Click here to close now.

Welcome!

Cloud Expo Authors: Dan Ristic, Roger Strukhoff, Liz McMillan, Elizabeth White, Kevin Benedict

Related Topics: Cloud Expo, XML, Open Source, Virtualization, Web 2.0, Security

Cloud Expo: Article

Turning Identity-as-a-Service Inside Out

From the perspective of the user, the Cloud should empower us. IDaaS does the opposite.

Simple question with a surprisingly complex answer: who owns your identity? Our first instinct is to insist that we each own our own identities. After all, we are our identities, right?

Not so fast. There are myriad players who own a piece of your identity, from the credit bureaus to your bank to Facebook to your doctor to your employer. Every single one has some kind of identity management system that keeps track of information about you. In fact, this personally identifiable information (PII) is so powerful that when someone steals it, we call that crime identity theft - as though stealing your PII was the equivalent of stealing your very soul.

The reason PII has such power, of course, is because we give it power. Knowing a username and password gives you the power to access a system. Knowing your Social Security Number and birth date may give you the power to get bank account information from a call center rep. Add a bit more knowledge and you have the power to apply for a loan or a job or a security clearance. The old adage states that knowledge is power, but information only has power if we choose to empower it.

From the perspective of IT, managing user identities has long been in our wheelhouse. The Identity and Access Management (IAM) market matured years ago, and all enterprises have a broad set of robust IAM alternatives to choose from. But hey, it's almost 2013, right? Why buy some IAM product I have to install and maintain. Why don't I just get it in the Cloud?

The Problem with Identity-as-a-Service
No brainer, right? Sign up for Identity-as-a-Service (IDaaS), or perhaps call it Identity Management as a Service (IDMaaS) or IAM as a Service (IAMaaS) - the marketplace still hasn't settled on the term - and you can throw away your Active Directory or LDAP. If all your users want to do is access the Software-as-a-Service (SaaS) offerings you provide, then placing your user directory in the Cloud is an obvious choice. Even when you want to control access to on-premise applications, IDaaS might make sense. After all, your current IAM solution connects to the apps in question over the network as it is. What does it matter whether IAM is running in the Cloud or not? Just put your user directory in the Cloud, configure it to control access to all your apps, and call it a day.

The problem is, this "put all the users in a directory" approach to IAM is increasingly inadequate to cover the kinds of identity management scenarios that we're facing in our maddeningly complex, interconnected world. But this story isn't new, either; after all, federated identity standards and technologies have been around for a decade or more. With federated identity, two separate security domains (that is, different departments or organizations with their own IAM systems) can exchange identity information with each other securely. Think of one of the travel aggregators, like Orbitz or Travelocity. Log into the aggregator Web site and you can purchase tickets and hotel rooms and the like, without ever contacting the airline or hotel directly. Behind the scenes the aggregator and the service provider are exchanging secure tokens that contain a bit of your identity, along with the appropriate instructions.

Federated identity is an essential enabler of Cloud security as well, particularly when the enterprise isn't comfortable moving their IAM to the Cloud. In fact, federating on-premise identity to the Cloud is a central technique we discuss in our Cloud Computing for Architects course. But it's not the same as IDaaS, where an organization actually moves its user directory to the Cloud. And federated identity breaks down when there are too many participants in a complex interaction, like the types of interactions that are becoming increasingly common in the Cloud.

So far so good: IDaaS isn't right for every organization today, but it could easily belong somewhere on your Cloud roadmap. But even when you reach a level of maturity where you're comfortable moving your IAM to the Cloud, IDaaS still falls short, because it doesn't take into account how we as individuals would like to think about our identities. From the perspective of the user, IDaaS moves the control over our own identities even further away from the user - and that's not the way we consumers view the Cloud. From the perspective of the user, the Cloud should empower us. IDaaS does the opposite.

