<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.feedburner.com/~d/styles/itemcontent.css"?><rss xmlns:geo="http://www.w3.org/2003/01/geo/wgs84_pos#" version="2.0"> 
	<channel> 
		<title>Kuppinger Cole + Partner</title> 
		<link>http://www.kuppingercole.com</link> 
		<description>Kuppinger Cole + Partner</description> 
				<geo:lat>48.13</geo:lat><geo:long>11.56</geo:long><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" href="http://feeds.feedburner.com/kuppingercole" type="application/rss+xml" /><feedburner:emailServiceId xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0">kuppingercole</feedburner:emailServiceId><feedburner:feedburnerHostname xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0">http://feedburner.google.com</feedburner:feedburnerHostname><feedburner:feedFlare xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" href="http://add.my.yahoo.com/rss?url=http%3A%2F%2Ffeeds.feedburner.com%2Fkuppingercole" src="http://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo4.gif">Subscribe with My Yahoo!</feedburner:feedFlare><feedburner:feedFlare xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" href="http://www.newsgator.com/ngs/subscriber/subext.aspx?url=http%3A%2F%2Ffeeds.feedburner.com%2Fkuppingercole" src="http://www.newsgator.com/images/ngsub1.gif">Subscribe with NewsGator</feedburner:feedFlare><feedburner:feedFlare xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" href="http://feeds.my.aol.com/add.jsp?url=http%3A%2F%2Ffeeds.feedburner.com%2Fkuppingercole" src="http://o.aolcdn.com/favorites.my.aol.com/webmaster/ffclient/webroot/locale/en-US/images/myAOLButtonSmall.gif">Subscribe with My AOL</feedburner:feedFlare><feedburner:feedFlare xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" href="http://www.bloglines.com/sub/http://feeds.feedburner.com/kuppingercole" src="http://www.bloglines.com/images/sub_modern11.gif">Subscribe with Bloglines</feedburner:feedFlare><feedburner:feedFlare xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" href="http://www.netvibes.com/subscribe.php?url=http%3A%2F%2Ffeeds.feedburner.com%2Fkuppingercole" src="http://www.netvibes.com/img/add2netvibes.gif">Subscribe with Netvibes</feedburner:feedFlare><feedburner:feedFlare xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" href="http://fusion.google.com/add?feedurl=http%3A%2F%2Ffeeds.feedburner.com%2Fkuppingercole" src="http://buttons.googlesyndication.com/fusion/add.gif">Subscribe with Google</feedburner:feedFlare><feedburner:feedFlare xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" href="http://www.pageflakes.com/subscribe.aspx?url=http%3A%2F%2Ffeeds.feedburner.com%2Fkuppingercole" src="http://www.pageflakes.com/ImageFile.ashx?instanceId=Static_4&amp;fileName=ATP_blu_91x17.gif">Subscribe with Pageflakes</feedburner:feedFlare><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="hub" href="http://pubsubhubbub.appspot.com" /><item> 
			<pubDate>Wed, 01 Jul 2009 10:04:36 +0200</pubDate>
			<title>Tim Cole: Integralis set to become the security arm of NTT</title> 
			<link>http://www.kuppingercole.com/articles/tc_integralis_sec_ntt_310709</link> 
			<guid>http://www.kuppingercole.com/articles/tc_integralis_sec_ntt_310709</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; By acquiring the Munich-based IT security specialist Integralis AG, the Japanese telco giant NTT (Nippon Telephone &amp; Telegraph) plans to become a major player in the world-wide market for managed security and identity management solutions.  Integralis (511 employees, 167 million Turnover) will be integrated as a separate division within NTTs Communications subsidiary (13,000 employees, 10 billion turnover).&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/articles/tc_integralis_sec_ntt_310709"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/2hajSD57KNg" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 30 Jun 2009 22:26:03 +0200</pubDate>
			<title>New design</title> 
			<link>http://www.id-conf.com/blog/2009/06/30/new-design/</link> 
			<guid>http://www.id-conf.com/blog/2009/06/30/new-design/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;We would like to present a &amp;#8220;design refresh&amp;#8221; of our web sites: &lt;a href="http://www.kuppingercole.com" target="_blank"&gt;www.kuppingercole.com&lt;/a&gt;, &lt;a href="http://blogs.kuppingercole.com" target="_blank"&gt;blogs.kuppingercole.com&lt;/a&gt;, and &lt;a href="http://www.id-conf.com" target="_blank"&gt;www.id-conf.com&lt;/a&gt;.&lt;/p&gt;
&lt;p&gt;We hope that a common header style will increase recognition and ease navigation between the sites.&lt;/p&gt;
&lt;p&gt;You are welcome to visit anytime, there is always something new waiting for you &lt;img src='http://www.id-conf.com/blog/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /&gt; &lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/mv3nHwluqtk" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 30 Jun 2009 15:58:38 +0200</pubDate>
			<title>Stronger and simpler authentication</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/06/30/stronger-and-simpler-authentication/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/06/30/stronger-and-simpler-authentication/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;I&amp;#8217;ve seen many approaches for strong authentication &amp;#8211; most of them are either too expensive, too complicated, or they aren&amp;#8217;t really appealing. The latter is true for approaches like &amp;#8220;passfaces&amp;#8221; have to pick one or some known faces from different pictures. Many approaches are complicated to deliver. And many of the token-based approaches are complex from a logistics perspective and are expensive. However, many of these approaches and especially combinations of for example hardware tokens and soft-tokens will work for many use cases.&lt;/p&gt;
&lt;p&gt;But there are other approaches which are interesting as well. One which looks pretty interesting is &lt;a title="GrIDsure" href="http://www.gridsure.com" target="_blank"&gt;GrIDsure&lt;/a&gt;, provided by an UK vendor and implemented by several OEMs right now. The idea is to provide a grid of numbers and to define a pattern within this grid per user. One user might decide on picking the numbers in the corners, clockwise. The next one might pick numbers from the second line from the right to the left. Even a relatively small grid allows for many different combinations. And due to the fact that the numbers within the grid change every time, there is a very high number of changing PINs which then can be entered. The concept is easy to understand, doesn&amp;#8217;t require additional hardware and works with any type of device with a display.&lt;/p&gt;
&lt;p&gt;Despite being really reluctant when a new vendor appears and likes to tell me that he has found the solution for strong authentication, the conversation with GrIDsure was definitely interesting. At least interesting enough to cover it in my blog and to do further research on that solution.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/FvTNnu2bH4g" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 27 Jun 2009 09:22:34 +0200</pubDate>
			<title>The flowering of the identity store</title> 
			<link>http://blogs.kuppingercole.com/cole/2009/06/27/the-flowering-of-the-identity-store/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2009/06/27/the-flowering-of-the-identity-store/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;&lt;img class="alignnone size-full wp-image-74" title="datastore_diagram" src="http://blogs.kuppingercole.com/cole/wp-content/uploads/datastore_diagram.jpg" alt="datastore_diagram" width="595" height="398" /&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;strong&gt;The Personal Data Eco-System (diagram by Iain Henderson and Drummond Reed)&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;Another reason I really love Twitter: It takes you places you might never have found on your own. Take a recent post by &lt;a href="http://twitter.com/xmlgrrl"&gt;xmlgrrl&lt;/a&gt;, a.k.a. Eve Maler of Sun Microsystems, a terse pointer to a posting by Iain Henderson of &lt;a href="mydex.org"&gt;Mydex &lt;/a&gt;on &lt;a href="http://www.rightsideup.net/?p=273"&gt;rightsideup.net&lt;/a&gt; entitled &amp;#8220;The Personal Data Eco-System&amp;#8221; which provides by far the best theoretical overview that I, at least, have seen on the true nature and function of personal data.&lt;/p&gt;
&lt;p&gt;The text is an abstract of a session Ian and his pal Drummond Reed of &lt;a href="http://www.cordance.net"&gt;Concordance&lt;/a&gt;, who is also a trustee of &lt;a href="http://www.idcommons.net"&gt;identitycommons&lt;/a&gt;, held at a recent &lt;a href="http://cyber.law.harvard.edu/projectvrm/VRM_West_Coast_Workshop_2009"&gt;West Coast VRM Workshop&lt;/a&gt; and which is also intended as an introduction to the &lt;a href="http://kantarainitiative.org"&gt;Kantara &lt;/a&gt;workgroup where they hope to explore these scenarios more deeply.   The focus of the piece is on what Iain and Drummond describe as &amp;#8220;Personal Data Stores&amp;#8221;, a slightly confusing term for a kind of data warehouse in which to store all the personal data available about me (or you) so that it can be used for anything from paying a credit card bill to scheduling a doctor&amp;#8217;s appointment or even planning a home move.&lt;/p&gt;
&lt;p&gt;But where it gets really exciting is when the two start to discuss what kind of data there is about me (or you) , what the relationship is between the different kinds of data and how they interact. Basically, they divide all personal data into five categories:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;My Data&lt;/strong&gt; (information about me that I, and only I, own and control)&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Your Data&lt;/strong&gt; (information about me that someone else &amp;#8211; e.g. an organization or the government &amp;#8211; owns and controls)&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Our Data&lt;/strong&gt; (information about me that is accessible to both me and them, e.g. buyer and seller)&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Their Data&lt;/strong&gt; (information about me that is owned and sold by third parties such as a credit card company)&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Everybody&amp;#8217;s Data&lt;/strong&gt; (information about me that is in the public domain, e.g. my postal address or an electoral roll)&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Iain and Reed have created the absolutely fascinating flower-like Venn diagram pictured above explaining how and where these separate sorts of data intersect to create what they describe as a &amp;#8220;Basic Identifier Set&amp;#8221; in the middle. This for them is the &amp;#8220;core personal identity data and they believe it will enable a working &amp;#8220;personal identity eco-system&amp;#8221; for providing services and ensuring transactions sometime in the future, with the individual functioning as the &amp;#8220;un-knowing point of integration&amp;#8221; of data about themselves.&lt;/p&gt;
&lt;p&gt;They describe in detail the various dynamic flows of data between the different categories, such as from My Data to Your Data where individuals provide information about themselves under certain conditions (think the &amp;#8220;tick boxes&amp;#8221; on web forms indicating whether I want to receive your newsletter if I buy your product) or from Your Data to Their Data as an organization shares information about me with another organization, something which can happen legally (as in identity federation) or illegally (then it&amp;#8217;s called identity theft).&lt;/p&gt;
&lt;p&gt;I find the Henderson/Reed Diagram an extremely illuminating intellectual achievement since it illustrates the huge complexity involved in addressing issues of identity, both digital and analog. I&amp;#8217;m not so sure whether I agree with Iain&amp;#8217;s conclusion and forecast that over time (&amp;#8221;in 10 years&amp;#8221;) some 80% of customer management processes will be driven from a &amp;#8220;My Data&amp;#8221; perspective. He argues that the rush for user-generated content, as well as economic reasons, will cause organizations to move to a user-controlled model of identity management.&lt;/p&gt;
&lt;p&gt;Well, I&amp;#8217;ve been around long enough to know you can multiply a given prognosis involving a ten-year timeframe by a factor of between two and ten and still wind up way out in left field.  But I do think they are right in assuming that there is a business case for moving towards user-controlled identity. Whether it will be, as they suggest, that allowing a vendor to mine my Personal Data Store for my consumer habits, and especially my buying intentions, will be incentive enough, or whether the prevalent model will be a simple upfront deal &amp;#8211; give me your personal information and I will give you a rebate or cash in hand &amp;#8211; I don&amp;#8217;t know, but until we find out it might be a good idea to contenplate the wonderfully symmetric flower petals of the identity eco-system diagram and ponder it’s implications.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/Mlhu2t_Y8H4" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 26 Jun 2009 09:16:46 +0200</pubDate>
			<title>Martin Kuppinger: Saving with security</title> 
			<link>http://www.kuppingercole.com/articles/mk_savesec_260609</link> 
			<guid>http://www.kuppingercole.com/articles/mk_savesec_260609</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; This is true in many areas. Single solutions popularly labeled and sold under the name Data Leakage Protection/Prevention are mostly just conscience salvers. They may deal with a certain concern, but dont solve the overall security problem. In fact most of them leave gaping holes.

