Thanks to the help of Henry Story, who recently presented the concepts of FOAF (an acronym of Friend of a friend) in a Sun Identity Interest teleconference forum, I have begun to experiment a bit with the technology.

According to the FOAF Wikipedia article:

FOAF is a descriptive vocabulary expressed using the Resource Description Framework (RDF) and the Web Ontology Language (OWL). Computers may use these FOAF profiles to find, for example, all people living in Europe, or to list all people both you and a friend of yours know. This is accomplished by defining relationships between people. Each profile has a unique identifier (such as the person's e-mail addresses, a Jabber ID, or a URI of the homepage or weblog of the person), which is used when defining these relationships.

The FOAF project, which defines and extends the vocabulary of a FOAF profile, was started in 2000 by Libby Miller and Dan Brickley. It can be considered the first Social Semantic Web application, in that it combines RDF technology with 'Social Web' concerns.

The FOAF project provides a way for me to maintain my personal Identity profile and link to others I know, creating a global social graph of acquainted people.  I don’t know much yet, but am intrigued by its possibilities.

You can visit my FOAF Card by clicking here, or view the XML for the corresponding FOAF file by clicking here.

If you have a FOAF file and would like to be added to my “knows” list, please send my the URL for your FOAF file.

Thanks!  I’ll keep you updated on my progress.

It is almost Christmas Eve.  In the midst of an insomnia episode, I conjured up a crazy notion of making a Christmas wish list of things I want from a Personal Identity-Persona Service (PIPS).   Your list may be different, but here’s mine.

1. Secure Identity Bank Vault for my Identity Profile and Credentials.  Of all the potential Identity Providers jostling for prominence in the market, I favor my bank the most.  They take pretty good care of my money, enable me to selectively send some of my money to other people, and seem to be sensitive to the issues surrounding security, privacy, liability and potential cyber threats.  I think I could trust them to take good care of my online Identity.  Think of it as the bank providing a safe deposit box for all the Identity attributes that I want to store and use, and providing the means to selectively take out Identity attributes for presentation to other people.  This vault should be located in a secure cloud, so I can get access from any computer or mobile device of my choice.  I think this is a concept even my technology-challenged wife, mother and father could readily understand and accept. 
2. Really Easy to use Identity/Profile/Persona Editor.  With my Secure Identity Bank Vault in place, I need a really easy to use way to fill that vault with my Identity information and maintain it over time.  This will include the information I would normally include provide to an online merchant or social network, as well as subsets of such information that I can define for the purpose of presenting different personae to facilitate different online experiences.
3. Multiple Levels of Identity Assurance or Validation.  I want to make sure that other people can’t impersonate me by setting up a  fake Identity Bank Vault for Mark Dixon that could be used to conduct illicit transactions.  To do that, methods need to be in place to validate the claims I make about my identity, such as birthplace, social security number, credit card numbers, etc.  Progressively rigorous checks of my background information will allow me to confidently present Bronze, Silver, Gold or Platinum Identity credentials to enable different levels of online interaction.
4. Really Easy to use Persona Selector.  I need the ability to easily select from a set of personae I have defined in the Identity Bank Vault.   For example, I will most likely have one persona to use for online shopping, one for interaction with state government, and another for using my church website.  This selector needs to be immediately accessible, probably in the browser toolbar.  For mobile use, the persona selector needs to be easily accessed and presented by any online application that requires me to log in or pay for services.
5. Multiple Levels of Secure Authentication.  I want to make sure that no one can access and use my Identity Bank Vault or persona and credentials it contains without my explicit permission.  In some cases, I may want to simply surf the web and virtually window shop by identifying myself with a user name and password.  However, I would like to restrict access to any financial transactions or health care record access by requiring a digital certificate (probably on a USB fob) and perhaps with a fingerprint check (perhaps via that same USB device).
6. Option to Use Separate Personae for Login and Payment.  In some cases, I may want to use an Internet Persona to poke around the web, do some window shopping and try things out.  I may want to log in to Amazon, eBay, Barnes and Noble or other merchants before I decide to buy.  None of these merchants needs to know my credit card information before I decide to buy something.  Therefore, I need an easy method for first identifying myself and subsequently presenting my payment method.
7. Audit Reports.  I would like to get an online “Identity bank statement” each month or on demand, detailing the my use of PIPS service.  This would allow me to verify that all uses were legitimate and would help me determine if adjustments were needed in my profile or use of the service.
8. Fraud Insurance.  If a privacy breach or other unauthrorized use of my Identity or credentials occur through no fault of my own, I would like to be insured against possible damages.  This would be similar to the fraud protection currently provided by credit card companies.

