Welcome!

@CloudExpo Authors: Kevin Jackson, Liz McMillan, Chris Kocher, Elizabeth White, Pat Romanski

Related Topics: @CloudExpo, Industrial IoT, Open Source Cloud, Containers Expo Blog, Agile Computing, Cloud Security

@CloudExpo: Article

Turning Identity-as-a-Service Inside Out

From the perspective of the user, the Cloud should empower us. IDaaS does the opposite.

Simple question with a surprisingly complex answer: who owns your identity? Our first instinct is to insist that we each own our own identities. After all, we are our identities, right?

Not so fast. There are myriad players who own a piece of your identity, from the credit bureaus to your bank to Facebook to your doctor to your employer. Every single one has some kind of identity management system that keeps track of information about you. In fact, this personally identifiable information (PII) is so powerful that when someone steals it, we call that crime identity theft - as though stealing your PII was the equivalent of stealing your very soul.

The reason PII has such power, of course, is because we give it power. Knowing a username and password gives you the power to access a system. Knowing your Social Security Number and birth date may give you the power to get bank account information from a call center rep. Add a bit more knowledge and you have the power to apply for a loan or a job or a security clearance. The old adage states that knowledge is power, but information only has power if we choose to empower it.

From the perspective of IT, managing user identities has long been in our wheelhouse. The Identity and Access Management (IAM) market matured years ago, and all enterprises have a broad set of robust IAM alternatives to choose from. But hey, it's almost 2013, right? Why buy some IAM product I have to install and maintain. Why don't I just get it in the Cloud?

The Problem with Identity-as-a-Service
No brainer, right? Sign up for Identity-as-a-Service (IDaaS), or perhaps call it Identity Management as a Service (IDMaaS) or IAM as a Service (IAMaaS) - the marketplace still hasn't settled on the term - and you can throw away your Active Directory or LDAP. If all your users want to do is access the Software-as-a-Service (SaaS) offerings you provide, then placing your user directory in the Cloud is an obvious choice. Even when you want to control access to on-premise applications, IDaaS might make sense. After all, your current IAM solution connects to the apps in question over the network as it is. What does it matter whether IAM is running in the Cloud or not? Just put your user directory in the Cloud, configure it to control access to all your apps, and call it a day.

The problem is, this "put all the users in a directory" approach to IAM is increasingly inadequate to cover the kinds of identity management scenarios that we're facing in our maddeningly complex, interconnected world. But this story isn't new, either; after all, federated identity standards and technologies have been around for a decade or more. With federated identity, two separate security domains (that is, different departments or organizations with their own IAM systems) can exchange identity information with each other securely. Think of one of the travel aggregators, like Orbitz or Travelocity. Log into the aggregator Web site and you can purchase tickets and hotel rooms and the like, without ever contacting the airline or hotel directly. Behind the scenes the aggregator and the service provider are exchanging secure tokens that contain a bit of your identity, along with the appropriate instructions.

Federated identity is an essential enabler of Cloud security as well, particularly when the enterprise isn't comfortable moving their IAM to the Cloud. In fact, federating on-premise identity to the Cloud is a central technique we discuss in our Cloud Computing for Architects course. But it's not the same as IDaaS, where an organization actually moves its user directory to the Cloud. And federated identity breaks down when there are too many participants in a complex interaction, like the types of interactions that are becoming increasingly common in the Cloud.

So far so good: IDaaS isn't right for every organization today, but it could easily belong somewhere on your Cloud roadmap. But even when you reach a level of maturity where you're comfortable moving your IAM to the Cloud, IDaaS still falls short, because it doesn't take into account how we as individuals would like to think about our identities. From the perspective of the user, IDaaS moves the control over our own identities even further away from the user - and that's not the way we consumers view the Cloud. From the perspective of the user, the Cloud should empower us. IDaaS does the opposite.

Identity as a Cloud Resource
The reason so many vendors fell into this trap with IDaaS is essentially the horseless carriage problem: we have IAM, we want to move to the Cloud, so let's put IAM in the Cloud - instead of rethinking the problem from the perspective of what the Cloud actually means. So, let's think about this problem in an entirely different way. Instead of beginning with the user directory at the heart of every IAM offering, let's begin with the user identity itself.

Essentially, we'd like to have some kind of avatar: a digital representation of our identity that the user controls for themselves. In other words, something like a digital wallet or key ring that manages PII on behalf of the user. Such technologies have been around for a few decades, of course; in fact, the whole idea of a digital wallet dates from the dot.com era in the 1990s. But such technologies didn't take off, for two reasons. First, big companies didn't like the idea of giving their customers control of their own identities. Second, we didn't have the Cloud.

Let's put off the discussion of control for a moment, because putting the Cloud piece into the puzzle will help us deal with the control issue. We need to consider the Cloud, however, because it changes everything. What the Cloud brings to the table is not just the ability to treat identity management as a service. It also enables us to treat identities themselves as Cloud resources.

