Marines can’t use Twitter or Facebook on duty, but soldiers and sailors can. For airmen, it depends on the base.
As for YouTube, the Air Force has created its own channel – which can’t be accessed from work computers.

A lot of people in favor of social media use (including yours truly) view it as an important communication and PR tool, providing some much needed openness and transparency in a time of record low recruitment and mistrust. It is also viewed as a weapon for the military to take back the narrative regarding the wars in Iraq and Afghanistan from the hype-driven media. The rate at which information can be gleaned from these media makes them effective early-warning systems on all manner of critical events – from earthquakes to civil war and revolutions. And don’t forget how incredibly useful it is as a tool for our troops to stay in contact with friends and loved ones. For a much better, insider take on how critical the use of social media is to our national security, read this extremely well-written article in the Federal Times.

I shared the story on twitter, along with my opinion that the ban was the wrong approach for the military to be taking. Brad Tumy challenged me to explain why I thought it was the wrong approach, and what I think they should be doing instead. I promised I would address his question in a blog post soon, so here goes.

Lets take a look at some of the main reasons given for banning social media.

1) Bandwidth Issues

The amount of bandwidth sucked up by YouTube, Facebook and the like puts a strain on limited DoD resources. But today, network tools that monitor bandwidth usage and throttle the traffic based on conditions are quite common. And using geolocation and device identification to cut off access on machines being used in the field (that use extremely limited satellite-based bandwidth) is technically possible (and as someone I met at Catalyst told me in a different context, is being done every day).

2) Spread of Malware

Highly publicized incidents like the Koobface worm spreading via Facebook have led some of the security experts to consider these sites to be tremendously dangerous to the integrity of the DoD networks. But the malware threat from social media is nothing compared to the attacks the DoD has to fend off on a daily basis via sanctioned channels, namely email and so called “good” websites. And the tools to protect against the malware attacks are well understood and widely deployed. Most folks learn pretty quickly to identify and ignore malware messages, no matter what the medium. And cloud-based social media sites will do a much better job of cutting an attack off at the knees than thousands of distributed email systems ever will.

3) Information Leakage

In providing their reason for banning social media, the Marine Corps said

the very nature of social networking sites creates a larger attack and exploitation window, exposes unnecessary information to adversaries and provides an easy conduit for information leakage.

This is probably the most serious cause for concern, and one where IAM and Security technologies can play a crucial role. In many cases, the challenge here is similar to the one faced when dealing with any communication channel, whether it be email or ftp. Many enterprises rely on Security Information Management to protect their most sensitive resources – their data. A well established Identity Management infrastructure provides the first layer of protection by ensuring that only authorized individuals have access to sensitive information, and then providing a complete audit trail around the access of that data. This has been shown to have a deterrent effect in information protection, and can assist in tracing back the source of a data leak. DLP (Data Leakage Protection) tools provide data security by enabling data identification, classification, usage and wrapping controls around it all. Firewalls are getting increasingly sophisticated (take a look at Palo Alto Networks, which is getting traction with a content inspection engine that can “accurately identify applications … and scan content to stop threats and prevent data leakage“). The fact that Facebook and Twitter have APIs that allow the creation of custom clients means that users can be given access in a secure way through apps developed by the military. And there is commercial software out there that does much the same.

Now, the way I see it, the armed forces are facing the exact same dilemma that most enterprises are facing when considering how to tackle the use of social media in the workplace. The only difference is in the amplification of the potential consequences. Exploitation of the attack window that social media use creates could lead an enterprise to lose a lot of money, but in the case of the armed forces it could lead to serious loss of life. That does mean that while the issues are the same, the risks are vastly different. This would necessitate a completely different risk mitigation strategy. But does that mean that the solutions that can help would change too?

A blanket ban such as the one being discussed would lead you to believe that there exists no ability to handle what are essentially security and access control issues in the system, and that simply is not the case. I’m not saying that it is perfect, but a combination of tools, policies and guidelines can make it possible for social media to be leveraged by the military in ways that serves their (and our) national cause without harming their mission. And that would be to everyone’s benefit.

If you ever saw the movie “Breach” about how Robert Hanssen leaked national secrets by photocopying files and carrying them out in his bag, just think of how much more quickly he might have been caught if he had been sending those files over a social media connection. USB drives and email are far bigger threats (right now) than social media. and by being proactive, the military can turn these tools to their advantage. On the other hand, by not playing in one of the emerging technologies in the market, the US military risks becoming outdated, outmoded and outplayed by our adversaries.