Of course, in order for a PIPS service to be worth much, social Networks, online merchants, government agencies and other relying parties will need to accept my PIPS profile and credentials.   But wouldn’t it be great if I could maintain one set of Identity and Profile information and have that available for consumption by any merchant or social network, according to my wishes?  I would be willing to pay a yearly fee for such a service, much like I pay certain bank fees now. Or, perhaps those fees would be waived if I maintained a certain account balance or averaged a certain transaction volume on a credit card issued by the bank.

Will something like this happen?  I think so.  Probably not in 2010.  By 2015? I certainly hope so.

Many thanks to my good friend Jonathan Gershater for sending me the link to another excellent post about Identity and Healthcare.  I particularly like his illustration of using Federated Identity to facilitate trusted exchange of medical records between different medical service providers. 

A user of any (Healthcare) ServiceProvider, who has been issued a digital identity by the trusted IdentityProvider, may seamlessly interact with the healthcare providers (SPs). The user will present the digital identity issued by the IdP, the SP will verify the Identity, and the user will be granted access to the Service Provider’s application. However, based on the user’s attributes and role, the functionality available to the user will vary.  A physician may alter a medical record but only within their specialty ( a dermatologist cannot alter a prescription for spectacles). A pharmacist may view but not alter the prescription for insulin in a healthrecord.  A patient may only view but not alter their medical record.

Jonathan Gershater recently published an interesting blog post exploring the conceptual differences between the National Health Information Network (NHIN) infrastructure, “a collection of standards, protocols, legal agreements, specifications, and services that enables the secure exchange of health information over the internet,” and an alternate approach known as the Health Internet, “an open-market standards-based approach to enable the exchange and sharing of electronic health data, using existing Internet standard protocols and web technologies.”

Jonathan referenced two informative posts on The Health Care Blog and Practice Fusion’s blog.  I’m still trying to wrap my mind around the significance of these two architectural directions, but it certainly appears that Identity is a critical part of the solution, regardless of what alternative approach or derivatives thereof may emerge.  Any Electronic Health Record (EHR) system must be based upon secure, flexible and scalable Identity Management system.

Thank, Jonathan, for the excellent reference.

Last week I had a stimulating conversation with Jim Kinchley and Chris Madsen, executives of Trufina, a “provider of online identity verification and identity management services, enabling individuals to verify their identity attributes online, and providing the identity management tools for sharing that verified identity information with individuals and websites across the Internet.”

In October, I posted an article entitled Identity Trend 4: Identity Assurance, one of a series of posts about important trends in the Identity Management industry. In that post I proposed, “With the continual expansion of online fraud and other threats to online security and privacy, the need for Identity Assurance methods are rising.  Being able to certify the that the correct Identity credentials are issue to the correct user before access is attempted is an increasingly critical issue.”

A few days after I authored that post, I became aware of Trufina, signed up for an account, paid a small fee, and had my Identity verified through a series of online questions drawn from publicly available information about me that presumably only I would know.  As evidence of that successful vetting process, I posted a Trufina badge on this blog (see right column).  This badge visually represents that my identity had been verified by Trufina, and provides a way that blog visitors could request a Trufina ID Card with details I elect to share.  Do you want to see how it works?  Please click on the Trufina badge or click here, enter your email address, and I’ll send you a link to see my Trufina-verified Identity Card.

