Good news from Italy: Piaggio wins award at Kuppinger Cole’s 2010 European Identity Conference

The European Identity Award in the category ‘Best Cloud IAM project’ was conferred to Piaggio, the well known worldwide manufacturer of Vespa scooters, for their use of Engiweb Security’s Identity & Access governance IDEAS solution.

The award recognizes outstanding projects as well as innovations and additional developments of standards. Directly from the awards page:

In the category “Best IAM Project in Cloud Computing”, […] The award was received by Piaggio Group of Italy for a hosted IAM solution based on products by Engiweb and focusing on defined, enterprise-wide business processes […] Both the number of nominees for the European Identity Award 2010 and the quality of the project submitted far surpassed last year. This is seen by Kuppinger Cole as a general sign of increasing maturity in IAM and GRC solutions. Especially notable was the number of nominations in the category “Cloud Computing”, a trend that the analyst group feels will be sure to continue over the next few years.

During the event Piaggio’s representative, Lorenzo Mastropietro, presented the company’s customer case explaining that Piaggio’s aim when they started was that of having a classic Identity Management project and from the beginning they had a clear vision of their business needs. Thus, even if the main targets were Access governance and Compliance improvements, Lorenzo highlighted how even the “basic” password reset functionality was sufficient to justify project investments. As a matter of fact, he is now using these early successful results to support internal marketing activities, in order to more fully involve all stakeholders and gain more support for future development.

Furthermore, thanks to the IM outsourced project, Piaggio does not need internal staff to execute IM operations and does not spend time and resources for its maintenance. The implemented solution makes it possible to delegate a big part of the ICT activities to the Outsourcer, allowing Piaggio to concentrate on aspects linked to business. (policy definition, workflows, role engineering, etc. …).

Vaso di coccio tra vasi di ferro

Blow the trumpets and blow the horns: we’re extremely happy that Engiweb Security has been announced as one of Gartner’s “Cool Vendors” for 2010, in the Application Security category. This is all thanks to the IDEAS platform that, even if could be best positioned as part of the market segment of “Access Governance Platform”, among other things provides additional support for Entitlement Management.

Will this acknowledgment create business opportunities for us in the international market? Will being a Gartner-certified “Cool Vendor” attract potential customers like bees to honey?

How to tell? This market is so strange!

Perhaps I’m a bit too disenchanted, but as a matter of fact, we still have to face a market where more than 60% of the customers do not perform serious “vendor selection” when they need to decide how to implement an identity management project.

As stated in the KPMG/Everett “2009 European Identity and Access Management Survey”, that can be downloaded here:

“When organizations are selecting their required IAM solution, a large amount acquire the solution of their preferred supplier and only 18% perform a vendor selection in order to select a ‘best of breed’ solution”

It is easy to guess who these “very very large” preferred vendors are…. however this may result in a “hidden” failure for the customer: licenses acquired and at once abandoned with no project that was implemented at all! (Hard to believe, but not everybody realizes that the implementation of a project is the biggest cost for an IM initiative).

I’m definitely pessimistic these days…

Anyway we at Engiweb Security have no intention of resting on our laurels… and we have some really cool things planned for the next product releases: Risk metrics/management and XACML support.
------------
Vaso di coccio tra vasi di ferro
This typical Italian expression was probably coined by Alessandro Manzoni who, in the first chapter of his masterpiece “Promessi Sposi” (The Betrothed), writes:

Il nostro Abbondio, non nobile,non ricco, coraggioso ancor meno s’era accorto, prima quasi di toccare gli anni della discrezione, d’essere in quella società, come un vaso di terra cotta, costretto a viaggiare in compagnia di molti vasi di ferro.
(Translation: Our Abbondio, not noble, not rich, not courageous, was therefore accustomed from his very infancy to look upon himself as a vessel of fragile earthenware, obliged to journey in company with many vessels of iron.)

The metaphor is clear: the vessel of fragile earthenware (Vaso di coccio) surrounded by many iron vessels (vasi di ferro), during a journey along a dirt road can easily be broken at the first little impact. Nowadays this expression describes a tricky situation where a person finds himself as a minority among hardened opponents.

See you at European Identity Conference ’10?

In Munich, for "European Identity Conference 2010" next week?