Identity as a Cloud Resource
The reason so many vendors fell into this trap with IDaaS is essentially the horseless carriage problem: we have IAM, we want to move to the Cloud, so let's put IAM in the Cloud - instead of rethinking the problem from the perspective of what the Cloud actually means. So, let's think about this problem in an entirely different way. Instead of beginning with the user directory at the heart of every IAM offering, let's begin with the user identity itself.

Essentially, we'd like to have some kind of avatar: a digital representation of our identity that the user controls for themselves. In other words, something like a digital wallet or key ring that manages PII on behalf of the user. Such technologies have been around for a few decades, of course; in fact, the whole idea of a digital wallet dates from the dot.com era in the 1990s. But such technologies didn't take off, for two reasons. First, big companies didn't like the idea of giving their customers control of their own identities. Second, we didn't have the Cloud.

Let's put off the discussion of control for a moment, because putting the Cloud piece into the puzzle will help us deal with the control issue. We need to consider the Cloud, however, because it changes everything. What the Cloud brings to the table is not just the ability to treat identity management as a service. It also enables us to treat identities themselves as Cloud resources.

As we discussed in an earlier ZapFlash, there are many different types of Cloud resources, including servers, storage, networks, queues, etc. Furthermore, the list isn't fixed. As Cloud Computing matures, we expect and encourage new types of resources. What makes them Cloud resources is that the user is able to dynamically provision and deprovision them with minimal management effort or service provider interaction.

So, let's take the notion of a user identity - or to be more precise, the user's avatar - and consider it to be a Cloud resource. The user, that is, we can provision such avatars as we see fit. And because they're in the Cloud, they're location independent. Facebook could use our avatar. Assign it privileges or other properties. Or our bank. Or our employer. But we control it.

Furthermore, we can choose how we control our Avatar. We may wish to log into its Web interface, but that's only one option. We could also use a hardware device like a flash drive or a USB dongle. We could add biometrics to the device, say via a fingerprint reader. Or we could install software on our computers that would enable us to control the avatar.

Treating identities as Cloud resources can also provide privacy boundaries. For example, I might instruct my avatar to provide my Social Security Number to my bank and the IRS, but not to Facebook. And of course, one of the primary benefits of this approach is that I can maintain my personal information in a single place. If I move, I notify my avatar, and everyone I've authorized to see my address automatically gets the update.

The ZapThink Take
In fact, treating identity as a provisionable Cloud resource - an avatar in the Cloud - makes so much sense that you might wonder why nobody has already made a billion dollars on this idea. The answer, of course, is control. Remember all the hullabaloo when Microsoft tried to position Passport as a general purpose identity store? Customers rebelled and Microsoft ended up in court - several times, in fact. Fundamentally, nobody wanted Microsoft to be in control of our identities.

Today we're going through a similar situation with Facebook, Twitter, and the like. Why bother creating yet another login with yet another password to forget, when we can simply log into that new site with our Facebook ID? Yes, we all go along, until we eventually realize we really don't want to give Facebook so much control over our online identity.

The Cloud, at least in theory, shifts this control to the user. The user should be responsible for provisioning Cloud resources. Yes, there needs to be software behind the scenes that makes provisionable avatars work and keeps them secure, but if they are truly Cloud resources, the Cloud service providers won't control them. Their customers will.

Image source: Sundaram Ramaswamy

More Stories By Jason Bloomberg

Jason Bloomberg is the leading expert on architecting agility for the enterprise. As president of Intellyx, Mr. Bloomberg brings his years of thought leadership in the areas of Cloud Computing, Enterprise Architecture, and Service-Oriented Architecture to a global clientele of business executives, architects, software vendors, and Cloud service providers looking to achieve technology-enabled business agility across their organizations and for their customers. His latest book, The Agile Architecture Revolution (John Wiley & Sons, 2013), sets the stage for Mr. Bloomberg’s groundbreaking Agile Architecture vision.

Mr. Bloomberg is perhaps best known for his twelve years at ZapThink, where he created and delivered the Licensed ZapThink Architect (LZA) SOA course and associated credential, certifying over 1,700 professionals worldwide. He is one of the original Managing Partners of ZapThink LLC, the leading SOA advisory and analysis firm, which was acquired by Dovel Technologies in 2011. He now runs the successor to the LZA program, the Bloomberg Agile Architecture Course, around the world.