Trufina provides a public API to allow websites to take advantage of Trufina identity validation services.  For example, the Naymz online Professional Reputation Network allows members to link their Trufina Verified ID to the Naymz profile.  In such a case, the Trufina Verified ID badge is shown on the Naymz member profile.  I don’t use the Naymz network as extensively as LinkedIn or Facebook, but neither of those more popular social networks have validated my Identity as well as Naymz has done, thanks to the Trufina process.

I look forward to seeing how Trufina progresses in the marketplace.  We really need a critical mass of easily accessible, yet secure, Identity validation services to increase the level of trust and confidence in online relationships.

After the CIO Frankly Speaking Breakfast event in Toronto on November 17th, Michelle Dennedy and I fielded questions about Identity Management from John Pickett of IT World Canada on camera.  A short video emerging from that interview was published on the IT World Canada website today.

I couldn’t figure out how to embed the video on this blog post, but clicking on the image will take to you to the IT World Canada website where you can view the video.

In our recent CIO Roundtable tour, a question about Identity and Access Management that emerged in every session was, “where do I go from here?”  It is one thing to talk about the theory of IAM; it is quite another thing to actually implement it in your enterprise.

My advice to the Roundtable participants and to you is this, “IAM is a journey, not a short-term event. Enterprises must begin to approach compliance as a long-term program, not a single project.  Take stock of where you are now, set objectives for where you want to be in the future, and execute your strategy in stages.”

To illustrate this process, the white paper I recently wrote, Identity and Access Management: Enabling HIPAA/HITECH Compliance, proposes thirteen best practices for approaching the application of IAM to HIPAA/HITEC compliance efforts.  Recognizing that IAM is a journey, not a project, is one of the best practices.

Think program, not project. HIPAA/HITECH compliance is a journey, not a short-term event. Enterprises must begin to approach compliance as a long-term program, not a single project. An effective and holistic compliance program should also incorporate governance and risk management. Boards of directors and executives are frequently being held to higher standards than ever before as they are expected to be knowledgeable about, and held liable for, everything going on within the enterprise.

The step-by-step process depicted above doesn’t fit everyone.  It only serves to illustrate the need to for defining your IAM journey as a series of phases subdivided into measureable steps.  Our experience has shown that those enterprises who follow this basic process usually succeed, while those who attempt to do much all at once, or focus on one small tactical project, often fail to realize the benefits of a well-executed IAM strategy.

Happy trails!  (I couldn’t resist that last comment, even though the “happy trails” comment in my previous post dealt with airline travel, not IAM journeys.)

I read a disturbing article by Dan Schwab of Fox Chicago News this morning entitled “Probe: ID rules lax at Chicago airports.” Perhaps the fact that I will board my 13th flight segment in two and a half weeks this afternoon fueled my interest in the article, which reported “a Fox Chicago News investigation discovered a major loophole at TSA checkpoints at O’Hare and Midway.”

During the past two months, Fox flew multiple employees – male, female, black, white, and Muslim – to different destinations around the country on different airlines.

The only requirement: They were not allowed to bring a photo ID. No passport. No driver’s license.

On every occasion, these Fox employees were allowed through security without a hitch as long as they showed that the name on their boarding pass matched the name on a couple of credit cards, according to Fox Chicago News.

Credit cards for identification?  What happened to the requirement of a photo ID?  This shows a remarkable lack of TSA compliance with recommended policy:

The federal Sept. 11 Commission’s final report included 10 pages that focused solely on the issue of terrorism and identity fraud. The report states: “Travel documents are as important as weapons. Fraud is no longer just a problem of theft. At many entry points to vulnerable facilities, including gates for boarding aircraft, sources of identification are the last opportunity to ensure that people are who they say they are.” …

By checking credit cards rather than a photo ID, TSA simply was following its own rules, which vaguely state that passengers without an acceptable ID will have to provide “information” to verify their identity, according to Fox Chicago News.

