Meta-directories can act in two ways. First, they can act as a pocket flashlight: they can help project a piece of your shadow. Meta-directories know how to map your shadow onto targets, but they are less frequently used to project all of your “you-ness” onto every target. Second, they can be used to create a doppelganger: they attempt to reconstruct you by gathering and examining all your shadows. Virtual Directories work in much the same way, but instead of creating your doppelganger, they attempt to create a high fidelity shadow from the collection of targets. This leads to…

Third Thought: Although Provisioning (and Meta-directory) tools can map your shadow onto a target, they have a harder time working in reverse.

Most Provisioning tools work by constructing and turning on the lights. Yes, Provisioning tools can correlate your shadow to you, but they have a hard time going further than that. They struggle with (given your shadow) determining which contexts of use, which lights created the shadow.

Before this post starts sounding like dialog from Ghost in the Shell, I’ll draw this to a close. I leave you with a question that has been rolling around in my head – From an enterprise perspective which is more important: the lights, you, or the targets?