As we discussed in an earlier ZapFlash, there are many different types of Cloud resources, including servers, storage, networks, queues, etc. Furthermore, the list isn't fixed. As Cloud Computing matures, we expect and encourage new types of resources. What makes them Cloud resources is that the user is able to dynamically provision and deprovision them with minimal management effort or service provider interaction.

So, let's take the notion of a user identity - or to be more precise, the user's avatar - and consider it to be a Cloud resource. The user, that is, we can provision such avatars as we see fit. And because they're in the Cloud, they're location independent. Facebook could use our avatar. Assign it privileges or other properties. Or our bank. Or our employer. But we control it.

Furthermore, we can choose how we control our Avatar. We may wish to log into its Web interface, but that's only one option. We could also use a hardware device like a flash drive or a USB dongle. We could add biometrics to the device, say via a fingerprint reader. Or we could install software on our computers that would enable us to control the avatar.

Treating identities as Cloud resources can also provide privacy boundaries. For example, I might instruct my avatar to provide my Social Security Number to my bank and the IRS, but not to Facebook. And of course, one of the primary benefits of this approach is that I can maintain my personal information in a single place. If I move, I notify my avatar, and everyone I've authorized to see my address automatically gets the update.

The ZapThink Take
In fact, treating identity as a provisionable Cloud resource - an avatar in the Cloud - makes so much sense that you might wonder why nobody has already made a billion dollars on this idea. The answer, of course, is control. Remember all the hullabaloo when Microsoft tried to position Passport as a general purpose identity store? Customers rebelled and Microsoft ended up in court - several times, in fact. Fundamentally, nobody wanted Microsoft to be in control of our identities.

Today we're going through a similar situation with Facebook, Twitter, and the like. Why bother creating yet another login with yet another password to forget, when we can simply log into that new site with our Facebook ID? Yes, we all go along, until we eventually realize we really don't want to give Facebook so much control over our online identity.

The Cloud, at least in theory, shifts this control to the user. The user should be responsible for provisioning Cloud resources. Yes, there needs to be software behind the scenes that makes provisionable avatars work and keeps them secure, but if they are truly Cloud resources, the Cloud service providers won't control them. Their customers will.

Image source: Sundaram Ramaswamy

More Stories By Jason Bloomberg

Jason Bloomberg is the leading expert on architecting agility for the enterprise. As president of Intellyx, Mr. Bloomberg brings his years of thought leadership in the areas of Cloud Computing, Enterprise Architecture, and Service-Oriented Architecture to a global clientele of business executives, architects, software vendors, and Cloud service providers looking to achieve technology-enabled business agility across their organizations and for their customers. His latest book, The Agile Architecture Revolution (John Wiley & Sons, 2013), sets the stage for Mr. Bloomberg’s groundbreaking Agile Architecture vision.

Mr. Bloomberg is perhaps best known for his twelve years at ZapThink, where he created and delivered the Licensed ZapThink Architect (LZA) SOA course and associated credential, certifying over 1,700 professionals worldwide. He is one of the original Managing Partners of ZapThink LLC, the leading SOA advisory and analysis firm, which was acquired by Dovel Technologies in 2011. He now runs the successor to the LZA program, the Bloomberg Agile Architecture Course, around the world.

Mr. Bloomberg is a frequent conference speaker and prolific writer. He has published over 500 articles, spoken at over 300 conferences, Webinars, and other events, and has been quoted in the press over 1,400 times as the leading expert on agile approaches to architecture in the enterprise.

Mr. Bloomberg’s previous book, Service Orient or Be Doomed! How Service Orientation Will Change Your Business (John Wiley & Sons, 2006, coauthored with Ron Schmelzer), is recognized as the leading business book on Service Orientation. He also co-authored the books XML and Web Services Unleashed (SAMS Publishing, 2002), and Web Page Scripting Techniques (Hayden Books, 1996).

Prior to ZapThink, Mr. Bloomberg built a diverse background in eBusiness technology management and industry analysis, including serving as a senior analyst in IDC’s eBusiness Advisory group, as well as holding eBusiness management positions at USWeb/CKS (later marchFIRST) and WaveBend Solutions (now Hitachi Consulting).