I’m not a big fan of the TSA.  To me, it is at best a huge, bumbling bureaucracy, and at worst, a huge, oppressive police force.  I really don’t feel safer because of them.  However, regardless of my feelings, this is a clear example about how poorly executed identity policy can lead to easily exploited security breaches, even as a false aura of safety is provided for the law-abiding majority, who obediently shed shoes and jackets, empty pockets and briefcases, and subject themselves to humiliating searches while many obvious loopholes remain.

Just one example … next time you go through the TSA screening process, notice how closely (or not) airport employees’ ID badges are examined. 

Happy trails!

PS.  The Dave Granlund cartoon reminds me of the time I brought exercise weights with me on a trip.  My luggage was manually searched every time – on each of four flight segments that week.  I now keep those dastardly weights safely at home with my horribly dangerous one-inch pocket knife.  Bitter?  Nah!

The white paper I mentioned several days ago, Identity and Access Management – Enabling HIPAA/HITECH Compliance, is now hot off the press and ready for download.  Thanks to all the great people at Sun Microsystems that contributed to this project and made it a reality.  Hopefully, the paper will be beneficial to those who are facing the challenges of how to comply with the increasing regulations surrounding management of healthcare data and information systems.

The paper’s abstract reads:

As healthcare organizations and vendors become more reliant on digital information technology, complying with increasing regulatory requirements presents a range of challenges. This paper explores the requirements that these organizations face, best practices for implementing identity management systems that help ensure compliance, and how Sun’s pragmatic approach to identity management simplifies the technology environment.

The table of contents:

1. Executive Summary
2. Healthcare Information Technology Challenges
3. Health Insurance Portability and Accountability Act (HIPAA)
4. Health Information Technology for Economic and Clinical Health Act (HITECH)
5. Impact of HIPAA, HITECH and Related Regulations
6. The Role of IAM in HIPAA/HITECH Compliance
7. Sun IAM Product Introduction
8. Best Practices for the IAM/Compliance Journey
9. How to Get Started with HIPAA/HITECH and IAM
10. The Sun IAM Workshop
11. References

Please let me know if you have any questions or would like to discuss the content in more detail.

It was nice to see a short piece covering the CIO Frankly Speaking Breakfast event in Toronto yesterday, where Michelle Dennedy and I fielded questions about Identity Management and Cloud Computing from John Pickett of IT World Canada.  I particularly liked the statement made by Michelle, “Identities are now being realized as the true assets for the organization.”

About a month ago, I received an invitation to join a new LinkedIn group, “Canadiam – IAM in Canada,” hosted by Mike Waddingham, whom I had never met in person.  Mike had recently launched a new blog of the same name, and formed the LinkedIn group to complement his blog. Mike asserted:

"Identity and Access Management in Canada is different. American identity issues are complicated by their obsession with national security. British data and privacy laws are decidedly different than ours. Identity and Access Management (IAM) implementations vary greatly from country to country. We need a ‘conversation’ about IAM in Canada. Canadiam is that conversation.”

The call for a Canadian IAM conversation is certainly timely, and I think the blog/group name is great, reminiscent of the legendary Molson Beer commercial, "I am Canadian", which Mike embedded within the maiden post on the Canadiam blog and I include here for your enjoyment.

Back in 2000 when this commercial was first released, I was employed with Oracle and doing quite a bit of work in Canada, so watching it again brought back fond memories of choice experiences I have had with great friends north of the border.

So, I joined Canadiam as an “honorary” Canadian, and enjoyed reading Mike’s posts, including “Canada’s top court enforces license photos,” and “Canadian Identity Assertion.”  Even though I don’t quite fit the qualifications specified in the Canadian Identity Assertion, I am honored to be associated.

