Facebook

Oct 8 2009   9:18PM GMT

OpenID pilot project for identity management starting up at NIH

Posted by: Alexander Howard
OpenID Foundation, Google, Yahoo, Facebook, National Institute of Health, MySpace, United States, AOL, OpenID, Identity management, authentication, NIH, privacy

As I reported last month, the U.S. federal government will try using OpenID as a federated identity framework for .gov authentication.

“The OpenID and .gov project’s goal is to make government more transparent to citizens,” said Don Thibeau, executive director of the OpenID Foundation at the OASIS Identity Management 2009 conference, referring the audience to IDManagement.gov.

There are now more than 1 billion OpenID-enabled accounts, according to Thibeau, with more than 40,000 websites supporting the framework, including technology companies Google, Yahoo, Facebook, AOL, MySpace, Novell and Sun Microsystems.

The OpenID identity management pilot at the National Institutes of Health (NIH) will be limited to conference registration, wiki authorization and library access, which require only Level of Access (LOA) 1 authentication.

Debbie Bucci, the integration services center program lead at the Center for Information Technology at NIH, talked about the success of existing identity management frameworks for authentication at the institute.

Bucci is cautious about implementing OpenID but sees utility in federated identity, given the success of InCommon, an identity framework at NIH. She expressed support for the “idea that you could take the same username and password and spread it around the business units.”

According to Bucci, NIH’s systems have more than 35,000 users, 250 service-level agreements and handle over 1 million transactions every day, 83% of which are external. Current user participation for InCommon is 21%, focused on higher education and research. The NIH’s electronic research administration supports more than 9,500 institutions and agencies, according to Bucci. By contrast, InCommon includes 165. More information about these identity management programs can be found at Federatedidentity.nih.gov.

According to Peter Alterman, senior advisor for strategic initiatives at NIH, the institute is continuing to work toward implementation of the Electronic Signatures in Global & National Commerce Act, also known as E-SIGN.

According to Thibeau, the core design principle for the trust framework is “openness,” meaning it will be open to all identity providers, qualified auditors, provider certification and evolution. He says that both the OpenID and Identity Card Foundations are working to collaborate with Harvard University’s Berkman Center and the Center for Democracy and Technology (CDT) to further expand the open trust framework.

That latter relationship may be important, as the CDT’s Schwartz said that “at Level 3 [access], we have a lot of concerns. If you don’t have limitations there, there will be a drive to ask for as much information as you can get.” Many high-priority citizen-to-government transactions are classified as LOA 3 or higher, including IRS tax filing, Social Security and Medicare. Given that limitation, there may be some roadblocks to address before government agencies that must address compliance under the Privacy Act implement this federated identity management framework.

Questioned about time frames and implementation metrics, Thibeau said in an email interview to “remember the effort under way is a pilot; a very deliberate beta test of new technology protocols, new integration and interoperability task. We don’t know when we will finish, but we do know we will make mistakes and wrestle with usability and security issues.

”Given all the players involved, it’s hard to say what will be completed and when. The most valuable new piece is how many people and many organizations are coalescing around a practical and far-reaching solution set for the challenges of identity from a user perspective. This goes beyond the tired truisms that often characterize privacy versus security debates. There is a real hunger for real solutions in identity authentication. Whether you frame it as open government, open source or open identity, there are powerful political, public and commercial drivers at work involving identity on the Web. The legal and policy discussions around open identity trust frameworks are a leading-edge indication that practical solutions are in play and
pragmatic (private and public sectors) organizations are involved.”

Thibeau was clear about the stage that the pilot is currently in. “We are at the beginning of a shakedown cruise on two tracks,” he said, referring to both the open source identity technologies and the open trust framework itself. “Both are parts of the GSA ICAM schema and both are on the agenda of the OpenID Foundation and Identity (IDF and ICF) boards to consider. They still have a review of and decision making around certification requirements, operations and strategy. As we begin technical testing of government pilots, we are also finalizing the certification of a trust framework process that is a critical element in government adoption and seen by some industry leaders as applicable for high value commercial applications.

Thibeau went on to explain that “the U.S. government is still finalizing requirements for credible, independent and industry standards-based identity certification.” The process holds interest beyond the borders of the U.S. as well, according to Thibeau. “Many international governments as well as U.S. state and local governments are studying the U.S. ICAM test of its ‘schema’ of technology protocols combined with industry self certification models. Identity provider certification of Open Trust Framework models have gained momentum after recent meetings with the Center for Democracy in Technology and feedback from various government agencies, including the GSA ICAM leadership, NIST, NIH and the national security staff in the White House.”

John Bradley, the chief security officer at ooTao Inc, serves on the OASIS XRI, XDI and ORMS Technical Committees and fielded questions about the details of the OpenID pilot at NIH. For more information, Bradley’s blog includes many useful links on the OpenID in government project.