@CloudExpo Stories
Get deep visibility into the performance of your databases and expert advice for performance optimization and tuning. You can't get application performance without database performance. Give everyone on the team a comprehensive view of how every aspect of the system affects performance across SQL database operations, host server and OS, virtualization resources and storage I/O. Quickly find bottlenecks and troubleshoot complex problems.
"Dice has been around for the last 20 years. We have been helping tech professionals find new jobs and career opportunities," explained Manish Dixit, VP of Product and Engineering at Dice, in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
An IoT product’s log files speak volumes about what’s happening with your products in the field, pinpointing current and potential issues, and enabling you to predict failures and save millions of dollars in inventory. But until recently, no one knew how to listen. In his session at @ThingsExpo, Dan Gettens, Chief Research Officer at OnProcess, discussed recent research by Massachusetts Institute of Technology and OnProcess Technology, where MIT created a new, breakthrough analytics model for ...
SYS-CON Events has announced today that Roger Strukhoff has been named conference chair of Cloud Expo and @ThingsExpo 2017 New York. The 20th Cloud Expo and 7th @ThingsExpo will take place on June 6-8, 2017, at the Javits Center in New York City, NY. "The Internet of Things brings trillions of dollars of opportunity to developers and enterprise IT, no matter how you measure it," stated Roger Strukhoff. "More importantly, it leverages the power of devices and the Internet to enable us all to im...
"At ROHA we develop an app called Catcha. It was developed after we spent a year meeting with, talking to, interacting with senior citizens watching them use their smartphones and talking to them about how they use their smartphones so we could get to know their smartphone behavior," explained Dave Woods, Chief Innovation Officer at ROHA, in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
DevOps is being widely accepted (if not fully adopted) as essential in enterprise IT. But as Enterprise DevOps gains maturity, expands scope, and increases velocity, the need for data-driven decisions across teams becomes more acute. DevOps teams in any modern business must wrangle the ‘digital exhaust’ from the delivery toolchain, "pervasive" and "cognitive" computing, APIs and services, mobile devices and applications, the Internet of Things, and now even blockchain. In this power panel at @...
Effectively SMBs and government programs must address compounded regulatory compliance requirements. The most recent are Controlled Unclassified Information and the EU's GDPR have Board Level implications. Managing sensitive data protection will likely result in acquisition criteria, demonstration requests and new requirements. Developers, as part of the pre-planning process and the associated supply chain, could benefit from updating their code libraries and design by incorporating changes. In...
"Venafi has a platform that allows you to manage, centralize and automate the complete life cycle of keys and certificates within the organization," explained Gina Osmond, Sr. Field Marketing Manager at Venafi, in this SYS-CON.tv interview at DevOps at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
"ReadyTalk is an audio and web video conferencing provider. We've really come to embrace WebRTC as the platform for our future of technology," explained Dan Cunningham, CTO of ReadyTalk, in this SYS-CON.tv interview at WebRTC Summit at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Financial Technology has become a topic of intense interest throughout the cloud developer and enterprise IT communities. Accordingly, attendees at the upcoming 20th Cloud Expo at the Javits Center in New York, June 6-8, 2017, will find fresh new content in a new track called FinTech.
Whether your IoT service is connecting cars, homes, appliances, wearable, cameras or other devices, one question hangs in the balance – how do you actually make money from this service? The ability to turn your IoT service into profit requires the ability to create a monetization strategy that is flexible, scalable and working for you in real-time. It must be a transparent, smoothly implemented strategy that all stakeholders – from customers to the board – will be able to understand and comprehe...
Keeping pace with advancements in software delivery processes and tooling is taxing even for the most proficient organizations. Point tools, platforms, open source and the increasing adoption of private and public cloud services requires strong engineering rigor – all in the face of developer demands to use the tools of choice. As Agile has settled in as a mainstream practice, now DevOps has emerged as the next wave to improve software delivery speed and output. To make DevOps work, organization...
"Qosmos has launched L7Viewer, a network traffic analysis tool, so it analyzes all the traffic between the virtual machine and the data center and the virtual machine and the external world," stated Sebastien Synold, Product Line Manager at Qosmos, in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life sett...
The WebRTC Summit New York, to be held June 6-8, 2017, at the Javits Center in New York City, NY, announces that its Call for Papers is now open. Topics include all aspects of improving IT delivery by eliminating waste through automated business models leveraging cloud technologies. WebRTC Summit is co-located with 20th International Cloud Expo and @ThingsExpo. WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web co...
Successful digital transformation requires new organizational competencies and capabilities. Research tells us that the biggest impediment to successful transformation is human; consequently, the biggest enabler is a properly skilled and empowered workforce. In the digital age, new individual and collective competencies are required. In his session at 19th Cloud Expo, Bob Newhouse, CEO and founder of Agilitiv, drew together recent research and lessons learned from emerging and established compa...
WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 6th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, P2P file sharing, and use cases that have already leveraged the power and convenience of WebRTC.
"Coalfire is a cyber-risk, security and compliance assessment and advisory services firm. We do a lot of work with the cloud service provider community," explained Ryan McGowan, Vice President, Sales (West) at Coalfire Systems, Inc., in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Regulatory requirements exist to promote the controlled sharing of information, while protecting the privacy and/or security of the information. Regulations for each type of information have their own set of rules, policies, and guidelines. Cloud Service Providers (CSP) are faced with increasing demand for services at decreasing prices. Demonstrating and maintaining compliance with regulations is a nontrivial task and doing so against numerous sets of regulatory requirements can be daunting task...
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.