Tags: Data Leakage Protection, DLP, Facebook, Firewall, Identity Management, Military, Oracle_IDM, Social Media, Social Networking, Twitter

Predictions are risky business, especially in the slightly schizophrenic world of IdM. On the one hand, things tend to move way too slowly; on the other hand, things emerge out of nowhere to take center stage. So I tend to shy away from making predictions. But I will talk about what I hope to see happen in the coming year. These are not impractical, fantasy wishes that will require me to find a magic lamp buried in the sand. These are things that have a good chance of happening if we as an industry stay focused.

Integrating Risk Management with Identity Management
Recent events have brought to light the need to build comprehensive integration between risk management and identity management software. Oracle’s acquisition of Bharosa last year was a response to marketplace demand to bring more context into the identity management process. There is a better understanding of the complex heuristics that need to become part of identity management decisions, and how to encapsulate them as workflow and rules. The coming year should bring more tools and more capabilities in these areas.

For the longest time, people would talk about integration in the context of product suites. The focus will now shift to integration in the context of pre-canned and pre-defined solutions and workflows.

Role Management Comes Into Its Own
Over the last couple of years, we have seen Role Management become an established part of identity management. But its real value will be realized when it stops being an explicitly deployed and managed part of IdM (a la access management) looking for consumers, and evolves into a business tool that is deployed within the enterprise context of provisioning, entitlement management and ERP. A number of other folks have already challenged vendors to do this, and hopefully a lot of work going on in this area will come to fruition.

The Evolving Identity Framework
There are a couple of things I hope to see happen this year that will help us move towards our ultimate vision of how identity is used.

• The Identity Services message has been very well received every time I have presented it. In the last year I met a number of individuals, like the folks from the Jericho Forum, the Concordia project, and a number of people at various conferences, who are really committed to changing how Identity becomes part of application development and deployment frameworks. Hopefully the coming year will see some concrete progress made in defining the necessary framework architecture that will enable the externalization of identity from applications
• We have seen everybody and their mother make moves to become OpenID Service Providers, especially the big identity silos. Hopefully this year will see an explosion of services that are OpenID Relying Parties, including some of those same big players. The real adoption of OpenID will come not from the glut of OpenID SP’s, but from the widespread availability of services that accept OpenIDs and do not require registration and username/passwords.
• I also hope to see someone take the Identity Oracle concept and create a viable business out of it. It may not explode right away, but it will start to emerge. It seems obvious that the easiest place for this to happen is in social networking applications like Facebook. They already hold a lot of identity information that they then serve to other applications (those annoying, currently non-critical Facebook apps that clutter everyone’s profile). Putting in place more controls on how my information is shared and with which apps, and then opening the walls to outside applications would be a logical progression in the evolution of identity providers for internet applications. I also hope to see the Identity Governance Framework become part of such a control framework in any Identity Oracle.
  And then hopefully at the start of 2009 I will be commenting on my hopes for the acceptance of internet identity framework tools within the enterprise.

Your Hopes
What are your hopes for the coming year? Leave a comment, or email them to me, so that we can add them to this list. and hopefully take notice.

Tags: Entitlement Management, Facebook, Identity Governance Framework, Identity in Social Networking, Identity Services, IGF, OpenID, Personal Identity Management, Role Management

Most of today’s social web applications (like MySpace and Facebook) are persona-based, not identity-based. What I mean is that these applications don’t really care about who you are, they only care about letting you be what you want to be within their context. So, it is not surprising that a 47 year old woman was able to pose so devastatingly as a 16 year old boy, because in essence that is what MySpace was built to be – a way to express a persona of your choosing.

Why don’t these applications, that know the kind of impact they can have (we all understand the threat predators pose online) on a persons life, care about who you really are? Because, bluntly put, they can’t. It is not possible for them to do that in a scalable, cost-effective manner. The lack of a solid identity framework for the internet prevents these applications from being truly identity-based. We have seen a push towards heavy-handed identity verification mechanisms (see my earlier post about identity verification in Second Life), but those solutions are so costly (time, infrastructure, cost) as to be impractical for most web applications. This kind of model will effectively curtail the free-wheeling collaborative spirit prevalent in the current generation of internet apps, and throttle innovation. If you had to stand in a line somewhere for 4 hours, and had to show your passport to someone, just so you could sign up for a Twitter account, would you?

A one-size-fits-all approach is not the answer. The correct solutions in life only come from taking a balanced approach to the problem. Nothing is more annoying to me when adding a Facebook app than being
required to check the box agreeing to share my information with the
app, even though I know that it doesn’t need any of it, and most likely isn’t using it at all. Consequently, I avoid adding those apps unless I really want to.