Mr. Bloomberg is a frequent conference speaker and prolific writer. He has published over 500 articles, spoken at over 300 conferences, Webinars, and other events, and has been quoted in the press over 1,400 times as the leading expert on agile approaches to architecture in the enterprise.

Mr. Bloomberg’s previous book, Service Orient or Be Doomed! How Service Orientation Will Change Your Business (John Wiley & Sons, 2006, coauthored with Ron Schmelzer), is recognized as the leading business book on Service Orientation. He also co-authored the books XML and Web Services Unleashed (SAMS Publishing, 2002), and Web Page Scripting Techniques (Hayden Books, 1996).

Prior to ZapThink, Mr. Bloomberg built a diverse background in eBusiness technology management and industry analysis, including serving as a senior analyst in IDC’s eBusiness Advisory group, as well as holding eBusiness management positions at USWeb/CKS (later marchFIRST) and WaveBend Solutions (now Hitachi Consulting).

@CloudExpo Stories
PubNub on Wednesday released an open source template to allow developers to add Skype-like video chat into their apps. The free template provides a fully functional video chat platform using WebRTC, PubNub and Google Authentication for a global, reliable collaboration solution. “While the WebRTC protocol has created huge excitement as a way to deliver video chat ubiquitously, there’s still a gap between the protocol itself and the ability to deploy a working, globally scaled, collaboration appl...
The IoT Bootcamp is coming to Cloud Expo | @ThingsExpo on June 9-10 at the Javits Center in New York. Instructor. Registration is now available at http://iotbootcamp.sys-con.com/ Instructor Janakiram MSV previously taught the famously successful Multi-Cloud Bootcamp at Cloud Expo | @ThingsExpo in November in Santa Clara. Now he is expanding the focus to Janakiram is the founder and CTO of Get Cloud Ready Consulting, a niche Cloud Migration and Cloud Operations firm that recently got acquir...
Today, IT is not just a cost center. IT is an enabler and driver of business. With the emergence of the hybrid cloud paradigm, IT now has increasingly more capabilities to create new strategic opportunities for a business. Hybrid cloud allows an organization to utilize multi-tenant public clouds, dedicated private clouds, bare metal hosting, and the associated support and services for the right use cases through an on-demand, XaaS model. This model of IT creates tremendous opportunities for busi...
SYS-CON Events announced today that BroadSoft, the leading global provider of Unified Communications and Collaboration (UCC) services to operators worldwide, has been named “Gold Sponsor” of SYS-CON's WebRTC Summit, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. BroadSoft is the leading provider of software and services that enable mobile, fixed-line and cable service providers to offer Unified Communications over their Internet Protocol networks. The Compa...
SYS-CON Events announced today that GENBAND, a leading developer of real time communications software solutions, has been named “Silver Sponsor” of SYS-CON's WebRTC Summit, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. The GENBAND team will be on hand to demonstrate their newest product, Kandy. Kandy is a communications Platform-as-a-Service (PaaS) that enables companies to seamlessly integrate more human communications into their Web and mobile applicatio...
SOASTA, the leader in performance analytics, today reported record growth of the CloudTest community, exceeding 30,000 registered users of the CloudTest platform in Q1 2015. SOASTA also announced widespread adoption of its Web and mobile testing solutions, with more than 1,600 customers completing more than 285,000 tests using CloudTest during the quarter. This rapid growth shows that DevOps-driven digital businesses are embracing a more continuous approach to testing, and CloudTest is meeting t...
ProfitBricks has launched its new DevOps Central and REST API, along with support for three multi-cloud libraries and a Python SDK. This, combined with its already existing SOAP API and its new RESTful API, moves ProfitBricks into a position to better serve the DevOps community and provide the ability to automate cloud infrastructure in a multi-cloud world. Following this momentum, ProfitBricks has also introduced several libraries that enable developers to use their favorite language to code ...
While DevOps most critically and famously fosters collaboration, communication, and integration through cultural change, culture is more of an output than an input. In order to actively drive cultural evolution, organizations must make substantial organizational and process changes, and adopt new technologies, to encourage a DevOps culture. Moderated by Andi Mann, panelists will discuss how to balance these three pillars of DevOps, where to focus attention (and resources), where organizations m...