Most of the issues addressed by DLP products can be resolved through group policy rules in Windows. Central management through true Endpoint Security/Protection solutions are by far the best way to handle your...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/articles/mk_savesec_260609"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/KdK8znHgN24" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 25 Jun 2009 00:00:00 +0200</pubDate>
			<title>Get the Big Picture - Managing Access beyond SAP for Cross-Enterprise Identity Governance</title> 
			<link>http://www.kuppingercole.com/podcasts/managing_access_beyond_sap.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/managing_access_beyond_sap.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/managing_access_beyond_sap.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/5hLWnsiVIFo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 24 Jun 2009 18:48:24 +0200</pubDate>
			<title>Pricing models for the cloud</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/06/24/pricing-models-for-the-cloud/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/06/24/pricing-models-for-the-cloud/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Even while I don&amp;#8217;t share his understanding of the term &amp;#8220;&lt;a title="What defines the cloud?" href="http://blogs.kuppingercole.com/kuppinger/2009/05/15/what-defines-the-cloud/" target="_blank"&gt;private cloud&lt;/a&gt;&amp;#8221; (I don&amp;#8217;t believe in that term) , I like what Chuck Hollis of EMC has blogged about &amp;#8220;&lt;a title="Monetizing the cloud" href="http://chucksblog.emc.com/chucks_blog/2009/06/monetizing-the-private-cloud-part-1.html" target="_blank"&gt;Monetizing the cloud&lt;/a&gt;&amp;#8220;. There are so many open questions around the valid business models for as well cloud providers as consumers for cloud services. And everyone will have to learn a lot &amp;#8211; and learning from others might help to avoid mistakes.&lt;/p&gt;
&lt;p&gt;By the way I also wouldn&amp;#8217;t limit the cloud discussion to &amp;#8220;providing infrastructure&amp;#8221; &amp;#8211; it goes well beyond that and covers virtually any type of IT service.&lt;/p&gt;
&lt;p&gt;There will room to discuss thinks like the correct terminology around the cloud as well as valid business models at &lt;a title="Cloud 09" href="http://www.id-conf.com/cc09" target="_blank"&gt;Cloud 09&lt;/a&gt;, to be held 2nd to 4th of December in Munich &amp;#8211; the cloud counterpart to our European Identity Conference.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/COU-SOf27vc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 24 Jun 2009 11:23:52 +0200</pubDate>
			<title>Why is IBM TIM 5.1 just a minor release?</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/06/24/why-is-ibm-tim-5-1-just-a-minor-release/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/06/24/why-is-ibm-tim-5-1-just-a-minor-release/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;IBM yesterday has announced its Tivoli Identity Manager 5.1. If you read the list of new features you might end up with the same question like me: Why is it only version 5.1, e.g. a minor (.1) release instead of TIM 6? Amongst the new features are fundamental things like Role Management, SoD support, attestation and, last not least, support for some Privileged Account Management (or Privileged Identity Management, the term IBM is using). With other words: IBM has significantly expanded the feature set of its product, mainly adding a lot of IAM-GRC features to what TIM delivers. Given that they have some other interesting solutions in the GRC space, especially for analytics and dashboards, IBM definitely improves its positioning in that emerging market segment.&lt;/p&gt;
&lt;p&gt;So the GRC stuff is one of the new areas in TIM 5.1. That&amp;#8217;s nice, but we have seen that before. Many vendors have either added such features to their products or have released separate GRC platforms &amp;#8211; with advantages and disadvantages in both approaches. IBM in fact has tied in that area.&lt;/p&gt;
&lt;p&gt;Much more interesting is the addition of PIM capabilities to a provisioning solution. Even while not every aspect of PIM will be solved by what TIM 5.1 delivers, that fulfills my expectations of PIM becoming more and more part of provisioning tools &amp;#8211; which is just logical, given that it is about managing accounts. IBM is the first vendor in the market who delivers an integration in that area. Novell might become a close follower given that they have recently acquired a PIM vendor.&lt;/p&gt;
&lt;p&gt;With these additions, IBM would have gould reasons to name the release of TIM as version 6.0 instead of 5.1. But understanding the reasons for version numbers is definitely amongst the hardest things in IT.&lt;/p&gt;
&lt;p&gt;However, IBM shows that they are intensively acting to improve their positioning in the IAM and GRC market space. Being one of the first big companies which had entered that market, there hasn&amp;#8217;t been that much evolution for some time. But now IBM is definitely back and moving forward significantly, acting as a strong competitor for the other players in the market. And once they deliver on full GRC solutions, beyond IAM-GRC and access controls (and IBM is amongst the ones who might deliver on that given their strengths in areas like SIEM, ITSM, and others&amp;#8230;) IBM might even further improve its positioning.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/c8Qvy_XUyis" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 19 Jun 2009 11:11:32 +0200</pubDate>
			<title>22.07.2009: Externalizing Identity into the Cloud</title> 
			<link>http://www.kuppingercole.com/events/n40055</link> 
			<guid>http://www.kuppingercole.com/events/n40055</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; Externalizing Identities from applications into a service oriented layer within the enterprise IT architecture has been discussed a lot within the last years, mainly in the light of reducing application development costs and to devolve all those identity silos captured in enterprise applications. With cloud computing and *aaS picking up momentum, the externalization of identity management into such a service layer finally seems to be rewarded with enough attention to move far up on many CIO´s...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/events/n40055"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/yuYPGo9dyyg" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 18 Jun 2009 13:05:38 +0200</pubDate>
			<title>Parallels wants to bring SaaS to the masses</title> 
			<link>http://blogs.kuppingercole.com/cole/2009/06/18/parallels/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2009/06/18/parallels/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Just got back from my favorite neighborhood watering hole in Munich, the Cafe Wienerplatz, where I met with Soeren von Varchmin, who recently moved in next door after spending a few years in Seattle.&lt;/p&gt;
&lt;p&gt;Soeren is VP SaaS at &lt;a href="http://www.parallels.com/"&gt;Parallels&lt;/a&gt;, a company that describes itself as &amp;#8220;worldwide leader in virtualization and automation software that optimizes computing for consumers, businesses and providers&amp;#8221;. His job is to bring together Internet Providers and Services Providers (ISVs) by providing a common plattform to provision, manage and integrate applications and services over the Internet. His vision is to create a large-scale cloud computing ecosystem where software vendors and cloud operators together deliver a wide variety of services to businesses and consumers.&lt;/p&gt;
&lt;p&gt;To achieve this goal, Parallels has written what they call the &amp;#8220;Application Packaging Standard&amp;#8221; (APS) which they describe as a new application packaging format designed to help implement a Software-as-a-Service (SaaS) business model. I guess you could call is &amp;#8220;SaaS 2.0&amp;#8243; (or maybe &amp;#8220;ASP x.0&amp;#8243;), because it enables almost all industry hosting providers &amp;#8211; Parallels&amp;#8217; traditional customer base &amp;#8211; to team up with almost any application provider to offer their apps as a rental web service.&lt;/p&gt;
&lt;p&gt;Once packaged in the APS format &amp;#8211; basically just an XML feed &amp;#8211; by a software vendor, an application can be easily &amp;#8220;plugged&amp;#8221; into an infrastructure of any hosting provider that implemented the standard &amp;#8220;socket&amp;#8221; for the APS applications.&lt;/p&gt;
&lt;p&gt;Soeren thinks this is a real win-win situation, since it gives hosting providers a new, higher-value business model while providing a new distribution channel for ISVs. Parallels is touting their standard as an open plattform, and rumor has it that they will be founding a non-profit organization to push the specification in the public domain., so check out their website at www.apsstandard.org for updates.&lt;/p&gt;
&lt;p&gt;&lt;span id="more-66"&gt;&lt;/span&gt;The reason I was interested in APS is that it contains full-fledged IdM capabilities, from Single Sign-on through provisioning, payment &amp;amp; billing, and since recently even license management, too. Since everybody is heading for the Cloud these days, I thought it would be intersting to know if APS might be a quick fix to the IdM problem in web-based applications. Soeren seems to think so. And technically, he may be right.  But of course, to make ASP a &amp;#8220;real&amp;#8221; standard he&amp;#8217;ll have to generate a lot more interest in the IdM community.&lt;/p&gt;
&lt;p&gt;Right now, Parallels is big in the provider and hosting market. Their boast is that, out of about 200 million domains in the world, between 30 and 40 million are powered by their software. Or putting it another way, just aboiut every major Internet Provider in the business is a customer of theirs. But simple hosting and plumbing isn&amp;#8217;t all that sexy anymore, and big cloud operators like Amazon, Google, 1&amp;amp;1 or Strato are on the lookout for extra sources of income. By hitching them up with ISVs and SaaS vendors like Salesforce et al. they could conceivably tap into some pretty substantial new revenue streams, especially SMEs who find it appealing to rent IT infrastructure and applications instead of buying.&lt;/p&gt;
&lt;p&gt;I asked Soeren if APS could also work as a platform for providing identity as a service, and he liked the idea. After all, if the platform can handle SSO and payment in a safe and scalable fashion, why not use it as a kind of universal identity provider for the Cloud instead of building IdM capability directly into the app?&lt;/p&gt;
&lt;p&gt;On the other hand, Parallels still has its work cut out for it convincing the thousands and thousands of ISVs out there to plug their existing solutions &amp;#8211; whether already SaaS-enabled or legacy &amp;#8211; into APS.&lt;/p&gt;
&lt;p&gt;Yeah, it makes sense businesswise, but anyone who has every tried to push a standard knows just how innovation-resistant people in the IT industry can be. But with Soeren living right around the corner now, I&amp;#8217;ll be able to check back every time we run across each other at Cafe Wienerplatz, so stay tuned.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/bCNF3l8g34A" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 18 Jun 2009 08:10:26 +0200</pubDate>
			<title>It’s not about the cloud – it’s about Cloud IT</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/06/18/its-not-about-the-cloud-its-about-cloud-it/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/06/18/its-not-about-the-cloud-its-about-cloud-it/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;The biggest problem around cloud computing is the lack of a valid and well accepted definition. Definitions like &amp;#8220;scalable services delivered via the internet&amp;#8221; fail for example when thinking about &amp;#8220;private clouds&amp;#8221; which aren&amp;#8217;t used via the internet (but at least based on using the same standards). And, by the way, not every cloud service will have to be highly scalable &amp;#8211; there will be more and more very specialized services where functionality is key, not a massive scalability.&lt;/p&gt;
&lt;p&gt;But the more you dive into the topic of cloud computing it becomes obvious that this cloudy thing of &amp;#8220;cloud&amp;#8221; (usually associated with the Internet and things which are provided there) isn&amp;#8217;t the key thing. The key to success is that companies understand the value of &lt;strong&gt;Cloud IT&lt;/strong&gt;.&lt;/p&gt;
&lt;p&gt;What does this mean? Cloud IT stands for consequently using cloud principles in IT &amp;#8211; and in every part of IT, not only for consuming some external services. That includes&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;well defined services (SLAs!!!)&lt;/li&gt;
&lt;li&gt;a consistent service management across all services, regardless of where they are running (and, based on that, consistent approaches to cloud governance)&lt;/li&gt;
&lt;li&gt;applications which are agnostic of where they are run or which hardware resources are available &amp;#8211; there have to be parameters which might limit the ability to run applications everywhere and the application has to accept the currently available hardware resources but as well should understand that these resources can change dynamically&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Defining everything in IT as services in a consistent manner is a fundamental change and the foundation for a flexible use of cloud services. Once you have made that move you can decide (based on parameters of a service) which service provider (internal or external) you will use. Thus, the first step is making your IT &amp;#8220;cloud-ready&amp;#8221;, e.g. moving towards a Cloud IT. Without that, using cloud services will always be sort of tactical and not strategic.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/-cObSETjMz4" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 17 Jun 2009 00:00:00 +0200</pubDate>
			<title>Messbare Vorteile für Sicherheit und Kosten durch Single Sign-On mit starker Authentifizierung</title> 
			<link>http://www.kuppingercole.com/podcasts/sso_mit_starker_authentifizierung.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/sso_mit_starker_authentifizierung.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/sso_mit_starker_authentifizierung.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/gBHeW4uUUmM" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 16 Jun 2009 20:47:41 +0200</pubDate>
			<title>Hooray, LDAPcon 2009 is coming up!</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2009/06/16/hooray-ldapcon-2009-is-coming-up/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2009/06/16/hooray-ldapcon-2009-is-coming-up/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;I was delighted when I saw that &lt;a href="http://www.symas.com/ldapcon2009/"&gt;LDAPcon is happening again this year&lt;/a&gt;. I went to the first event in Cologne, Germany 2007, and was very impressed. When you have the &amp;#8220;creme de la creme&amp;#8221; from the LDAP community talking about their favourite topic, you&amp;#8217;re guaranteed an interesting and exhiliarating time &amp;#8211; assuming that LDAP and directories are your thing.&lt;/p&gt;