Sep 11 2009   1:54PM GMT

Messina and Recordon explain OpenID authentication and .gov websites

Posted by: Alexander Howard
CIO, OpenID Foundation, Open source, Facebook, David Recordon, OpenID, Chris Messina, Vivek Kundra, #g2s, #gov20

This week, U.S. CIO Vivek Kundra announced a pilot program that will allow people to log in to government websites using OpenID authentication and InfoCard technology. In the video embedded below, open source advocate Chris Messina and David Recordon, senior open programs manager at Facebook, discuss the details of the announcement and how the OpenID authentication mechanism will work. Both Messina and Recordon sit on the board of the OpenID Foundation. The interview was recorded by SearchCompliance.com associate editor Alexander B. Howard at this week’s Government 2.0 Summit in Washington, D.C.

Aug 18 2009   4:53PM GMT

3 social media questions for compliance officers to consider

Posted by: Alexander Howard
Facebook, Social network, Twitter, LinkedIn, social media, Online Communities, privacy, compliance

My recently published series on online privacy and social media compliance is resulting in some feedback from our audience, as you might imagine. Scott Crawford, managing research director for Enterprise Management Associates, posed three questions that I believe are useful for anyone working and using social media to consider.

Navigating these boundaries will be a tricky dance for all as advice and professional services are offered over social media platforms, whether they are Twitter, Facebook, LinkedIn or [X] other social network. Crawford’s comments follow.

“I personally think one of the biggest issues with social networking will not be as cut-and-dried as a lot of these recommendations make it sound, however – namely: What clearly distinguishes personal from professional information shared via social networking sites? What are the boundaries of personal expertise and corporate IP? Can those necessarily be deduced in all cases where social networking is the vehicle? How much of the individual’s personal identity overlaps with corporate identity? This is likely a particular concern where personal expertise is the primary stock-in-trade of the enterprise, as with consulting organizations. Despite the apparent conflict, social networks are popular outlets for consultants, for example, since they not only help promote personal expertise but showcase it in a very personal way. Although you’ve offered some excellent examples of common sense distinctions between personal and acceptable corporate use, I suspect a number of cases will come forward that are not so clear-cut — and even where the case appears to be clear-cut, I would fully expect legal counsel to vigorously exploit any lack of clear distinctions that may be found in a particular case.”

If you have answers to Scott’s questions, please leave a comment, send feedback to editor@searchcompliance.com or @reply to @ITCompliance on Twitter.

Jun 25 2009   6:51PM GMT

Add Twitter security to the top information security threats

Posted by: Alexander Howard
Twitter, Facebook, LinkedIn, RSA Conference, identity theft, Social Enterprise, Social network, malware, Information security

Last week’s 140 Characters Conference presented dozens of examples of how people are using Twitter creatively, effectively and disruptively. What didn’t get as much attention are the security risks and compliance challenges Twitter presents as the wildly popular microblogging platform continues to see adoption by enterprise users.

I talked with Erin Jacobs, chief security officer for UCB Inc., about Twitter security. If you haven’t found her on Twitter yet, she tweets as @SecBarbie. She sent her list of top information security threats about Twitter to us via email, which we published below.

---

Information leakage
Corporate networks try to protect themselves from email, IM and other means of sending information outside of the network. There are new services for updating Twitter popping up daily, so it is impossible at this time to completely block the ability to access Twitter. Network security professionals are constantly racing to fill in the holes to ensure that information cannot be leaked. Information leaks could include:

• Identity information from inside organizations.
  • Identity theft
  • Credit card fraud
  • Account numbers
• Business IP leakage.
  • Business plans
  • Code leakage
  • Copyright infringement
• Facility information.
  • Business operating hours could be used in targeted physical theft attacks.
  • Personnel locations or schedules.

Malware/viruses/Oh-MY!
Since Twitter communicates over port 80 and 443, there really isn’t much to protect users from inadvertently bringing malicious code into the network. Bit.ly and other URL shorteners can easily send users to different addresses than the user expects.

Improper use of Twitter
Direct messages are not secure email. Education about potential vulnerabilities is essential for executives and top-level management to understand that they must keep business off of Twitter. Issues around human resources and online harassment are also a consideration.

---

After Erin wrote in, I used Twtpoll to ask my followers on Twitter the same question, using her list and adding a few other options.

You can vote on what your primary Twitter security concern is on Twtpoll. The results, as of today, are embedded below:

As you’ll see, insecure third-party apps leading to stolen accounts is (currently) the top answer – it’s an issue of natural concern to Twitter users. Coming in second, however, was Erin’s concern over data leaks of confidential or proprietary information. Information security threats are at the top of on any CISO’s list; add Twitter security to the list.
Each of these information security threats are valid for other social networking platforms or services as well, like LinkedIn and, in particular, Facebook. Issues around Twitter security and social media in general were frequently discussed at this past week’s Enterprise 2.0 Conference in Boston and, at the RSA Conference earlier this year, where Web application security was at the top of the information security threats list.