Fast forward to yesterday morning.  I had arrived in Vancouver to participate as a panelist in the CIO Magazine / Sun Microsystems breakfast event, “Identity Management - Pathway to Enterprise Agility.”  Before joining my colleagues at the event, I took a moment to post a short message on the Canadiam LinkedIn group that I was in town and would participate in a similar event in Toronto next Tuesday.

We had a great session, moderated by John Pickett, VP & Community Advocate at IT World Canada. Michelle Dennedy and I fielded questions about Identity Management, Privacy, Security and Cloud computing from John and members of the audience.  After the session, a man from the rear of the room, who had offered several insightful comments and excellent questions, came forward to introduce himself.  It was none other than Mike Waddingham himself!  I hadn’t recognized him from his LinkedIn photo and certainly didn’t expect him to be in attendance.  I had assumed he lived in the Toronto area.  But Mike had travelled to Vancouver from his home base in Edmonton to attend the event.

I never cease to be amazed at the surprise personal encounters I have at almost professional gathering I attend, where I meet people in person for the first time after connecting previously on line.  The magic of online interaction, while valuable and delightful in and of itself, always seems to be amplified by face-to-face interaction.

So, Mike and all you Canadiams, thanks for the privilege of being numbered among you as an honorary Canadian.  Thanks for giving me another treasured “social networking moment.” I look forward to participating further in the Canadian IAM discussion.

As explained in my recent post, I am awaiting final publication of a white paper I recently authored, entitled, “Identity and Access Management – Enabling HIPAA/HITECH Compliance.”  This post is a excerpt from that paper.

In the thirteen years since the initial passage of the HIPAA act, practical experience in the field has yielded several recommended best practices for implementing IAM systems to enable HIPAA/HITECH compliance. We recommend the following:

1. Understand requirements. By developing a better understanding of compliance requirements, how compliance affects information technology (IT), and how IT in general and IAM specifically can help support the privacy, security and notification requirements of HIPAA/HITECH, companies can establish efficient, cost-effective, and sustainable programs that address all of these complex requirements within a holistic compliance framework.

2. Recognize IT's critical role. In many companies, IT has evolved to become the critical backbone behind almost every operation, but many people still view technology as a cost rather than an investment or asset. By understanding the key roles that IT plays in support of HIPAA/HITECH compliance, enterprises can maximize the value of their technology investment.

3. Understand the role of IAM. IAM plays a critical role in compliance with HIPAA/HITECH privacy, security and notification requirements.. However it does not automatically satisfy all HIPAA/HITECH requirements. Recognizing the value and the limitations of IAM in the entire spectrum of HIPAA/HITECH compliance is essential.

4. Think program, not project. HIPAA/HITECH compliance is a journey, not a short term event. Enterprises must begin to approach compliance as a long-term program, not a single project. An effective and holistic compliance program should also incorporate governance and risk management. Boards of directors and executives are frequently being held to higher standards than ever before as they are expected to be knowledgeable about, and held liable for, everything going on within the enterprise.

5. Establish privacy and security policy. A success privacy and security program requires a documented set of principles, policies, and practices. Using the Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information as a guide, the enterprise's privacy and security principles should be documented as a foundation upon which to build policies, practices and strategies.

6. Develop a strategy. The only way to effectively address the wide spectrum of compliance requirements is to integrate them into a common compliance strategy that is intertwined with the business itself. A business-driven, risk-based, and technology-enabled compliance strategy can help create enterprise value by rationalizing unnecessary complexities, driving consistency and accountability across the enterprise, and identifying opportunities for a possible enhancement of operational performance and information quality.

7. Collaborate. HITECH extends compliance responsibility and penalties to all business associates. Work closely with your vendors and business partners to form an overall security and privacy framework, including updating legal relationship documents as ncessary.