&lt;p&gt;I still remember last time how Howard Chu gave us a musical demonstration of how a well-performing directory should perform &amp;#8211; on the violin! I don&amp;#8217;t think anybody forgot that. We also got a very good overview of the different open source projects around directories, and about how to make good use of some of the LDAP extensions.&lt;/p&gt;
&lt;p&gt;This time, we&amp;#8217;ll also have two action-packed days, and the &lt;a href="http://www.symas.com/ldapcon2009/call-for-papers.shtml"&gt;call for papers&lt;/a&gt; is open. I encourage everybody to share their best practises, vision and thought and make this an unforgettable event as well. I&amp;#8217;ll be submitting for sure &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /&gt; &lt;/p&gt;
&lt;p&gt;LDAPcon takes place in Portland and starts on September 20, a day before LinuxCon. The second day will be shared with LinuxCon, it seems. Might as well stay for LinuxCon as well! This is a good event not just for directory vendors and project maintainers, but especially also for those who deploy and run LDAP directories in challenging environments, and those who develop software that talks to LDAP servers. Kudos to the Symas guys for helping organise it (and they are just helping to organise it &amp;#8211; it&amp;#8217;s not at all an OpenLDAP conference, if that what you&amp;#8217;re thinking). I&amp;#8217;m definitely looking forward to it!&lt;/p&gt;
&lt;p&gt;BTW I just saw that &lt;a href="http://blogs.sun.com/Ludo/entry/ldapcon_2009_call_for_papers"&gt;Ludo wrote about it as well&lt;/a&gt;, and even posted some photos from the 2007 event.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/0iyGEM7CVKo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 11 Jun 2009 16:59:11 +0200</pubDate>
			<title>UnboundID launches frontal attack on Sun – good idea??</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2009/06/11/unboundid-launches-frontal-attack-on-sun-good-idea/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2009/06/11/unboundid-launches-frontal-attack-on-sun-good-idea/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;I recently received a press release from UnboundID announcing the availability of a new &amp;#8220;synchronization server&amp;#8221;. This software keeps two LDAP servers in sync (as the name suggests) &amp;#8211; bidirectionally. In theory very useful, and it&amp;#8217;s free too. But there&amp;#8217;s a small trick: the synchronization server supports both Sun&amp;#8217;s DSEE (Directory Server Enterprise Edition) and the new Unbound ID Directory Server. In the release, Unbound ID makes no secret of what this software should be used for: to migrate away from Sun&amp;#8217;s directory toward Unbound ID&amp;#8217;s competing solution.&lt;/p&gt;
&lt;p&gt;UnboundID is a start-up based out of Austin, TX. It was founded by several ex-Sun employees, including Neil Wilson, author of the &amp;#8220;slamd&amp;#8221; load generation engine, and formerly one of the key people behind Sun&amp;#8217;s OpenDS. I have already raved about their new LDAP SDK for Java, in my opinion the finest and most complete LDAP development kit for any language ever written.&lt;/p&gt;
&lt;p&gt;The company is going after the very lucrative Telco and large service provider market, and launched a frontal attack on Sun Microsystems, who is the market leader in that space. UnboundID is offering a 30-40% reduction in yearly maintenance costs if customers switch from DSEE to their solution. Of course there is the usual fine print, and this offer is limited to medium-sized directories with less than two million entries. Why should Sun customers switch from DSEE to UnboundID Directory? According to UnboundID, their server is faster, has less footprint and is supported on a wider platform range.&lt;/p&gt;
&lt;p&gt;It is not really obvious to me however why Telcos and large service providers would want to switch. For one, DSEE has been the de-facto market leader for massive-scale directory services, and customer satisfaction is high (not just if you believe the marketing &amp;#8211; I&amp;#8217;ve personally heard the same from Telcos using the product). A directory server running in a Telco is an absolutely super-critical component, and ripping it out and replacing it is akin to heart surgery. DSEE is very mature after having been around for many years and the kinks have been ironed out in many very large deployments a long time ago already (in fact, I was in one of those deployments in 2002 &amp;#8211; that was fun). UnboundID would obviously need to make a very good case and give organisations a high level of assurance for them to switch over. The Telco sector is much more innovative than others, and tends to be on the bleeding edge of technology &amp;#8211; but even so, there is a reluctance to switch from a very mature product that &amp;#8220;just works&amp;#8221; to a brand-new product.&lt;/p&gt;
&lt;p&gt;That&amp;#8217;s why UnboundID offers the &amp;#8220;synchronization server&amp;#8221; in order to try to entice organisations to run both directory servers next to each other for a longer period &amp;#8211; to evaluate and eventually become comfortable enough with the UnboundID server to make the switch. It seems that the &amp;#8220;synchronization server&amp;#8221; has been written specifically for this purpose.&lt;/p&gt;
&lt;p&gt;Which, personally speaking, I think is a bit of a pity, but hopefully UnboundID will realise the immense value that this synchronisation server could have once they&amp;#8217;ve gotten over their frontal attack on Sun. A generic synchronization server that would keep multiple directories from multiple vendors synchronised is a fantastic value proposition, and I&amp;#8217;m sure many organisations would jump at it. Especially when it comes from such brilliant minds like Neil Wilson&amp;#8217;s who is known for his awesome LDAP stuff.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/aylW9Y3eLv4" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 02 Jun 2009 09:52:12 +0200</pubDate>
			<title>25.06.2009: Get the Big Picture   Managing Access beyond SAP for Cross-Enterprise Identity Governance</title> 
			<link>http://www.kuppingercole.com/events/n40053</link> 
			<guid>http://www.kuppingercole.com/events/n40053</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; In this free webinar, youll learn how an integrated identity governance approach can more effectively improve your risk posture with enterprise-wide policy enforcement, access certifications and role management across all relevant systems. By having a single view into user access rights, you will greatly improve your visibility into risky or non-compliant areas and automate your processes for managing these risks.&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/events/n40053"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/32fJa8Mw9iA" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 26 May 2009 00:00:00 +0200</pubDate>
			<title>Product Report: Siemens DirX Access</title> 
			<link>http://www.kuppingercole.com/report/pr_siemens_dirx_260509</link> 
			<guid>http://www.kuppingercole.com/report/pr_siemens_dirx_260509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Siemens managed to enter the web access management and identity federation market successfully by buying in and then significantly developing technology. Siemens DirX Access&amp;rsquo; version 8.1 is a technically accomplished solution with a flexible and modular architecture concept. Siemens DirX Access 8.1 covers all standard requirements for solutions in this segment and in addition offers even more features for web services security and application integration options - especially for...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/pr_siemens_dirx_260509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/qEBaOlxYO10" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 26 May 2009 00:00:00 +0200</pubDate>
			<title>Vendor Report: Siemens</title> 
			<link>http://www.kuppingercole.com/report/vr_siemens_eng_260509</link> 
			<guid>http://www.kuppingercole.com/report/vr_siemens_eng_260509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Siemens is one of the largest companies in the world. Siemens IT Solutions and Services (SIS), responsible for IT-products and services, is one of the different segments [Siemens refers to these as &amp;ldquo;sectors&amp;rdquo;] of the company group. The established IAM and GRC products from Siemens are also allocated to this segment.&lt;/p&gt;&lt;p&gt;Biometric solutions, smartcards, card management and public key infrastructures are part of the product range for IT security, in addition to IAM core...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/vr_siemens_eng_260509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/BvG3rSOJmwk" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 19 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Fulup Ar Foll, Sun Microsystems</title> 
			<link>http://www.kuppingercole.com/podcasts/070509_interview_arfoll.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/070509_interview_arfoll.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Tim Cole interviews Fulup Ar Foll at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/070509_interview_arfoll.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/lQgWnG4Hbjo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 19 May 2009 00:00:00 +0200</pubDate>
			<title>EIC Impressions</title> 
			<link>http://www.kuppingercole.com/podcasts/070509_interview_impressions.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/070509_interview_impressions.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; A few short interviews from the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/070509_interview_impressions.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/cfXDvY54zc8" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 19 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Marina Walser, Novell</title> 
			<link>http://www.kuppingercole.com/podcasts/070509_interview_walser.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/070509_interview_walser.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Tim Cole interviews Marina Walser at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/070509_interview_walser.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/UUd-EEuWqs0" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 19 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Kim Cameron, Microsoft</title> 
			<link>http://www.kuppingercole.com/podcasts/070509_interview_cameron.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/070509_interview_cameron.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Tim Cole interviews Kim Cameron at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/070509_interview_cameron.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/RlVHujDv-8A" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 18 May 2009 23:17:18 +0200</pubDate>
			<title>EIC impressions</title> 
			<link>http://www.id-conf.com/blog/2009/05/18/eic-impressions/</link> 
			<guid>http://www.id-conf.com/blog/2009/05/18/eic-impressions/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;A few more short interviews from the conference&lt;br /&gt;
&lt;object width="425" height="344" data="http://www.youtube.com/v/u90aR4qQdnk&amp;amp;hl=en&amp;amp;fs=1&amp;amp;rel=0" type="application/x-shockwave-flash"&gt;&lt;param name="allowFullScreen" value="true" /&gt;&lt;param name="allowscriptaccess" value="always" /&gt;&lt;param name="src" value="http://www.youtube.com/v/u90aR4qQdnk&amp;amp;hl=en&amp;amp;fs=1&amp;amp;rel=0" /&gt;&lt;param name="allowfullscreen" value="true" /&gt;&lt;/object&gt;&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/bMPDfX9i8Jo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 18 May 2009 17:34:55 +0200</pubDate>
			<title>Interview with Kim Cameron</title> 
			<link>http://www.id-conf.com/blog/2009/05/18/interview-with-kim-cameron/</link> 
			<guid>http://www.id-conf.com/blog/2009/05/18/interview-with-kim-cameron/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Interview with Kim Cameron, Microsoft&lt;br /&gt;
&lt;object width="425" height="344"&gt;&lt;param name="movie" value="http://www.youtube.com/v/1hT3hfxuZRU&amp;#038;hl=en&amp;#038;fs=1&amp;#038;rel=0"&gt;&lt;/param&gt;&lt;param name="allowFullScreen" value="true"&gt;&lt;/param&gt;&lt;param name="allowscriptaccess" value="always"&gt;&lt;/param&gt;&lt;embed src="http://www.youtube.com/v/1hT3hfxuZRU&amp;#038;hl=en&amp;#038;fs=1&amp;#038;rel=0" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="344"&gt;&lt;/embed&gt;&lt;/object&gt;&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/fH7aRPJGtgE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 17 May 2009 05:43:02 +0200</pubDate>
			<title>The Lost Chapters of EIC</title> 
			<link>http://www.id-conf.com/blog/2009/05/17/the-lost-chapters-of-eic/</link> 
			<guid>http://www.id-conf.com/blog/2009/05/17/the-lost-chapters-of-eic/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Today we&amp;#8217;ve been finally able to get our hands on a tape we almost believed to be lost forever. But thanks to our video technicians we can now present you a few more interviews from the EIC 2009.&lt;/p&gt;
&lt;p&gt;Interview with Marina Walser, Novell EMEA&lt;br /&gt;
&lt;object width="425" height="344" data="http://www.youtube.com/v/EQF4HnjJ1CY&amp;amp;hl=en&amp;amp;fs=1&amp;amp;rel=0" type="application/x-shockwave-flash"&gt;&lt;param name="allowFullScreen" value="true" /&gt;&lt;param name="allowscriptaccess" value="always" /&gt;&lt;param name="src" value="http://www.youtube.com/v/EQF4HnjJ1CY&amp;amp;hl=en&amp;amp;fs=1&amp;amp;rel=0" /&gt;&lt;param name="allowfullscreen" value="true" /&gt;&lt;/object&gt;&lt;/p&gt;
&lt;p&gt;Interview with Fulup Ar Foll, Sun Microsystems (yes, another one!)&lt;br /&gt;
&lt;object width="425" height="344" data="http://www.youtube.com/v/r1KvfEULBxw&amp;amp;hl=en&amp;amp;fs=1&amp;amp;rel=0" type="application/x-shockwave-flash"&gt;&lt;param name="allowFullScreen" value="true" /&gt;&lt;param name="allowscriptaccess" value="always" /&gt;&lt;param name="src" value="http://www.youtube.com/v/r1KvfEULBxw&amp;amp;hl=en&amp;amp;fs=1&amp;amp;rel=0" /&gt;&lt;param name="allowfullscreen" value="true" /&gt;&lt;/object&gt;&lt;/p&gt;
&lt;p&gt;Stay tuned for more.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/ev1eDmpy7to" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 15 May 2009 09:31:18 +0200</pubDate>
			<title>Martin Kuppinger: Trends and Threats in Desktop Virtualization</title> 
			<link>http://www.kuppingercole.com/articles/mk_trendsthreats_150509</link> 
			<guid>http://www.kuppingercole.com/articles/mk_trendsthreats_150509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; Desktop virtualization is clearly a hot topic in IT, but a closer look reveals that some elements are still missing and that in many use cases problems would be better addressed using classic technologies such as Client Lifecycle Management and terminal services.&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/articles/mk_trendsthreats_150509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/cLPW_v7UaPE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 15 May 2009 06:42:05 +0200</pubDate>
			<title>What defines the cloud?</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/05/15/what-defines-the-cloud/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/05/15/what-defines-the-cloud/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;There are plenty of definitions of the &amp;#8220;cloud&amp;#8221;. Most of them include aspects like services which are provided via the internet and which are highly scalable. But the discussion about terms like a &amp;#8220;private cloud&amp;#8221; proves that this is a somewhat insufficient definition. Depending on the definition of a &amp;#8220;private cloud&amp;#8221;, these services might be delivered via a private network.&lt;/p&gt;