KuppingerCole European Identity Conference 2010 starts this coming Monday in Munich - Germany. It is Europe's largest Conference on Identity & Access Management with more than 50 exhibitors.
I'll be there looking to share, learn, get news and ideas. Engiweb Security will also be present with a booth in the exposition area and a number of IM experts available for any related inquiries.

We are involved in several sessions, you can look at the complete agenda here.

Also our customer Piaggio (yes, the manufacturer of the legendary Vespa scooter) will be presenting a case study based on its Managed IM Service Project at 11:00 on Wednesday, May 5. It will be a highly informative speech, so I hope you will attend.

Back to Blogging

After a long period of inactivity, due to several internal and external factors, here I am ready to write about Roles and Identity Management again!

It has been almost a year since my last post. During this period, I haven’t had a lot of time for things like the blog, and this was a big mistake for various reasons. One of these being that since Engiweb Security is an engineering-focused organization that has not given a lot of attention to marketing, this blog can (among other IdM related considerations) try to support efforts to raise its profile and properly position Engiweb Security in the marketplace.

While I was gone, there have been a number of notable movements in the market, and many of the latest announcements involve IAM: Oracle swallowing up SUN, Gartner taking over Burton Group, etc…
In the meantime it looks like the Role Management bandwagon is as hot as when I started neglecting this blog months ago.
Furthermore, Engiweb Security is in the process of better positioning its offer in order to avoid possible miscommunications or challenges to our potential clients.

In a week or so, I’ll post a blog about the evolution of IDEAS (our Identity &Access Governance solution) and our latest partnership deals.
I also still plan on posting articles about current IdM debates. For instance, I find the ABAC-RBAC heated debate very exciting, and it still arouses my curiosity. BTW why are they still using the “Role Explosion” hackneyed and false excuse to justify that RBAC is not usable?

Anyway… back to us! For now, the Engiweb team has published new academic papers for the security community, describing the conceptual model used in the IDEAS solution in detail.

• A. Colantonio, R. Di Pietro, A. Ocello, and N. V. Verde. “Taming Role Mining Complexity in RBAC”. Computers & Security, Challenges for Security, Privacy & Trust (special issue), Elsevier, 2010.
• A. Colantonio, R. Di Pietro, A. Ocello, and N. V. Verde. “ABBA: Adaptive Bicluster-Based Approach to Impute Missing Values in Binary Matrices”. In Proceedings of the 25th ACM Symposium on Applied Computing, SAC '10, Sierre, Switzerland, March 2010.
• A. Colantonio, R. Di Pietro, A. Ocello, and N. V. Verde. “A Formal Framework to Elicit Roles with Business Meaning in RBAC Systems”. In Proceedings of the 14th ACM Symposium on Access Control Models and Technologies, SACMAT '09, Stresa, Italy, June 2009.

If you are interested in receiving the full texts, please send me an e-mail: my surname at eng dot it.

In Munich, for "European Identity Conference 09" next week?

The Kuppinger Cole European Identity Conference 09 will take place on May 05 - 08, 2009 in Munich - Germany. It is Europe's largest Conference on Identity & Access Management with more than 50 exhibitors.

This event is a great networking opportunity for smart, innovative, and forward thinking people to get together to learn about and discuss today's most significant technology topics on IAM.

Complete details are available here, so come visit Engiweb Security's booth, or attend one of the three panels were we will be speaking.

Also, Engineering Ingegneria Informatica will be presenting a case study based on our IDEAS Platform at 15:00 on Tuesday, May 5. It will be a highly informative speech, so I hope you will attend.
I hope to see you next week.

Alessandro strikes again!

Two new Technical Papers, “Mining Stable Roles in RBAC”, and “A Probabilistic Bound on the Basic Role Mining Problem and its Applications” have been recently accepted and will be presented, by my colleague Alessandro Colantonio, at the coming IFIP/SEC-2009- 24th IFIP International Information Security Conference, Pafos, Cyprus, May 18-20, 2008.

I am not an expert in the used theoretical and mathematical concepts, but I find the global effort to minimize complexity very insightful. Clearly, keeping the number of different roles sufficiently small is an important aspects. But there are many other aspects being equally important, in particular roles should reflect the organizational structure, should be acceptable by human users, easy to update, and should consider business constraints. The papers highlight some basic features on which Engiweb Security “IDEAS Role Constructor” module is based.