This is where pieces like Bob Blakely’s Identity Oracle, the Identity Services model, Burton’s Limited Liability Persona, the IGF and user-centric methodologies have to all fit together. We do need strong identity verification mechanisms, but we shouldn’t need to go through that for every single site we want to use. Indirection is the solution to many a problem, and the right identity framework for the internet is the necessary thing to have this identity verification feed into a platform level identity that multiple applications can build on.

This is also needed as a necessary step to support pseudonymity online. The goal of an identity framework is not to prevent people from creating online personae that are
divorced from reality. It is to give applications the ability to create
suitable boundaries within which such a persona can be created. Using this,
an application like MySpace, where the identity consequences can be so
devastating, can choose to, for example, prevent people whose identity
is in the 30+ age group from creating a persona that is in the 10-20
age group.

Like so many things in modern life, we have gotten immune to all the horror stories of online predators. Until a story like this comes along to remind us that these are important things that we are working on, and we need to get it right.

Tags: Facebook, Identity Governance Framework, Identity in Social Networking, IGF, Megan Meier, MySpace, Personal Identity Management, User-Centric Identity

“When we talk about the social graph we are talking about the set of connections, friendships, business connections, acquaintances, that everyone has in the world… We are trying to take the social graph that exists in the world and try to map it out… We have a model of social graph that we are constructing.”

At least he has the concept right.

You can read the New York Times BITS blog post here.

Tags: Facebook, Personal Identity Management, Social Graph

In an interview that he gave to Saul Hansell for the BITS blog of the NYT, Dan Nye, the chief executive of LinkedIn, said the following about the emerging idea of a social graph for the web:

“When people tell the story that there will be one graph they are crazy,” he said. “These are different platforms that are built for different purposes, with different members and different relationships between them.”

Isn’t that kind of the reason we need a social graph? There are too many platforms for too many different purposes. But just like we want to have one identity (with multiple personas) that can be selectively used on different parts of the web, we also want to have one social graph that maps all my relationships, and then gives us the power to share certain relationships or relationship types with certain services.

Dan Nye sounds like he believes in the business model of silos. The need for a social graph for the web is similar to the need for a personal identity infrastructure for the web. Both are aimed at breaking down the silos that currently hold our identities and relationships hostage. It is a little tiring to have to become friends with the same people in multiple social networks (I personally have had to do that on both LinkedIn and Facebook).

Or does Dan Nye think that co-workers and professional contacts cannot also be friends?

Seems to me that Dan doesn’t understand the idea behind the social graph. Anyone who wants to know more should check out the following links:

• Brad Fitzpatrick & David recordon on “The Social Graph and Social Network portability“
• Microformats Wiki
• Phil Hunt on “Social Graph Search & Social Network Portability“

Interestingly enough, Google seems to be about to jump into the social graph discussion. Check out this other BITS blog post about Google’s thoughts on the relevance of the social graph in improving search.

Tags: Facebook, Identity in Social Networking, LinkedIn, Personal Identity Management, Social Graph, User-Centric Identity

Pamela Dingle blogged about the basic dilemma that most of us faced when we first signed up – our disinclination to give up (what we feel) is too much information in the form of the overwhelmingly abused and dreaded “date of birth”. To say that Facebook needs a way to verify that you are of age is an understatement (as anyone who has been perusing the blogosphere would know from the number of posts regarding predators on social networking sites). Yet the age-old technique of “give me your date of birth and click this check box to assure me that it is correct” isn’t a reliable form of identity proofing. That is in no way a deterrent to those kids intent on joining the next cool hangout. And it creates one more potential source of PII for hackers and identity thieves. Kim Cameron said that he gave his digital date of birth during sign up, one that has little to do with his real birthday. And the cause for concern is legitimate because we don’t know where the data is going (See my rant in “Why Social Websites are really Faux-Social” about the lack of control around what data gets shared by Facebook with 3rd party applications). Anyone can create an application on the Facebook Platform and immediately start harvesting PII data.

My experience with Facebook has also brought up another thing that bugged me – the lack of support for a digital persona. Pamela touched on it indirectly in her most recent Facebook related post. Most sites give me no way to partition my online identity with them into clearly separated personae. Again an example of how “social” in the online world doesn’t quite mirror that  of the real world. In reality, most of us keep our personal and our professional lives separate, with few overlaps. The delineation is extremely important, allowing us to express and indulge our personal freedom without an impact on our professional sphere of life. And we all have some experience, however minor, of the consequences of any blurring of that line.