&lt;p&gt;The insufficiency becomes obvious as well with respect to some of the aspects of the cloud. There are so many different types of cloud services that there are for sure some which, for example, are so specific that they don&amp;#8217;t need to be highly scalable &amp;#8211; for example cloud applications which are devoted to a specific target audience with only few members like for example airlines or rail operators. There the scalability is automatically limited and not somewhat infinite, like often is assumed as a requirement for cloud services. And there will be many services devoted to much smaller groups (with respect to the size and number of members).&lt;/p&gt;
&lt;p&gt;From my perspective, the essence of cloud computing are the services. Services are defined on various levels, from pure computing power up to very specific applications. These services are provided by someone. They have to be well-defined so that they can be provided by different providers and the switch to another provider is supported. This definition goes well beyond today&amp;#8217;s definitions in IT Service Management. It has, for example, to be defined, where (geographically) a service can be hosted &amp;#8211; due to legal reasons.&lt;/p&gt;
&lt;p&gt;Given that a well-defined service which can be run virtually anywhere is the core of cloud computing, it becomse obvious that terms like &amp;#8220;private cloud&amp;#8221; are just marketing fuzz. In fact there will be only one cloud with different operators, from internal data centers to external cloud providers. And by the way: Where should be the borderline between &amp;#8220;private&amp;#8221; and &amp;#8220;public&amp;#8221;? The (diminishing) perimeter of an organization? The fact that a partition of a data center in the cloud is used? A physical machine or a virtual machine? Actually it isn&amp;#8217;t possible to define that in a valid way.&lt;/p&gt;
&lt;p&gt;The real value of cloud computing is that services can be consumed from different providers and that providers can be changed &amp;#8211; sometimes pretty easy, sometimes with a little more efforts. That might be an internal or external provider, but you shouldn&amp;#8217;t care about in case that the requirements are fulfilled (which could as well mean that it is mandatory to provide a service internally).&lt;/p&gt;
&lt;p&gt;There are many open points around cloud services and the related standards today. In case that we have defined that a specific service consumed in the EU has to be hosted in the EU &amp;#8211; how do we avoid that the data is sent from Paris to Berlin via New York which might happen in practice? Obviously, a lot of work has to be done around standards, around service descriptions, around management tools at any level. But despite the shortcomings we observe today, the cloud will become reality and IT will be run and managed differently from today. There are far too many advantages in cloud computing.&lt;/p&gt;
&lt;p&gt;We will discuss many of the topics around Cloud Computing, the opportunities, business drivers, standards, service management and so on at &lt;a title="Cloud 09" href="http://www.id-conf.com/cc09" target="_blank"&gt;Cloud 09&lt;/a&gt; in Munich in November 2009. Take part in these discussions!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/GtT45pMrafM" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 15 May 2009 02:10:47 +0200</pubDate>
			<title>Keynote by Kim Cameron, Microsoft</title> 
			<link>http://www.id-conf.com/blog/2009/05/15/keynote-by-kim-cameron-microsoft/</link> 
			<guid>http://www.id-conf.com/blog/2009/05/15/keynote-by-kim-cameron-microsoft/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;&lt;object width="480" height="385" data="http://www.youtube.com/p/AA5454357BD8AF31&amp;amp;hl=en&amp;amp;fs=1" type="application/x-shockwave-flash"&gt;&lt;param name="allowFullScreen" value="true" /&gt;&lt;param name="allowscriptaccess" value="always" /&gt;&lt;param name="src" value="http://www.youtube.com/p/AA5454357BD8AF31&amp;amp;hl=en&amp;amp;fs=1" /&gt;&lt;param name="allowfullscreen" value="true" /&gt;&lt;/object&gt;&lt;/p&gt;
&lt;p&gt;&lt;a href="http://www.id-conf.com/sessions/574" target="_blank"&gt;The Road to Claims: From Vision to Reality&lt;/a&gt;&lt;br /&gt;
Kim Cameron, Microsoft&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/NUx6lscsC-g" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 14 May 2009 19:30:25 +0200</pubDate>
			<title>Keynote by Marina Walser, Novell</title> 
			<link>http://www.id-conf.com/blog/2009/05/14/keynote-by-marina-walser-novell/</link> 
			<guid>http://www.id-conf.com/blog/2009/05/14/keynote-by-marina-walser-novell/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;&lt;object width="480" height="385" data="http://www.youtube.com/p/19353F3BF092A44F&amp;amp;hl=en&amp;amp;fs=1" type="application/x-shockwave-flash"&gt;&lt;param name="allowFullScreen" value="true" /&gt;&lt;param name="allowscriptaccess" value="always" /&gt;&lt;param name="src" value="http://www.youtube.com/p/19353F3BF092A44F&amp;amp;hl=en&amp;amp;fs=1" /&gt;&lt;param name="allowfullscreen" value="true" /&gt;&lt;/object&gt;&lt;/p&gt;
&lt;p&gt;&lt;a href="http://www.id-conf.com/sessions/509" target="_blank"&gt;SAP-GRC-IdM &amp;#8211; What is the Problem?&lt;/a&gt;&lt;br /&gt;
Marina Walser, Novell EMEA&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/6vWB3SkJOWU" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 13 May 2009 21:53:08 +0200</pubDate>
			<title>Keynote by John Aisien, Oracle</title> 
			<link>http://www.id-conf.com/blog/2009/05/13/keynote-by-john-aisien-oracle/</link> 
			<guid>http://www.id-conf.com/blog/2009/05/13/keynote-by-john-aisien-oracle/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;&lt;object width="480" height="385" data="http://www.youtube.com/p/C28FE0702A21C47F&amp;amp;hl=en&amp;amp;fs=1" type="application/x-shockwave-flash"&gt;&lt;param name="allowFullScreen" value="true" /&gt;&lt;param name="allowscriptaccess" value="always" /&gt;&lt;param name="src" value="http://www.youtube.com/p/C28FE0702A21C47F&amp;amp;hl=en&amp;amp;fs=1" /&gt;&lt;param name="allowfullscreen" value="true" /&gt;&lt;/object&gt;&lt;/p&gt;
&lt;p&gt;&lt;a href="http://www.id-conf.com/sessions/510" target="_blank"&gt;Enterprise IT-enabled Cost Avoidance &amp;amp; Reduction: The Role of Identity &amp;amp; Access Management&lt;/a&gt;&lt;br /&gt;
John Aisien, Oracle Corporation&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/tVEyqMpUoNc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 13 May 2009 16:02:47 +0200</pubDate>
			<title>Keynote by Eve Maler, Sun Microsystems</title> 
			<link>http://www.id-conf.com/blog/2009/05/13/keynote-by-eve-maler-sun-microsystems/</link> 
			<guid>http://www.id-conf.com/blog/2009/05/13/keynote-by-eve-maler-sun-microsystems/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;We&amp;#8217;re planning to upload selected EIC 2009 keynotes to YouTube and here is the first one.&lt;/p&gt;
&lt;p&gt;&lt;object width="480" height="385" data="http://www.youtube.com/p/8CF44184B5C40205&amp;amp;hl=en&amp;amp;fs=1" type="application/x-shockwave-flash"&gt;&lt;param name="allowFullScreen" value="true" /&gt;&lt;param name="allowscriptaccess" value="always" /&gt;&lt;param name="src" value="http://www.youtube.com/p/8CF44184B5C40205&amp;amp;hl=en&amp;amp;fs=1" /&gt;&lt;param name="allowfullscreen" value="true" /&gt;&lt;/object&gt;&lt;/p&gt;
&lt;p&gt;&lt;a href="http://www.id-conf.com/sessions/501" target="_blank"&gt;The Care and Feeding of Online Relationships&lt;/a&gt;&lt;br /&gt;
Eve Maler, Sun Microsystems&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/Q9QCYw_F4VE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 16:08:46 +0200</pubDate>
			<title>EIC 2009 presentations and keynotes</title> 
			<link>http://www.id-conf.com/blog/2009/05/12/eic-2009-presentations-and-keynotes/</link> 
			<guid>http://www.id-conf.com/blog/2009/05/12/eic-2009-presentations-and-keynotes/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Just like last year, registered participants of the EIC 2009 have access to all presentations and keynote videos in the special area of Kuppinger Cole web site.&lt;/p&gt;
&lt;p&gt;We have sent a personal direct link to that area in an e-mail to every participant, so please check your inbox!&lt;/p&gt;
&lt;p&gt;If you haven&amp;#8217;t received such an mail from Kuppinger Cole, it could be that we do not know your address yet. In this case please contact &lt;a href="mailto:lk@kuppingercole.com"&gt;Mr. Levent Kara&lt;/a&gt;.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/X53VVX2XWeA" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Dale Olds, Novell</title> 
			<link>http://www.kuppingercole.com/podcasts/060509_interview_olds.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/060509_interview_olds.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Felix Gaehtgens interviews Dale Olds at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/060509_interview_olds.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/r9b7X879oVg" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Dr. Prateek Mishra, Oracle</title> 
			<link>http://www.kuppingercole.com/podcasts/070509_interview_mishra.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/070509_interview_mishra.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;a href="http://www.youtube.com/watch?v=4jQXSNkMc8I&amp;amp;feature=channel" title="Dr. Prateek Mishra Interview"&gt;&lt;/a&gt;Felix Gaehtgens interviews Dr. Prateek Mishra at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/070509_interview_mishra.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/L-8xIUdhXps" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Anthony Nadalin, IBM</title> 
			<link>http://www.kuppingercole.com/podcasts/060509_interview_nadalin.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/060509_interview_nadalin.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Felix Gaehtgens interviews Anthony Nadalin at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/060509_interview_nadalin.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/E3H01J-f8CQ" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Pat Patterson, Sun microsystems</title> 
			<link>http://www.kuppingercole.com/podcasts/050509_interview_patterson.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/050509_interview_patterson.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Felix Gaehtgens interviews Pat Patterson at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/050509_interview_patterson.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/UmJmu_QcRX0" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Prof. Dr. Rob Fijneman, KPMG</title> 
			<link>http://www.kuppingercole.com/podcasts/070509_interview_fijneman.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/070509_interview_fijneman.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Tim Cole interviews Dr. Rob Fijneman at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/070509_interview_fijneman.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/JoF46NPfDDM" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Eve Maler, Sun Microsystems</title> 
			<link>http://www.kuppingercole.com/podcasts/050509_interview_maler.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/050509_interview_maler.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Felix Gaehtgens interviews Eve Maler at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/050509_interview_maler.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/XbrzavWoCeY" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Dr. Babak Sadighi, Axiomatics AB</title> 
			<link>http://www.kuppingercole.com/podcasts/050509_interview_sadighi.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/050509_interview_sadighi.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Felix Gaehtgens interviews Dr. Babak Sadighi at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/050509_interview_sadighi.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/eNQhxi6Tj7Y" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Fulup Ar Foll, Sun Microsystems</title> 
			<link>http://www.kuppingercole.com/podcasts/060509_interview_arfoll.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/060509_interview_arfoll.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Felix Gaehtgens interviews Fulup Ar Foll at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/060509_interview_arfoll.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/afUAZDbf5Vg" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Is there a difference between the European way of doing IAM/GRC and the rest of the world?</title> 
			<link>http://www.kuppingercole.com/podcasts/050509_keynote_2_panel.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/050509_keynote_2_panel.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Keynote at the European Identity Conference 2009&lt;/p&gt; 												 												 												&lt;div&gt;by &lt;strong&gt;Paul Heiden&lt;/strong&gt;, BHOLD COMPANY BV,&lt;strong&gt; Prof. Dr. Audun Josang&lt;/strong&gt;, Queensland University of Technology, and Oslo...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/050509_keynote_2_panel.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/uVgUWJygad8" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Identity Management Systems as a Risk?</title> 
			<link>http://www.kuppingercole.com/podcasts/050509_keynote_7_vonderhude.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/050509_keynote_7_vonderhude.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Keynote at the European Identity Conference 2009&lt;/p&gt;&lt;p&gt;by &lt;strong&gt;Niels von der Hude&lt;/strong&gt;, Beta Systems Software &lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/050509_keynote_7_vonderhude.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/MwzrXVPA5lo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>The Care and Feeding of Online Relationships</title> 
			<link>http://www.kuppingercole.com/podcasts/050509_keynote_8_maler.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/050509_keynote_8_maler.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Keynote at the European Identity Conference 2009&lt;/p&gt;&lt;p&gt;by &lt;strong&gt;Eve Maler&lt;/strong&gt;, Sun Microsystems &lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/050509_keynote_8_maler.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/JNwi-slLoKQ" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Identity Management in the Focus of eGovernment and Vertical Solutions</title> 
			<link>http://www.kuppingercole.com/podcasts/050509_keynote_4_erlinghagen.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/050509_keynote_4_erlinghagen.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Keynote at the European Identity Conference 2009&lt;/p&gt;&lt;p&gt;by &lt;strong&gt;Sabine Erlinghagen&lt;/strong&gt;, Siemens IT Solutions and Services &lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/050509_keynote_4_erlinghagen.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/-g-cvcYCLJs" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Interview with Berthold Kerl, Deutsche Bank</title> 