8. Establish a governance process. Compliance efforts affect a broad spectrum of an enterprise. Stakeholders from many organizations, often with conflicting priorities, have vested interests in the outcomes of a compliance strategy. The governance process must provide representation from the impacted functional areas of the organization. A governance board should have appropriate representation from IT, security, audit, application owners, human resources, business process owners and applicable business associates. The board should be accountable for the project objectives and be vested with authority to make program decisions. The board should be empowered to 1) establish a statement of purpose for the program, 2) promote and give visibility to the program throughout the larger organization, 3) act as a mechanism for quickly making decisions regarding program scope, issues, and risks, and 4) monitor the program health on an ongoing basis.

9. Implement your strategy in phases. By segmenting the overall solution into manageable parts, an organization can realize quick, visible business benefits and progressively realize overall program objectives in an orderly, measurable way. Implementing in manageable phases also makes it easier to battle issues such as scope creep or requirements drift.

10. Standards. Follow the NIST and other applicable standards for electronic healthcare records. Adjust to form a compliance model with this emerging standard. Focus on open standards and vendors that are open standards compliant to insure long-term flexibility of computing platforms and security frameworks.

11. Give real-time visibility. Real-time views into the functioning of controls across these systems and across the enterprise, through job-specific dashboards or portal views, can provide insight into compliance status, progress, and risks. Effective communications with all stakeholders is essential.

12. Unify disparate compliance efforts. Many companies are beginning to realize the potential of technology to support sustained compliance and are actively looking to combine existing fragmented, reactive, and inefficient governance and compliance efforts into a single sustainable compliance program. Bringing together compliance, governance, and risk management under a holistic framework, can result in a centralized compliance organization with the understanding, structure, and ability to help optimize the company’s compliance efforts in a sustainable, strategic, and cost effective manner.

13. Assess progress and adjust as necessary. Each phase of the progressive implementation of the compliance strategy will yield more in-depth understanding about the compliance process as it pertains to the specific enterprise. Implementing methods of continual process improvement will yield progressively refined results.

Please let me know what you think.  What have you found that really works in this IAM/Compliance Journey?

Tomorrow is the first of five “CIO  Roundtables” sponsored by CIO Magazine and Sun Microsystems to be held in Washington DC, New York, San Francisco, Vancouver and Toronto.  It will be a good experience to participate in each event with Michelle Dennedy, Chief Governance Officer of Cloud Computing for Sun Microsystems, and dozens of CIOs and IT management folks in what promises to be a lively and invigorating discussion of Identity Management issues facing modern enterprises and government institutions.  We will address the subject, “Identity Management - Pathway To Enterprise Agility.”

A list of locations and further information are included in a previous post.

I recently authored a white paper entitled, “Identity and Access Management – Enabling HIPAA/HITECH Compliance.”  The paper is now in the final editing and formatting process.  As we awaiting the final publishing date, let me share an excerpt from the paper, focused on the key ways IAM enables HIPAA/HITECH compliance.

HIPAA/HITECH requirements for privacy, security, auditing and notification are supported directly by IAM. By streamlining the management of user identities and access rights and automating time-consuming audits and reports, IAM solutions can help support strong privacy and security policies across the enterprise and throughout Health Information Networks while reducing the overall cost of compliance.

IAM provides the following key enablers for HIPAA/HITECH compliance:

1. Assign and control user access rights. Securely managing the assignment of user access rights is critical to HIPAA/HITECH compliance, particularly in distributed and networked environments typical of modern healthcare business. Decentralized provisioning is not only inefficient and costly, it also increases the risk of security and privacy violations. Automated provisioning allows centralized control of resources and applications that have historically existed in silos. This provides a much greater level of control over access to those resources. Checking audit policy at the time or provisioning ensures regulatory compliance, thus preventing audit policy violations.

2. Adjust user access rights when responsibilities change. Business risk is introduced when employees change jobs and access isn’t appropriately adjusted or removed. Failing to appropriately adjust or remove users’ access when job changes occur can result in superuser-access and SOD violations. Automated provisioning effectively eliminates many of these risks, especially when combined with auditing and role management capabilities.