SYS-CON Events announced today that kintone has been named “Bronze Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY, and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. kintone promotes cloud-based workgroup productivity, transparency and profitability with a seamless collaboration space, build your own business applic...
SYS-CON Events announced today that Stratoscale, the new data center operating system, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Based in Herzeliya, Israel, Stratoscale is redefining the data center, developing a hardware-agnostic, software platform hyper-converging compute, storage and networking across the rack or data center. The self-optimizing platform automatically distributes all physical...
of cloud, colocation, managed services and disaster recovery solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. TierPoint, LLC, is a leading national provider of information technology and data center services, including cloud, colocation, disaster recovery and managed IT services, with corporate headquarters in St. Louis, MO. TierPoint was formed through the strategic combination of some of t...
How do you securely enable access to your applications in AWS without exposing any attack surfaces? The answer is usually very complicated because application environments morph over time in response to growing requirements from your employee base, your partners and your customers. In his session at 16th Cloud Expo, Haseeb Budhani, CEO and Co-founder of Soha, will share five common approaches that DevOps teams follow to secure access to applications deployed in AWS, Azure, etc., and the frict...
SYS-CON Events announced today that Soha will exhibit at SYS-CON's DevOps Summit New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Soha delivers enterprise-grade application security, on any device, as agile as the cloud. This turnkey, cloud-based service enables customers to solve secure application access and delivery challenges that traditional or virtualized network solutions cannot solve because they are too expensive, inflexible and operational...
SYS-CON Events announced today that Vicom Computer Services, Inc., a provider of technology and service solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. They are located at booth #427. Vicom Computer Services, Inc. is a progressive leader in the technology industry for over 30 years. Headquartered in the NY Metropolitan area. Vicom provides products and services based on today’s requirements...
SYS-CON Events announced today that Ciqada will exhibit at SYS-CON's @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Ciqada™ makes it easy to connect your products to the Internet. By integrating key components - hardware, servers, dashboards, and mobile apps - into an easy-to-use, configurable system, your products can quickly and securely join the internet of things. With remote monitoring, control, and alert messaging capability, you will mee...
What exactly is a cognitive application? In her session at 16th Cloud Expo, Ashley Hathaway, Product Manager at IBM Watson, will look at the services being offered by the IBM Watson Developer Cloud and what that means for developers and Big Data. She'll explore how IBM Watson and its partnerships will continue to grow and help define what it means to be a cognitive service, as well as take a look at the offerings on Bluemix. She will also check out how Watson and the Alchemy API team up to off...
The 17th International Cloud Expo has announced that its Call for Papers is open. 17th International Cloud Expo, to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, APM, APIs, Microservices, Security, Big Data, Internet of Things, DevOps and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding bu...
With IoT exploding, massive data will transform businesses with opportunities to monetize almost anything that can be measured. In this C-Level Roundtable Discussion at @ThingsExpo, Brendan O’Brien, Aria Systems Co-founder and Chief Evangelist, will lead an expert panel of consultants, thought leaders and practitioners who will look at these new monetization trends, discuss the implications, and detail lessons learned from their collective experience. Finally, the panel will point the way forw...
SYS-CON Events announced today that Column Technologies, a global technology solutions company, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Established in 1998, Column Technologies is a leader in application performance and infrastructure management for commercial and federal markets. The company is headquartered in the United States, with a diverse and talented team of more than 350 employees around th...
SYS-CON Events announced today that ProfitBricks, the provider of painless cloud infrastructure, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY., and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. ProfitBricks is the IaaS provider that offers a painless cloud experience for all IT users, with no learning curve. ...