			<link>http://www.kuppingercole.com/podcasts/070509_interview_kerl.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/070509_interview_kerl.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Tim Cole interviews Berthold Kerl at the European Identity Conference 2009&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/070509_interview_kerl.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/iBT51Gwj1tw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>The Road to Claims: From Vision to Reality</title> 
			<link>http://www.kuppingercole.com/podcasts/050509_keynote_3_cameron.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/050509_keynote_3_cameron.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Keynote at the European Identity Conference 2009&lt;/p&gt;&lt;p&gt;by &lt;strong&gt;Kim Cameron&lt;/strong&gt;, Microsoft &lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/050509_keynote_3_cameron.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/b3_2DU6g8CE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 12 May 2009 00:00:00 +0200</pubDate>
			<title>Identity Management &amp; GRC 2009 - 2019</title> 
			<link>http://www.kuppingercole.com/podcasts/050509_keynote_1_kuppinger.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/050509_keynote_1_kuppinger.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Opening keynote at the European Identity Conference 2009&lt;/p&gt;&lt;p&gt;by &lt;strong&gt;Martin Kuppinger&lt;/strong&gt;, Kuppinger Cole + Partner &lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/050509_keynote_1_kuppinger.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/YDwBPeQ-39g" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 11 May 2009 15:35:42 +0200</pubDate>
			<title>Kuppinger Cole on Twitter</title> 
			<link>http://www.id-conf.com/blog/2009/05/11/kuppinger-cole-on-twitter/</link> 
			<guid>http://www.id-conf.com/blog/2009/05/11/kuppinger-cole-on-twitter/</guid> 
			<description>In &lt;a href="http://www.id-conf.com/blog"&gt;European Identity Conference Blog&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;You can follow &lt;a href="http://twitter.com/kuppingercole" target="_blank"&gt;@kuppingercole&lt;/a&gt; on Twitter to get the latest news from Kuppinger Cole web site in real time.&lt;/p&gt;
&lt;p&gt;Or maybe you&amp;#8217;ll be interested to follow our employees&amp;#8217; own accounts: &lt;a href="http://twitter.com/TCole1066" target="_blank"&gt;@TCole1066&lt;/a&gt;, &lt;a href="http://twitter.com/balaganski" target="_blank"&gt;@balaganski&lt;/a&gt;, &lt;a href="http://twitter.com/Lefti09" target="_blank"&gt;@Lefti09&lt;/a&gt;, &lt;a href="http://twitter.com/joergresch" target="_blank"&gt;@joergresch&lt;/a&gt;, &lt;a href="http://twitter.com/BettinaButhmann" target="_blank"&gt;@BettinaButhmann&lt;/a&gt;. I&amp;#8217;m sure others will join soon &lt;img src='http://www.id-conf.com/blog/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /&gt; &lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/tMidOdQxIQc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 09 May 2009 08:31:45 +0200</pubDate>
			<title>My Twitter Top Ten</title> 
			<link>http://blogs.kuppingercole.com/cole/2009/05/09/my-twitter-top-ten/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2009/05/09/my-twitter-top-ten/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;I know it&amp;#8217;s funny, but in fact it&amp;#8217;s me, by far the oldest guy at KCP, who is actually the greatest fan of Twitter. Perhaps if you don&amp;#8217;t have as much time left to waste as some of my younger colleagues you learn to appreciate abbreviation.&lt;/p&gt;
&lt;p&gt;Anyway, the European Identity Conference which ended yesterday here in Munich produced a bumper crop of Tweets which I have been browsing through this morning at my leisure (first time in a week I&amp;#8217;v had any), and I thought I would share a few with those of you who do not yet fully appreciate just how powerful this new medium actually is.&lt;/p&gt;
&lt;p&gt;Summing up of a large multinational conference like EIC running over many days and featuring some of the finest speakers in the industry, and doing this in a format that restricts the writer to 140 characters max, is a challenge, of course, but many of those present not only rose to it, but proved themselves past masters of terse, to-the-point, no nosense (well actually, sometimes a bit of nonsense) communication.&lt;/p&gt;
&lt;p&gt;&lt;span id="more-52"&gt;&lt;/span&gt;Kudos to Bavo de Ridder of Acerta, a Belgian IdM specialist, who ran away with the title &amp;#8220;Most Prolific Twitterer&amp;#8221; at EIC. Not only did he produce approximately twice as many Tweets as even I, no mean Twitterer myself, managed to thumb into my Palm Treo. We actually at times managed to engage in a twittered dialog, for instance when I posted &amp;#8220;Fulup Ar Foll (Sun): &amp;#8216;Roles will not fly in the Cloud&amp;#8217;&amp;#8221;, to which his immediate response was: &amp;#8220;@TCole1066 those cases where roles do fly (elegantly) are mostly those cases where roles have a simple attribute relation&amp;#8221;&lt;/p&gt;
&lt;p&gt;Sometimes our online conversations took a twirky turn, like when Martin Kuppinger gave his keynote and Bavo twittered. &amp;#8220;Attending &amp;#8220;Beyond the hype &amp;#8211; a strategical approach to cloud computing&amp;#8221; (I see hype in that title)&amp;#8221;, leading me to ponder on the &amp;#8220;Philosophical question: Is hyping hype a double positive or a double negative?&amp;#8221;.&lt;/p&gt;
&lt;p&gt;The runner up, by the way, was Heide Groshelle of Groshelle Communications, a San Francisco based PR consultancy who helped KCP get thge message about EIC out to the masses and who turns out to be at least equally at home in both the old media and the new.&lt;/p&gt;
&lt;p&gt;Tweets turned up from many of the &amp;#8220;big guns&amp;#8221; in our industry such as Sun&amp;#8217;s Eve Maler (&amp;#8221;@xmlgirl&amp;#8221;), Novel&amp;#8217;s Dale Olds (&amp;#8221;@daleolds&amp;#8221;) and Quest&amp;#8217;s Jackson Shaw (&amp;#8221;@jacksonshaw&amp;#8221;). And some like @vibronet, another non-stop Twitterer, chose to remain anonymous, which anyone is perfectly entitled to do on Twitter (one of the rapidly dwindling number of places on the Internet where you still are allowed to wear a mask in public).&lt;/p&gt;
&lt;p&gt;Anyway, for what it&amp;#8217;s worth, I give you here, dear reader, my personal list of favorites culled from 32 pages of conference postings as my very own&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Top Ten Tweets From EIC 09&lt;/strong&gt;&lt;/p&gt;
&lt;blockquote&gt;&lt;p&gt;&lt;em&gt;1.  &amp;#8220;not sure who of you is currently at #eic in munich, but it&amp;#8217;s the #1 identity conference in europe and def worth checking out.&amp;#8221;&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;br /&gt;
2.    &amp;#8221; Fulup &amp;#8220;user centric for me is a joke&amp;#8221; &amp;#8230; thank god Dick Hardt is not at this conference &amp;#8230; would have been a good fight though”&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;br /&gt;
3.    &amp;#8220;Falling cows are a huge risk since the outcome is fatal, but the probability is low. GRC is about weighing the two. Thanks Dave Kearns!&amp;#8221;&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;br /&gt;
4.    &amp;#8220;If personal information dealers would care about your consent they&amp;#8217;d ask &amp;#8211; they&amp;#8217;ve got my email&amp;#8230;&amp;#8221;&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;br /&gt;
5.    &amp;#8220;Can IdM create risk? Yes, says Niels v.d. Hude of Beta Sys. It&amp;#8217;s a single point of failure and itself should be monitored and audited&amp;#8221;&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;br /&gt;
6.    &amp;#8220;Kim Cameron states Microsoft will make Active Directory the &amp;#8220;motor&amp;#8221; for accepting and emitting claims via the Geneva STS server&amp;#8230;cool!&amp;#8221;&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;br /&gt;
7.    &amp;#8220;OMG, I&amp;#8217;ve been working on enterprise spaghetti for the last twenty years!&amp;#8221;&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;br /&gt;
8.    “Google mentioned in the keynote &amp;#8230; where is google in this conference ???”&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;br /&gt;
9.    “As long as compliance is treated as a burden, there is a systemic risk that will periodically result in (catastrophic) failures”&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;&lt;br /&gt;
10.    “Thanks all for a great #eic C u all next year!”&lt;/em&gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/XMtyhRiP-rs" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 07 May 2009 12:04:54 +0200</pubDate>
			<title>Awards for outstanding Identity management projects</title> 
			<link>http://www.kuppingercole.com/articles/awards_2009</link> 
			<guid>http://www.kuppingercole.com/articles/awards_2009</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; On the occasion of the European Identity Conference 2009 (EIC), the leading European event for Identity and Access Management (IAM) and GRC (Governance, Risk Management, and Compliance), the analyst firm Kuppinger Cole conferred the European Identity Award. The award recognizes outstanding projects as well as innovations and additional developments of standards.&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/articles/awards_2009"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/2v9C3lheHis" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 05 May 2009 12:03:33 +0200</pubDate>
			<title>EIC09: ICF-German Chapter Gründung</title> 
			<link>http://blogs.kuppingercole.com/rohr/2009/05/05/eic09-icf-german-chapter-grundung/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2009/05/05/eic09-icf-german-chapter-grundung/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Dear readers, the following post is provided bi-lingual but does not represent a one-to-one translation. Most information is for German speaking readers, so the English version is comparably short! Still, there is some general info in the English part, so please make sure you read both parts…&lt;br /&gt;
The ICF German Chapter Inauguration Meeting&lt;br /&gt;
www.informationcard.de&lt;br /&gt;
Participants: Corisecio, Fraunhofer FOKUS, Deutsche Telekom, Oracle, Novell, Arcot, Microsoft, Siemens, fun Communications, Hasso-Plattner-Institut, Azigo, KuppingerCole and MANY more!&lt;/p&gt;
&lt;p&gt;Initiated by Jens Fromm of Fraunhofer FOKUS in cooperation with Axel Nennker, Deutsche Telekom Labs, a local German speaking chapter of http://informationcard.net/ was established. The founding members and supports of www.informationcard.de will try to align their efforts as much as possible to establish an interoperable and easily to adopt exchange network, where not only cross-testing but also fully operational systems can be deployed. Goal: to foster the adoption and usage of infocards in the German speaking countries by bringing together stakeholders such as card-providers, infrastructure providers, service providers and possibly providing info to consumers.&lt;br /&gt;
A number of member presentations on technology, background, usage-scenarios and development provided a deeper insight to what is happening in the ICF and between partners. In brief, there where presentations of Deutsche Telekom of a mWallet with Nokia Symbian (NFC, functional) or Apple iPhone (just a UI, not yet fully functional) that showed a P2P (mobile2mobile two Nokias, touching…). Other use-cases besides money transfer comprise cinema ticketing and POS payment in a canteen. There also was a demo on hotel booking again with Nokia/iPhone, that visualized the goal of having the same look &amp;#038; feel on all devices. Additional (and excellent!) demos where provided by Corisicio and fun Communications, showing different ways and methods to access the KuppingerCole Site with IdentityCards. Microsoft rounded it up with showing how to authenticate to special online workspaces using Windows 7 and IE8.&lt;br /&gt;
The next month will show how the participants will create their network and infrastructure that will provide a continually usable test-bed and also an environment for real applications. Especially, it will be interesting how removing the language barrier will contribute to creating best-practices that can be handed back to larger InformationCard Community in the ICF. KuppingerCole supports these efforts by serving as a live-site to authenticate with IdentityCards as well as promoting the use of IdentityCards in a broader, more open and public community.&lt;/p&gt;
&lt;p&gt;DE&lt;br /&gt;
Eine der ersten großen Teilsessions auf der European Identity Confernce in München war das Treffen der deutschsprachigen Abteilung der InformationCard Foundation http://informationcard.net/, das weit über 20 Teilnehmer bewegt hat, sich schon vor den Keynotes am Vormittag des ersten Konferenztages zusammen zu finden. Unter Mitwirkung einiger amerikanischer Vertreter haben sich Mitarbeiter von Corisecio, Fraunhofer FOKUS, Deutsche Telekom, Oracle, Novell, Arcot, Microsoft, Siemens, fun Communications, Hasso-Plattner-Institut, Azigo und von KuppingerCole getroffen, um den derzeitigen Stand der Entwicklung zu zeigen. Wichtigster Punkt war die voll-funktionale Demonstration der Anmeldung an der KuppingerCole Site mit einer InformationCard.&lt;br /&gt;
Das Ziel des Treffens war es, alle Beteiligten und Interessierten zusammen zu bringen, die entweder aktiv an der Entwicklung von InformationCard Technologien, Kartenselektoren oder Anwendungsszenarien arbeiten. Neben der bereits angesprochenen live-Demonstration der KCP-Anmeldung wurden mehrere Ansätze zur Verwendung auf Mobiltelefonen (iPhone und Nokia Symbian) mit NFC Anbindung vorgestellt, die insbesondere dem Anwender viele Möglichkeiten zur Mehrfachnutzung bieten. Die Teilnehmer waren sich einig, dass das allgemeine Problem die bisher fehlende Adaption durch die Anwender sei – ein Weg diese Adaption zu verbessern ist eine möglichst niedrige Einstiegshürde. Im Detail bedeutet dies, ein weit reichender Support diverser Endgeräte, eine möglichst einfache Installation und Konfiguration der notwenigen Software auf den Endgeräten und eine ebenfalls möglichst hohe Portabilität bzw. Nutzbarkeit in vielen Anwendungsszenarien. Exzellente Live-Demonstrationen von fun Communications und Corisecio (ebenfalls Anmeldung an der KCP Site, jedoch über Mobiltelefone) untermauerten den hohen Anspruch, den Gruppe an sich selbst stellt.&lt;br /&gt;
Die kommende Monate werden zeigen, wie sich die deutschsprachige entwickelt und welche speziell auf den zentraleuropäischen Wirtschaftsraum abgestimmten Konzepte und Lösungen als best-practise an die Mutterorganisation weiter gegeben werden können. KuppingerCole unterstützt die Initiative nach Kräften - unter anderem mit der Möglichkeit zur Anmeldung an der KCP Site mit IdentityCard und natürlich mit allen zur Verfügung stehenden Mitteln um Anwender für die Technologie zu begeistern.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/vn0xrJSZzFE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 05 May 2009 00:00:00 +0200</pubDate>
			<title>Vendor Report: vps ID Systeme</title> 
			<link>http://www.kuppingercole.com/report/mk_vr_vps_050509</link> 