3. Revoke user access upon termination. IAM systems can automate the process of immediately revoking user access rights upon termination or suspension. This eliminates a commonly-exploited security gap and opportunity for policy violation that may occur after an employee or contractor has been dismissed.

4. Manage allocation of user credentials. Managing user names, passwords and other user access credentials is essential to assuring that only authorized users are granted access to information systems. IAM technology can provide enterprise-wide control of user credentials, including the enforcement of uniform password policies (e.g. password strength, periodic change).

5. Enforce segregation of duties (SOD) policies. Segregation of duties (also known as separation of duties), has as its primary objective the prevention of fraud and errors. This objective is achieved by disseminating the tasks and associated privileges for a specific business process among multiple users. IAM methods can prevent, detect, and resolve access rights conflicts to reduce the likelihood that individuals can act in a fraudulent or negligent manner. Once violations are identified, notification and remediation steps are automatically initiated based on corporate policies.

6. Provide uniform access policy. IAM can provide administration and enforcement of common user access policies across a wide span of diverse systems, improving executive confidence in how the enterprise complies with HIPAA/HITECH requirements.

7. Manage access based on business roles. Provisioning and auditing at the business role level, rather than just at the IT access control level, ties user access rights more closely to business processes. With a role management solution, managers can approve access rights that have a meaningful business context, thus reducing the risk of managers inadvertently creating SOD violations by granting carte blanche access to their direct reports.

8. Enforce secure access policies. While automated identity administration, provisioning and auditing are essential to HIPAA/HITECH compliance, these methods don't actually enforce the use of security policies when a user accesses the controlled systems. IAM Access Management technology can enforce user access policy at the point of entry to an application or other system, in harmony with established policy. Examples of such enforcement include Web access management (including single sign-on or SSO), enterprise single sign-on (ESSO), and Web service security.

9. Enforce informed consent principles. Informed consent principles (e.g. opt-in, opt-out, notice) can be enforced, based on identities of individual patients and potential users of personal information associated with such data.

10. Extend access control to business associates. Identity Federation can extend access control beyond enterprise boundaries to enable secure access to electronic records while safeguarding the privacy of sensitive information. This is essential to complied with extended requirements of HITECH.

11. Verify access rights. While automated user access provisioning is designed to accurately assign access rights, such access rights should be confirmed by audit. IAM can provide the ability to both assign access rights according to established polices and then periodically verify that access rights are still compliant with those same policies.

12. Conduct periodic compliance assessments. Periodic audits of access rights and privileges can assure that security and privacy policies are consistently enforced. Re-certification is a process where managers approve direct reports’ access to enterprise resources and applications. IAM can provide the ability to automatically present managers with the correct information to attest to each employee's access rights needs. By applying role management principles, this re-certification process can enable the approving manager to work at the business-role level, attesting to those entitlements quickly and accurately because they are given in a meaningful business context.

13. Provide automated reports. The delivery of accurate, timely and complete reports can assess compliance with established requirements. IAM can provide scheduled and ad-hoc compliance reports, including automated violation notifications, comprehensive work flow processes, and audit assessment reports. Such reports can generated across multiple systems and enterprise applications and be submitted to appropriate people within the enterprise, to business associates and to appropriate regulatory agencies.

I’ll share more excerpts soon and let you know when the full paper is ready for download.  Please stay tuned.

Over the past several weeks, I have posted a series of articles about Identity Management Trends and predictions.  This brief post provides an index to that series of posts.

Overview article: Identity Management Trends and Predictions

Individual articles:

1. Market Maturity
2. Authentication
3. Authorization
4. Identity Assurance
5. Roles and Attributes
6. Identity Federation
7. Regulation and Compliance
8. Personalization and Context
9. Identity Analytics
10. Internet Identity
11. Identity in the Cloud

Thanks for joining me in this little exploration.  Any feedback you might have would be most welcome.