The abstracts:

A Probabilistic Bound on the Basic Role Mining Problem and its Applications
In this paper we describe a new probabilistic approach to the role engineering process for RBAC. In particular, we address the issue of minimizing the number of roles, problem known in literature as the Basic Role Mining Problem (basicRMP). We leverage the equivalence of the above issue with the vertex coloring problem. Our main result is the proof that the minimum number of roles is sharply concentrated around its expected value. A further contribution is to show how this result can be applied as a stop condition when striving to find out an approximation for the basicRMP.
We also show that the proposal can be used to decide whether it is advisable to undertake the efforts to renew an RBAC state. Note that both these applications can result in a substantial saving of resources. A thorough analysis using advanced probabilistic tools supports our results.
Finally, further relevant research directions are also highlighted.

Mining Stable Roles in RBAC
In this paper we address the problem of generating a candidate role set for an RBAC configuration that enjoys the following two key features: it minimizes the administration cost; and, it is a stable candidate role-set.
To achieve these goals, we implement a three steps methodology: first, we associate a weight to roles; second, we identify and remove the user-permission assignments that can not belong to a role having a weight exceeding a given threshold; third, we restrict the problem of finding a candidate role-set for the given system configuration using only the user-permission assignments that have not been removed in step two (that is, user-permission assignments that belong to roles having a weight exceeding the given threshold). We formally show-proof of our results are rooted in graph theory-that this methodology achieves the intended goals.
Finally, we discuss practical applications of our approach to the role mining problem.

Authors: Alessandro Colantonio, Roberto Di Pietro, Alberto Ocello, Nino Verde.

If you are interested in receiving the full texts, please send me an e-mail: my surname at eng dot it.

Musings on Bruno Munari thoughts

Last Sunday I was walking downtown in the historical center of Rome, and as I was strolling along the Tiber river I came across the Ara Pacis Museum. These days the exhibit area inside Ara Pacis is hosting an exhibition on Bruno Munari.
The new museum, designed by the Richard Meier architect is quite charming: I like its pristine structure that is full of light, but what really touched me was the Bruno Munari exhibition.
In fact Munari’s works and his attitude of whimsy and sheer inventive imagination were actually venerated by me when I was a kid.

From the catalog:

“Munari’s life (1907-1998) and career spanned the 20th century, and he was among the most seminal exponents of Italian design and graphic design. Yet he never received the accolades and recognition on an international scale that he so richly deserved. What sets Munari apart from other designers is that he engaged in a quiet, playful revolution, inventing and designing with humorous and modest creativity, challenging all conventions and stereotypes intelligently but without flamboyance.”

But let me tell you why I’m speaking of Bruno Munari in this blog.

Walking along the exhibit set course, I noticed some of Munari’s sentences on the walls, and among them one in particular attracted some attention:

“Progresso è quando si semplifica, non quando si complica”
“Progress is when things get simpler, not more complicated”

I like to use quotes to mix things up: in this case Bruno Munari reminds me of the aggregation (and/or acquisition) processes currently taking place in the Identity Management space.
We, as all vendors, are supporting our customers move from automating infrastructure procedures (that is meta-directory services, basic identity administration and access management) to enabling business processes, towards the satisfaction of the new requirements for Governance, Risk and Compliance (GRC).
Thus most vendors started down that path of adding new features, and new modules; often with the shortcut of specialized company acquisitions.

And the result is. ......Yes, for sure we are allowed to check the coarse grain Role checkbox in RFP's, and if the prospect asks for a POC we can always mask the mess, ..... and in parallel: let’s pump cosmetic marketing campaigns.

So if the product isn’t built, since the beginning, around a data model that is able to natively manage all processes linked to identity, role life cycles and access governance, just two alternatives are available:

• Rewriting from scratch the product around a coherent and complete data model;
• Try immediately to trim the fat, hide the complexity and hope that the discrepancy that exists will definitely be decreased in the next releases and beyond…

What is happening in the present Enterprise Role management vendor acquisition fever is quite typical.

Is it possible to really integrate an Identity Management solution with an Advanced Role Management solution? And what are the risks associated with this two-headed architecture?

I will write more about this in the next post and try to explain our idea of integrated solution that is able to natively support all the needed features in a scenario, where Advanced Role Management capabilities together with strong Authorization Management is gaining momentum