			<guid>http://www.kuppingercole.com/report/mk_vr_vps_050509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p align="justify"&gt;Die vps ID Systeme GmbH (vps) ist eine 100%ige Tochtergesellschaft der b&amp;ouml;rsennotierten Digital Identi-fication Solutions AG. Letztere ist wiederum aus dem Bereich Identifikations- und Sicherheitssysteme des KODAK-Konzerns entstanden und 2003 als unabh&amp;auml;ngiges Unternehmen gegr&amp;uuml;ndet worden. Die Digital Identification Solutions AG ist seit 2006 b&amp;ouml;rsennotiert.&lt;/p&gt;&lt;div align="justify"&gt;Die vps wiederum wurde 1992 gegr&amp;uuml;ndet und hat sich von Beginn an auf...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mk_vr_vps_050509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/T-zjngk6mg8" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 05 May 2009 00:00:00 +0200</pubDate>
			<title>Market Report: The SAP Identity Management Strategy</title> 
			<link>http://www.kuppingercole.com/report/mkmr_sapidm_040509</link> 
			<guid>http://www.kuppingercole.com/report/mkmr_sapidm_040509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;About two years have gone by since SAP took over the Norwegian manufacturer MaXware. Since then, SAP IM has positioned itself in the Identity Management market and significantly enhanced the products taken over from MaXware. In the meantime, the strategy has also become much clearer than it was two years ago.&lt;/p&gt;&lt;p&gt;The product called SAP NetWeaver Identity Management has gained a lot of attention in the market. By now, SAP can provide numerous customer references. Furthermore, it is...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mkmr_sapidm_040509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/Ke_xomu0rOw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 05 May 2009 00:00:00 +0200</pubDate>
			<title>Product Brief: Microsoft Forefront Identity Manager</title> 
			<link>http://www.kuppingercole.com/report/fg_pb_forefront_identitymanager</link> 
			<guid>http://www.kuppingercole.com/report/fg_pb_forefront_identitymanager</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;div align="justify"&gt;On Monday the 23rd of March, Microsoft announced that it would - again - delay the launch of ILM 2, the &amp;quot;Identity Lifecycle Manager&amp;quot;. The release was now pushed back one whole year, to give Microsoft more time to &amp;quot;validate ILM in long-running live deployments before release&amp;quot;. As can be expected, this announcement has caused a considerable amount of reactions, ranging from delight to frustration. The blogosphere and newswires soaked up the news and were...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/fg_pb_forefront_identitymanager"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/yYUT7NnLbyo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 05 May 2009 00:00:00 +0200</pubDate>
			<title>Vendor Report: Beta Systems</title> 
			<link>http://www.kuppingercole.com/report/mk_vr_betasystems_050509</link> 
			<guid>http://www.kuppingercole.com/report/mk_vr_betasystems_050509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Die Beta Systems Software AG ist ein in Berlin ans&amp;auml;ssiger Anbieter von Standardsoftwareprodukten. &lt;/p&gt;  &lt;p align="justify"&gt;Das Unternehmen unterst&amp;uuml;tzt die Bereiche Security (mit Fokus auf Identity und Access Management) und Compliance sowie Dokumentenverarbeitung, die Verarbeitung von gro&amp;szlig;en Datenmengen in Rechenzentren und das Management und die Automatisierung in Rechenzentren.&lt;/p&gt;  &lt;p align="justify"&gt;Die Produkte und L&amp;ouml;sungen zielen auf die Prozessoptimierung in der...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mk_vr_betasystems_050509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/QeEbshY9ihY" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 05 May 2009 00:00:00 +0200</pubDate>
			<title>Vendor Report: Aveksa</title> 
			<link>http://www.kuppingercole.com/report/mk_vr_aveksa_050509</link> 
			<guid>http://www.kuppingercole.com/report/mk_vr_aveksa_050509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;div align="justify"&gt;Aveksa's claim is &amp;quot;Enterprise Access Governance&amp;quot;. The company is one of several startups which provide a GRC platform to support requirements of what Kuppinger Cole calls IAM-GRC, e.g. the Identity and Access Management related aspects of GRC (Governance, Risk Management, and Compliance). Aveksa was founded in 2006, by an experienced team including several former executives from Netegrity, a market leader in identity and access management software that was...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mk_vr_aveksa_050509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/7pNZvAXXUkE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 04 May 2009 08:50:27 +0200</pubDate>
			<title>Where in the Cloud am I?</title> 
			<link>http://blogs.kuppingercole.com/cole/2009/05/04/where-in-the-cloud-am-i/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2009/05/04/where-in-the-cloud-am-i/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Recently, at a press briefing by German IBM boss Stefan Jetter who waxed enthusiastic about Cloud Computing, an elderly journalist rose and asked him a show-stopper: “Where are my data when they’re out there in the Cloud?” Jetter did a double take, but my colleague pressed on: “I mean, physically, where are they?”&lt;/p&gt;
&lt;p&gt;Of course, the answer is: On some nameless server somewhere, anywhere in a grid farm in Ohio or Dublin or… In fact, the usual answer is : Who cares?&lt;/p&gt;
&lt;p&gt;Well, for one the German privacy protection agencies. Passing data across national boundaries can be a federal offense not only here. The &lt;a href="http://en.wikipedia.org/wiki/Data_Protection_Directive#Transfer_of_personal_data_to_third_countries"&gt;EU Data Protection Directive&lt;/a&gt; (officially Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data) mandates that personal data may only be transferred to third countries if that country provides an adequate level of protection – something the U.S., just to name one, does not, at least not according to European standards, especially since foreigners do not benefit from the US Privacy Act of 1974.&lt;/p&gt;
&lt;p&gt;&lt;a href="http://www.crunchbase.com/person/martin-buhr"&gt;&lt;span id="more-43"&gt;&lt;/span&gt;Martin Buhr&lt;/a&gt;, the European head of Amazon&amp;#8217;s Web Services (@tallmartin on Twitter) and the champion of Amazon’s &lt;a href="http://aws.amazon.com/ec2/"&gt;Elastic Compute Cloud&lt;/a&gt; (EC2), with whom I shared a recent panel on Cloud Computing, has a pragmatic solution to the question of where to store data in the Cloud and whether or not location matters. Amazon operates separate Cloud Computing centers in the States and in Ireland, so problem solved. Or is it?&lt;/p&gt;
&lt;p&gt;Operating what are essentially two Clouds (called “Availability Zones”), each running on its own physically distinct, independent infrastructure, makes sense from a data center perspective. Common points of failures like generators and cooling equipment are not shared across AZs. This sounds similar to the common practice of data center redundancy, but normally this is done to ensure operational security. Data are mirrored back and forth constantly so if one center goes down, the other can pick up immediately. But in this case, at least theoretically, there is no redundancy since these are essentially two separate systems.&lt;/p&gt;
&lt;p&gt;Only, of course, they aren’t. So Amazon has added a system whereby EC2 assigns regional IP addresses to its customers, so presumably it is easy to determine which data can travel across the Atlantic and which can’t. I don’t want to get into a long discussion about IP spoofing and similar technologies developed to foil state-run censorship systems like the Great Firewall of China, but you get the general idea. Okay, they use IPv4, but Version 4 addresses are a scarce resource. And yes, they claim they have compliance options that will make hosting data in the Cloud both safe and legal.&lt;/p&gt;
&lt;p&gt;Maybe I’m cynical, but I’ve been around too long and heard too many tales of supposedly fail-safe systems being compromised by whiz-kids or Russian Mafiosi to really believe that quick fixes on the infrastructure level will hold out forever. I would prefer to see Amazon and others in the Cloud community discussing user-centric identity-based approaches to the problem instead of essentially saying: “Trust us” I’m pretty sure my elderly colleague won’t. He’d like to be able to check out for himself exactly where somebody put his data.&lt;/p&gt;
&lt;p&gt;PS: Maybe we&amp;#8217;ll hear more on this at &lt;a href="http://www.id-conf.com/eic2009"&gt;EIC 09 &lt;/a&gt;which starts tomorrow in Munich. If you&amp;#8217;re interested, stop by my panel on &amp;#8220;&lt;a style="text-decoration: none;" href="http://www.id-conf.com/tracks/77"&gt;(User Centric) Identity in the Cloud&lt;/a&gt;&amp;#8221; which is scheduled for 2 pm on Tuesday.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/XduqAPEdz1M" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 02 May 2009 00:00:00 +0200</pubDate>
			<title>Trend Report: The impact of claims-based approaches</title> 
			<link>http://www.kuppingercole.com/report/mktr_claims_based_020509</link> 
			<guid>http://www.kuppingercole.com/report/mktr_claims_based_020509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; The term of &amp;ldquo;claims-based identity&amp;rdquo; and the idea overall of using the term &amp;ldquo;claim&amp;rdquo; in Identity and Access Management (IAM) has been introduced by Microsoft some two years ago but the concepts can be used in any environments and technologies can (and sometimes are) provided by other vendors as well.&lt;br /&gt;&lt;br /&gt;A claim is a piece of information about a user provided by an identity provider which can be challenged by the relying party which receives that claim. Claims can...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mktr_claims_based_020509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/OhwguuerZ7E" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 02 May 2009 00:00:00 +0200</pubDate>
			<title>Market Report: Die Identity Management-Strategie von SAP</title> 
			<link>http://www.kuppingercole.com/report/mkmr_idmstra_sap_020509</link> 
			<guid>http://www.kuppingercole.com/report/mkmr_idmstra_sap_020509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; Seit der &amp;Uuml;bernahme des norwegischen Herstellers MaXware durch SAP sind inzwischen rund zwei Jahre vergangen. Seit diesem Zeitpunkt hat sich SAP IM im Identity Management-Markt positioniert. Die von MaXware &amp;uuml;bernommenen Produkte wurden in dieser Zeit signifikant wei-terentwickelt. Auch in der Strategie gibt es inzwischen deutlich mehr Klarheit als noch vor zwei Jahren.&lt;br /&gt;&lt;br /&gt;Das als SAP NetWeaver Identity Management bezeichnete Produkt hat erhebliche Aufmerk-samkeit im Markt...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mkmr_idmstra_sap_020509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/8ed5iQuAgYY" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 02 May 2009 00:00:00 +0200</pubDate>
			<title>Market Report: GRC 2009</title> 
			<link>http://www.kuppingercole.com/report/mkmr_grc09020509</link> 
			<guid>http://www.kuppingercole.com/report/mkmr_grc09020509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; GRC (Governance, Risk Management, Compliance) is amongst the most important emerging market segments in IT. Kuppinger Cole observes an trend towards tools which integrate analysis, attestation, authorization management, risk management, Segregation of Duties controls, and role management functionalities to provide an overall GRC solution with focus on access controls and authorization which can be applied to all applications and all compliance regulations which are relevant to any...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mkmr_grc09020509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/l79MlNEPBtE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 02 May 2009 00:00:00 +0200</pubDate>
			<title>Market Report: Oracle buys Sun  the Impact on IAM and GRC strategies and tactics</title> 
			<link>http://www.kuppingercole.com/report/mkfgmr_orasun_020509</link> 
			<guid>http://www.kuppingercole.com/report/mkfgmr_orasun_020509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; The news that Oracle will acquire Sun Microsystems has lead to some uncertainty at existing Oracle and Sun customersin the IAM and GRC market space. That uncertainty will exist for quite some time, given that the acquisition is not expected to close before the summer of 2009. Until that point of time, both vendors will have to act separately and are not allowed to publish a combined roadmap.&lt;br /&gt;&lt;br /&gt;Kuppinger Cole has, as part of its research programme, extensively researched both...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mkfgmr_orasun_020509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/7UKfwf_AoN0" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 02 May 2009 00:00:00 +0200</pubDate>
			<title>Technology Report: Strong authentication for user-centric Identity Management</title> 
			<link>http://www.kuppingercole.com/report/mk_techrepo_strongim_020509</link> 
			<guid>http://www.kuppingercole.com/report/mk_techrepo_strongim_020509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; Currently, there is a lot of work done around user-centric identity management. But until now, there is a lack of strong authentication in that area &amp;ndash; even while there are several existing approaches which can be used and even while there are many potential identity providers.&lt;br /&gt;&lt;br /&gt;Despite the fact, that there are several open questions regarding business models for identity providers and the, until now, slow adoption of user-centric technologies beyond the experts and geeks, we...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mk_techrepo_strongim_020509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/kzvsjf9nduM" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 02 May 2009 00:00:00 +0200</pubDate>
			<title>Trend Report: SSO 2009</title> 
			<link>http://www.kuppingercole.com/report/mktr_sso2009020509</link> 
			<guid>http://www.kuppingercole.com/report/mktr_sso2009020509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; Single Sign-On (SSO) ist eines der wichtigsten Felder im Identity und Access Management (IAM).Durch eine vereinheitlichte Authentifizierung k&amp;ouml;nnen eine Reihe von Business-Values erreicht werden, darunter reduzierte Risiken f&amp;uuml;r Sicherheit und Compliance sowie niedrigere Service Desk-Kosten.&lt;br /&gt;&lt;br /&gt;Innerhalb der Vielzahl von unterschiedlichen technischen Ans&amp;auml;tzen f&amp;uuml;r das Single Sign-On sehen wir Identity Federation und, in Erg&amp;auml;nzung f&amp;uuml;r spezielle Einsatzfelder,...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mktr_sso2009020509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/eqe5oDRbU-I" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 01 May 2009 00:00:00 +0200</pubDate>
			<title>Vendor Report: Siemens</title> 
			<link>http://www.kuppingercole.com/report/mk_vrsiemens_010409</link> 
			<guid>http://www.kuppingercole.com/report/mk_vrsiemens_010409</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; Siemens ist eines der gr&amp;ouml;&amp;szlig;ten Unternehmen weltweit. Innerhalb des in verschiedene Segmente [Siemens spricht hier von Sektoren] gegliederten Konzerns gibt es auch den Bereich Siemens IT Solutions and Services (SIS), der f&amp;uuml;r IT-Produkte und &amp;ndash;Dienstleistungen zust&amp;auml;ndig ist. Diesem Bereich sind auch die etablierten IAM- und GRC-Produkte von Siemens zugeordnet.&lt;br /&gt;&lt;br /&gt;Zu den Produktangeboten f&amp;uuml;r IT-Sicherheit geh&amp;ouml;ren neben IAM-Kernl&amp;ouml;sungen auch...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mk_vrsiemens_010409"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/RMqkHoV-6mc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 01 May 2009 00:00:00 +0200</pubDate>