A site like Facebook offers no such separation. Unlike LinkedIn, a site like Facebook covers both my personal and my professional spheres. While I would like to connect with my friends and relatives that are on Facebook, I do not want those (highly personal and potentially embarrassing in the wrong context) interactions to be visible to my professional contacts. Yet I have no way of creating different personae that govern my different relationships -  just one more example of the “All or Nothing” approach to social networking that is so pervasive right now.

Maybe I’m an oddity in this age of tell-all openness. But I think a poll of most of the Facebook netizens who are also working professionals would reveal a desire for persona management as part of their online experience.

Tags: Digital Persona, Facebook, Identity in Social Networking, Personal Identity Management, User-Centric Identity

In the article, he discusses an experiment that the folks at Wired did to try and build a social website like Facebook using freely available tools and widgets. They were able to get to about 90% of Facebook functionality, but the missing 10% was the most important part – the ability to link people in relationships.

Scott attributed the failure to the lack of “a generalized way to convey relationships between people’s identities on the internet”. But doesn’t that first require that we have a generalized way to represent people’s identities on the internet?

Let’s face it, relationship silos are really just extensions of identity silos.  The problem of having to create and re-create my relationships as I go from site to site mirrors my problem of having to create and re-create my identity as I go from site to site. The Facebook Platform might have one of the better Identity Provider APIs , but all the applications built on it still have to stay within Facebook itself.

There seems to be an opportunity for someone to launch a service that allows people to connect their OpenIDs using an appropriately named, tagged relationship. This could then be used as the basis for friend-style relationships in social applications. Of course, that would eliminate one of the big reasons most of these sites have experienced the growth they have – I’m on it cos my friends are on it. But it’s the same argument for not wanting to be limited by the MYG silos.

<aside>

When you choose to add an application to your profile within Facebook,
it gives you a nice message telling you that it will share your
information with the application, but never what information it will
share. Essentially it is an open-ended invitation for the application
to look at my whole profile, even if the only thing it should really
have access to is my preference of music so it can put an appropriately
blinged out icon on my page. The lack of granularity here makes it
decidedly non user-centric as far as I am concerned. Perfect place for
an IGF style governance document. Every application should declare what data from my identity profile it needs, and why. That way if the ‘Book of the Month’ application wants my political leaning, I can agree to give that
information knowing fully well it won’t get my birth date.

</aside>

Tags: Facebook, Identity in Social Networking, Personal Identity Management, Social Graph, User-Centric Identity

• Facebook demonstrates that opt-out privacy does not work.
• Fears over Facebook identity fraud

Both illustrate how the world that identity management operates in is changing rapidly, and that IdM needs to keep up.

The first article clearly points to the behavioral patterns that those entrusted with protecting users identity and privacy should understand. You can’t rely on users to protect themselves when they don’t know that they are at risk. Teenagers growing up with these technologies will have an inherent trust in these systems, and so the technology must learn to empower the user, not by giving them enough rope with which to hang themselves, but rather by giving them the right controls to determine correctly how they want to handle their information. In other words, adopt a more user-centric model (boy, I can hear the flames coming for that one).

The second article points to a far more subtle but important fact of digital life. The nature of “identity secrets” is changing. Once commonly accepted secrets for verifying a persons identity (like “mothers maiden name”, “city you were born in” or “the first car you ever drove”) are no longer secret in the age of blogging and tell-all MySpace pages. Bob Blakely put it out there pretty bluntly in a talk he did at Catalyst called The End of Secrecy – “You have no secrets anyway, get over it”. While he was talking about the nature of privacy, it also applies in a much more mundane way to the identity systems in play today – reliance on the same old model of individual secrets is not only passe, it is downright dangerous.

The new model being proposed nowadays is commonly encapsulated in the phrase “What I Have, What I Am, What I Know“. What I Have usually refers to some kind of strong authentication token (smart card, token, USB key). What I Am is an extension of the previous in the form of some biometric identifier (fingerprint, retinal scan, voice recognition). What I Know is a secret (password, PIN, mothers maiden name). As can be seen, the model still relies on a secret, but that has been bolstered by two other factors of authentication. While this is good enough for now, it does seem that new techniques will need to be discovered as increasing computation power and better technology weaken the other two factors over time.

Who knows, maybe the next big thing in identity management will be behavioral pattern analysis (”What I Will Do“) as a form of authentication (see the work being done at the University of Ottawa on a technology they call 3D Password).

Tags: Authentication Management, Burton Catalyst Conference, BurtonGroupCatalyst07, Facebook, Personal Identity Management