			<title>Product Report: Omada Identity Manager</title> 
			<link>http://www.kuppingercole.com/report/mk_pr_omada_id_010509</link> 
			<guid>http://www.kuppingercole.com/report/mk_pr_omada_id_010509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; Der d&amp;auml;nische Hersteller Omada hat sich in den vergangenen Jahren als wichtigster Technologiepartner von Microsoft im Umfeld von MIIS und Forefront Identity Manager positionieren k&amp;ouml;nnen. Gemeinsam mit Microsoft wurden eine Reihe von gro&amp;szlig;en Projekten gewonnen und zusammen mit unterschiedlichen Integrationspartnern umgesetzt.&lt;br /&gt;&lt;br /&gt;Omada erweitert dabei die derzeit prim&amp;auml;r auf die technische Synchronisation von Identit&amp;auml;tsinformationen ausgelegte...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mk_pr_omada_id_010509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/S4_dX_PshRQ" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 01 May 2009 00:00:00 +0200</pubDate>
			<title>Vendor Report: TESIS SYSware</title> 
			<link>http://www.kuppingercole.com/report/mk_vr_tesis_010409</link> 
			<guid>http://www.kuppingercole.com/report/mk_vr_tesis_010409</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; Die TESIS SYSware ist ein in M&amp;uuml;nchen beheimatetes Unternehmen in Privatbesitz, das Teil der TESISGruppe ist. Diese Unternehmensgruppe besteht aus drei Teilunternehmen, die sich mit unterschiedlichen IT-Themenfeldern besch&amp;auml;ftigen. Die TESIS SYSware (im Folgenden kurz als TESIS bezeichnet) hat ihren Schwerpunkt in den Bereichen IT-Security und Identity Management und ist ein Anbieter von standardisierten Softwareprodukten in diesem Bereich.&lt;br /&gt;&lt;br /&gt;Das Unternehmen ist dabei...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mk_vr_tesis_010409"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/BCLMbZDZLkU" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 01 May 2009 00:00:00 +0200</pubDate>
			<title>Product Report: Quest ActiveRoles Server</title> 
			<link>http://www.kuppingercole.com/report/mk_prquest_active_010509</link> 
			<guid>http://www.kuppingercole.com/report/mk_prquest_active_010509</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; Der Quest ActiveRoles Server ist der Produktkategorie Enterprise Provisioning zuzuordnen. Das Produkt ist dabei keine typische Provisioning-L&amp;ouml;sung, sondern im Kern ein Werkzeug f&amp;uuml;r die rollenbasierte Verwaltung von Active Directory-Umgebungen, das inzwischen auch eine zunehmende Zahl von anderen Systemumgebungen unterst&amp;uuml;tzt.&lt;br /&gt;&lt;br /&gt;Entsprechend liegen die spezifischen St&amp;auml;rken des Produkts auch beim Management von Active Directory-Umgebungen, wo es in der...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mk_prquest_active_010509"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/JfhYcppLfuc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 30 Apr 2009 00:00:00 +0200</pubDate>
			<title>Produktbericht: Radiant Logic Virtual Directory Server</title> 
			<link>http://www.kuppingercole.com/report/fgpr_radiant_virt_300409</link> 
			<guid>http://www.kuppingercole.com/report/fgpr_radiant_virt_300409</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Mit dem Release 5.0 des Virtual Directory Server hat Radiant Logic seine Produktlinie in die VDS Proxy Edition und die VDS Context Edition aufgespaltet, um den spezifischen Anforderungen der Verzeichnisvirtualisierung besser entsprechen zu k&amp;ouml;nnen. Viele der Anforderungen an Virtual Directories entstehen aus den spezifischen Umsetzungsproblemen, die &amp;uuml;berwunden werden m&amp;uuml;ssen und die am besten &amp;uuml;ber gezielte Punktl&amp;ouml;sungen gel&amp;ouml;st werden. Die VDS Proxy Edition von...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/fgpr_radiant_virt_300409"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/asxkgA5-_2Y" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 30 Apr 2009 00:00:00 +0200</pubDate>
			<title>Produktbericht: SailPoint IdentityIQ</title> 
			<link>http://www.kuppingercole.com/report/mkpr_sailpoint_300409</link> 
			<guid>http://www.kuppingercole.com/report/mkpr_sailpoint_300409</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;SailPoint IdentityIQ ist eines der f&amp;uuml;hrenden Produkte im aufstrebenden Marktsegment der Identiy/Access-GRC-Plattformen, das leistungsstarke Funktionen in den Bereichen Attestierung, Audit, Analyse und Rollenverwaltung bietet &amp;ndash; Letzteres wurde im aktuellen Release deutlich verbessert. Das Produkt unterst&amp;uuml;tzt einen Risiko-Scoringansatz mit Schwerpunkt auf dem Identit&amp;auml;tsrisiko, ist jedoch keine vollwertige Enterprise Risk Management-L&amp;ouml;sung. &amp;Uuml;ber direkte...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/report/mkpr_sailpoint_300409"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/_VHvVDwmPYI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 29 Apr 2009 15:08:21 +0200</pubDate>
			<title>10 Top Trends 2009 for IAM and GRC</title> 
			<link>http://www.kuppingercole.com/articles/top_trend_iam_grc_290409</link> 
			<guid>http://www.kuppingercole.com/articles/top_trend_iam_grc_290409</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; As in the past years, Kuppinger Cole has worked out 10 top trends in IAM (Identity and Access Management) and GRC (Governance, Risk Management, Compliance). Things are going forward in 2009, despite the economic crisis  even more, especially GRC vendors are benefiting from the crisis and the increasing investments in GRC. The need for Risk Management is well understood now.&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/articles/top_trend_iam_grc_290409"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/ESap20AIuc0" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 28 Apr 2009 10:49:03 +0200</pubDate>
			<title>The rationales behind the Oracle-Sun deal</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/04/28/the-rationales-behind-the-oracle-sun-deal/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/04/28/the-rationales-behind-the-oracle-sun-deal/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;The (planned) Oracle/Sun deal has gained a lot of attention. There was a lot of discussion of the rationales behind. But most of them didn&amp;#8217;t really touch the point why Oracle will spend so much money for Sun. Have a look at the rationales:&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;The hardware?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;Not really. Oracle never has done hardware business before. That is another type of business. For sure there are some advantages. It is a little easier for Oracle to offer appliances, but they could have done this with standard hardware and some flavour of Linux. For sure, for big shops that might become interesting &amp;#8211; highly scalable hardware and the database or application server or a business system. But on the other hand, the overall margins will decrease for these deals. And the aspect that it becomes cheaper for Oracle to equip its own cloud data centers in the future isn&amp;#8217;t worth to take the risk of a hardware business.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;The Solaris operating system?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;As well &amp;#8211; some few advantages but no real one. With hardware and a high-level server operating system, Oracle is more competitive with companies like IBM and Oracle, the (from a revenue perspective) real big guys in the industry. And Oracle might even bring some market share back to Solaris, by preferring that OS. But overall, there is not that much value in there. Solaris is fine for large cloud data centers, but it is overkill for many appliances. The overall value of obtaining an OS thus is somewhat limited for Oracle.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;The IAM and GRC tools?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;Even while we are experts around IAM and GRC &amp;#8211; that wasn&amp;#8217;t the reason behind. In contrast, that is one of the areas with a huge overlap and thus a lot of potential problems in defining a roadmap and migration paths for existing customers.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;The cloud?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;Again &amp;#8211; not really. There are some advantages in having own hardware and an operating system for high scale cloud data centers. But Oracle would have been well able to manage the move towards the cloud without that. And if it were about the cloud, there probably would have been better choices than Sun.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;The psychology?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;Yes, to some degree. Oracle now really competes with IBM at any level. It has an own operating system. But that is not the real rationale behind the deal, even while that thought might have influenced the decision making.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;The market share?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;Which market share? Oracle is buying market share, no doubt. They have done this with acquisitions like PeopleSoft, they have done this especially when acquiring BEA. But there is a rationale behind that about which I will talk later.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;The Java stack?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;No. There are probably more risks than advantages. Improving the stack itself is an investment without direct return. That might improve the position of Oracle in the application server field. But given that Sun has &amp;#8220;owned&amp;#8221; Java and nevertheless hasn&amp;#8217;t been the leader in the market of application infrastructures shows that this is not the main reason. Besides this, there might be sort of a trust issue in Oracle owning that stack &amp;#8211; Sun has been more trusted in supporting open source than Oracle is. And other companies like IBM and SAP which are heavily relying on Java might as well be somewhat disappointed. Oracle is a much more heavyweight competitor for them than Sun has been.&lt;/p&gt;
&lt;p&gt;And yes. Oracle will be able to drive some things forward in the stack. Think about an integration of JAAS (Java Authentication and Authorization Service) with Oracle&amp;#8217;s concept of SOS (Service Oriented Security). By doing this, Oracle might gain some advantage for their &amp;#8220;engines&amp;#8221; which provide these services and some tighter integration than others can provide.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;The application server?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;Yes, to some degree. The market share of what Sun provides around application infrastructures (development tools and so on) is somewhat relevant but not the main reason. But overall there is the question whether Oracle really wants to maintain Glassfish, Fusion, and WebLogic. And for sure Oracle expands its grip on that market.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;The expanded lead in application infrastructures?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;Here you go. That is the real target of Oracle. That is why they have bought BEA, that is why they have been heavily investing in IAM and other areas of the IT market. For a long time, there have been the operating systems and the business applications as the instruments of power in the IT industry. That is changing, with the business processes and the supporting application infrastructure becoming the new instrument of power. That is the reason why companies like Oracle, SAP and IBM (based on Java) as well as Microsoft (based on the .NET Framework) are heavily competing for that market. The one who is in control of the business process platform has managed to achieve the vendor lock-in &amp;#8211; the more specific features of the platform are used, the more lock-in.&lt;/p&gt;
&lt;p&gt;That is, from my perspective, the real rationale behind that deal. From that perspective, it is not that much a market &lt;em&gt;share&lt;/em&gt; deal but a market &lt;strong&gt;power&lt;/strong&gt; deal. That is the reason why Oracle buys several elements of limited value for Oracle (not of limited value from an overall perspective, for sure!). That is the reason why Oracle again spends a lot of money and takes some risks. Java helps, the market share in the application server market helps. But they are not the key reasons for that decision.&lt;/p&gt;
&lt;p&gt;Interestingly, most customers haven&amp;#8217;t yet understood what is happening in the IT market from a strategic point of view. Otherwise, they wouldn&amp;#8217;t leave platform decisions in the area of IT infrastructure to some developers and architects or, in best case, the CIO, but understand that as a decision with a long-term strategic impact on the entire organization.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/RxgfyVRm_QI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 27 Apr 2009 11:51:52 +0200</pubDate>
			<title>The balance act of changing the business model</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/04/27/the-balance-act-of-changing-the-business-model/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/04/27/the-balance-act-of-changing-the-business-model/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Last week Microsoft has announced that they will offer own cloud computing services in nineteen different countries. The approach is &amp;#8220;hosted by Microsoft, offered by partners&amp;#8221;. That is an interesting approach and it is obviously the result of Microsoft&amp;#8217;s thoughts about how to manage the balance act between the existing business model and the upcoming cloud computing business.&lt;/p&gt;
&lt;p&gt;On one hand, Microsoft relies on their partners which sell software licenses today. On the other hand, Microsoft has to provide offerings as cloud services. Until now, there have been some limited offerings for example with value-adding services for Exchange infrastructures or, in a specific market segment, the Office LiveMeeting product. With last week&amp;#8217;s announcement, Microsoft provides core services like Exchange Online and SharePoint Online by themselves. The services aren&amp;#8217;t sold directly by Microsoft but via 2.500+ specialized partners.&lt;/p&gt;
&lt;p&gt;Microsoft has as well announced that this is just the beginning of their &amp;#8220;Software and Services&amp;#8221; strategy, thus other solutions will be added. Given that the pretty prominent URL &lt;a href="http://www.microsoft.com/online"&gt;www.microsoft.com/online&lt;/a&gt; (or &lt;a href="http://www.microsoft.de/online"&gt;www.microsoft.de/online&lt;/a&gt; or similar URLs) is used it becomes clear that this type of business shall provide a significant part of the future revenue stream of Microsoft.&lt;/p&gt;
&lt;p&gt;Even with this business model which focuses on sharing revenues between Microsoft and the partners, there is still some potential conflict with partners. The price tag defined by Microsoft is sort of the upper border for Hosted Exchange and Hosted SharePoint Services. Thus, some of the existing hosting partners of Microsoft will have to change their price tags. Microsoft now is the one who controls the price tag. Partners might add services, for sure.&lt;/p&gt;
&lt;p&gt;But many partners will have to rethink their business model. On one hand, participating in a constant revenue stream is interesting. On the other hand, the more parts of the environment are delivered from the cloud, the less project revenues will occur. That is a risk for partners.&lt;/p&gt;
&lt;p&gt;From a Microsoft perspective, the model looks more interesting. Microsoft has the biggest network of resellers for cloud services in the market, Microsoft can compete with other cloud vendors and Microsoft adds a service-based revenue model to its existing license-based models.&lt;/p&gt;
&lt;p&gt;It will be interesting to observe how that model affects the existing partnerships as well as the entire cloud market. Despite some scepticism I think that the chosen model is the best solution for the balance act Microsoft has to do. And I&amp;#8217;m as well convinced that it will allow Microsoft to take a significant share of that particular area of the cloud market. It might again prove that Microsoft is pretty well able to adopt to changes &amp;#8211; like they have done multiple times before.&lt;/p&gt;
&lt;p&gt;By the way: Don&amp;#8217;t miss &lt;a title="Cloud 09" href="http://www.kuppingercole.com/events/cc09" target="_blank"&gt;Cloud &amp;#8216;09&lt;/a&gt; and &lt;a title="European Identity Conference" href="http://www.kuppingercole.com/events/eic2009" target="_blank"&gt;EIC 2009&lt;/a&gt;!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/yw_DaQh8RGo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 23 Apr 2009 00:00:00 +0200</pubDate>
			<title>Enterprise Single Sign-On in der Praxis</title> 
			<link>http://www.kuppingercole.com/podcasts/enterprise_sso_praxis.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/enterprise_sso_praxis.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/enterprise_sso_praxis.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/mlmTfiDVcGs" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 22 Apr 2009 18:00:20 +0200</pubDate>
			<title>Sun integrates MySQL with IDM Offering</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2009/04/22/sun-integrates-mysql-with-idm-offering/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2009/04/22/sun-integrates-mysql-with-idm-offering/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Sun Microsystems has just announced at the annual MySQL Conference that it is adding extended support for MySQL into its Identity Management stack. That&amp;#8217;s great, but what does it mean? For one, MySQL is hugely popular &amp;#8211; starting off as an embedded open source database, and slowly but surely pushing into the enterprise RDBMS area over the years. Most enterprises use MySQL somewhere &amp;#8211; some of them use MySQL strategically (i.e.: if you need a database, consider MySQL as one of the option, or even as the default option).&lt;/p&gt;
&lt;p&gt;So what does this have to do with identity management? Most databases are used by applications, and many of these application have some user schema in their databases. This means that identity information is widely dispersed through very many different databases throughout the enterprise, like a mosaic. Identity management over the years has been making the promise to consolidate, bind together and manage identity information, and Sun Microsystems has an extensive identity management offering that does exactly that. Sun&amp;#8217;s added support for MySQL with their entire identity stack takes this to a new level by allowing organizations to bind together data regardless of whether it is stored in an classic directory or relational database.&lt;/p&gt;
&lt;p&gt;For one, Sun Microsystems has enhanced and strengthened the links between MySQL and the two directory servers: DSEE and OpenDS. DSEE (Directory Server Enterprise Edition) is Sun Microsystems&amp;#8217; flagship directory server that combines essential enterprise features with carrier class scalability. OpenDS started off as a project to be Sun&amp;#8217;s next generation directory product line, and is very successful as an embedded directory. In several years, OpenDS is due to replace Sun&amp;#8217;s current flagship directory server, DSEE (Directory Server Enterprise Edition).&lt;/p&gt;
&lt;p&gt;The enhanced integration brings numerous advantages to both enterprise and telco directory scenarios, and I&amp;#8217;ll go through them briefly. Let&amp;#8217;s start with the Telcos, as it is always impressive to talk about massive scalability, availability and speed. MySQL can be used as a back-end data store for OpenDS, Sun&amp;#8217;s open source directory server. According to an announcement made yesterday, OpenDS Standard edition can be integrated with MySQL Cluster.  When used together, the OpenDS provides the LDAP directory front-end to a rock-solid, clustered relational database. This is really interesting for Telcos, service providers and other very large directory users that need scalability and have very high availability requirements. Using a clustered relational database such as MySQL Cluster as a back-end for OpenDS allows administrators to gain extra flexibility for data management which comes in really handy when the amount of data is massive. It also give more options for providing a on-stop directory service. LDAP Directory servers are typically deployed as a set of equivalent multi-master servers &amp;#8211; each &amp;#8220;master&amp;#8221; managing an autonomous copy of the data set. A replication mechanism is then used to keep all masters in synch. Now add the clustering features, and the resulting mix is like a swiss army knife for those that need the ultimate flexibility and resilience in directory services.&lt;/p&gt;
&lt;p&gt;In fact after this integration, OpenDS and OpenLDAP are the only directory servers that allows users to choose either a &amp;#8220;traditional&amp;#8221; Berkeley DB based embedded backend or a relational database backend to be used. The former is great for enterprises that prefer a maintenance-free zero-administration back-end, and because of this many directory servers have traditionally used Berkeley DB. The latter, using a fully-fledged relational database as a back-end for directory servers opens up many possibilities in terms of data management, but is more difficult to manage. Traditionally, users had to choose a different product depending on whether the priority was ease of maintenance or sophisticated data management features when choosing a directory server. Now OpenDS have a choice with the same product. But not just OpenDS, Sun is actually licensing MySQL cluster as &amp;#8220;MySQL Cluster Carrier Grade Edition&amp;#8221; to be used either with OpenDS or OpenLDAP. I know quite a few LDAP directory administrators working in large Telcos, and I&amp;#8217;m sure they&amp;#8217;re thrilled.&lt;/p&gt;
&lt;p&gt;On the enterprise side, Sun has added virtual directory features to DSEE to easily link into MySQL databases. This means that data that used to be stashed away in MySQL databases can now be made easily through the LDAP protocol. Being an advanced feature of virtual directory servers, it shows Sun&amp;#8217;s  commitment to extend their virtual directory offering.&lt;/p&gt;
&lt;p&gt;But MySQL support has not just been enhanced in Sun&amp;#8217;s directory servers. Sun Identity Manager can read and provision identity data to and from any MySQL database schema, and can now even use MySQL as its primary internal data repository. Role Manager can use MySQL as its identity warehouse. OpenSSO can also use MySQL as an identity repository. In a way this was to be expected when Sun acquired MySQL a bit more than a year ago &amp;#8211; to start building on its acquired RDBMS platform and integrate it with its other offerings, in this case Identity Management. It is actually quite impressive how fast this integration has happened when compared to other vendors who take considerably longer &amp;#8220;digesting&amp;#8221; acquisitions and combining them to maximise value.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/hCUUNUz_3OY" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 22 Apr 2009 16:43:39 +0200</pubDate>
			<title>How could a future Oracle-Sun Identity Management Stack look like?</title> 
			<link>http://www.kuppingercole.com/articles/fg_mk_oracle_sun220409</link> 
			<guid>http://www.kuppingercole.com/articles/fg_mk_oracle_sun220409</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com"&gt;Kuppinger Cole + Partner&lt;/a&gt;&lt;br&gt;&lt;br&gt; On the 20th of April, news of Oracle's intention to acquire of Sun Microsystems took most people by surprise. Reactions predictably covered the whole spectrum, with an abundance of comments going each way between delight and dismay. We've been asked for comments by customers and journalists over the last days, and have talked with several customers of both companies. Obviously, both Sun and Oracle employees are under strict orders not to comment on the proposed acquisition, and it is...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/articles/fg_mk_oracle_sun220409"&gt;more&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/TBRjp_aA1GM" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 20 Apr 2009 14:35:50 +0200</pubDate>
			<title>Liberty Alliance moves to Kantara</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/04/20/liberty-alliance-moves-to-kantara/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/04/20/liberty-alliance-moves-to-kantara/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Today, Liberty Alliance will move to a new organization named Kantara. That is based on the analysis that security, privacy, and minimal disclosure of end users&amp;#8217; personal information are becoming more and more important. In this area, several initiatives are on their way. The idea of Kantara now is to build an umbrella organization for the entire identity industry and to streamline different initiatives. Liberty Alliance will become a part of that bigger effort.&lt;/p&gt;
&lt;p&gt;The interesting question will be: Will Kantara become a big umbrella or a small one? There are several interesting initiatives within the Liberty Alliance today, but there are many initiatives outside of that. There are OASIS standardizations like SPML and SAML, there is the Information Card Foundation (ICF), there are many other activities on different levels up to industry specific standardizations.&lt;/p&gt;
&lt;p&gt;Thus it might appear that Kantara becomes more sort of a Liberty Alliance relaunch &amp;#8211; if they don&amp;#8217;t succeed in integrating at least most of the other relevant initiatives. Let&amp;#8217;s wait and see&amp;#8230;&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/YKUJKlnBBxg" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 20 Apr 2009 14:20:00 +0200</pubDate>
			<title>Sun and Oracle – I would have won my bet</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/04/20/sun-and-oracle-i-would-have-won-my-bet/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/04/20/sun-and-oracle-i-would-have-won-my-bet/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Today Oracle announced that they will acquire Sun. That isn&amp;#8217;t a real surprise to me. When the potential acquisition of Sun by IBM has been discussed some weeks ago, I&amp;#8217;ve been asked about my view on that. From my perspective that would have been mainly a market share deal. And when big market share deals are discussed, Larry Ellison isn&amp;#8217;t far away. Thus I&amp;#8217;ve said at that point of time that Oracle might as well make a bid. The third company I had in mind was Cisco, but they have missed that opportunity (which would have improved their strategic positioning significantly).&lt;/p&gt;
&lt;p&gt;Right now, Larry Ellison has made it again. And from his perspective, that makes sense. He acquires market share in the application infrastructure and IT infrastructure market, and he gains access to much more Java intellectual property. Despite some overlaps in the portfolio, Oracle benefits from that. They become the &amp;#8220;Java company&amp;#8221; and they have acquired several other interesting pieces of software. Regarding Solaris, the advantages aren&amp;#8217;t that obvious. But at least Oracle has an own operating system right now which might become interesting for appliances and for other new types of solutions. The other way round, Solaris might benefit from other Oracle offerings as part of larger packages or enterprise license agreements &amp;#8211; and given that Oracle right now is a hardware vendor as well, they might provide interesting bundles to their customers.&lt;/p&gt;
&lt;p&gt;It is noteworthy that Oracle doesn&amp;#8217;t talk much about the hardware business in the initial press release. But the sentence of &amp;#8220;Oracle will be the only company that can engineer an integrated system &amp;#8211; applications to disk &amp;#8211; where all pieces fit together&amp;#8230;&amp;#8221; is an indicator of Oracle planning to keep the hardware business and not to sell it. And given the opportunities for selling larger projects, for the appliance market, and for future cloud offerings (based on own hardware), there is some potential in that combination.&lt;/p&gt;
&lt;p&gt;Specifically for IAM and GRC, there are some overlaps. But there are also specific strengths in both portfolios, with for example the very fast Sun Directory Server - and with the installed base of Sun. Anyhow, customers will have to carefully analyze the combined roadmaps of both companies. There are overlaps and that might lead to scenarios where customers have to migrate at some point of time in the future.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/HWF2NWJsqMY" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 16 Apr 2009 00:00:00 +0200</pubDate>
			<title>Controlling the Impacts of Recession on IT Security</title> 
			<link>http://www.kuppingercole.com/podcasts/controlling_impacts_of_recession.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/controlling_impacts_of_recession.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/controlling_impacts_of_recession.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/ishfe33ml9Q" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 16 Apr 2009 00:00:00 +0200</pubDate>
			<title>Cloud Computing  Opportunities &amp; Risk</title> 
			<link>http://www.kuppingercole.com/podcasts/cloud_cumouting_opportunities_risk.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/cloud_cumouting_opportunities_risk.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/cloud_cumouting_opportunities_risk.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/x22XAQLiLqI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 14 Apr 2009 18:56:38 +0200</pubDate>
			<title>Identity Management and the Cloud</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/04/14/identity-management-and-the-cloud/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/04/14/identity-management-and-the-cloud/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Cloud Computing will be the next big paradigm shift in IT. I have no doubt about that. But like with in many other cases, there is first of all a vision, then a buzzword, then some basic technology &amp;#8211; and then people start to think about things like reliability and security. The same is true with Cloud Computing. There are many services out there, but IAM and GRC for the cloud are heavily underestimated.&lt;/p&gt;
&lt;p&gt;That is somewhat funny given that some of these services appeared in the big New Economy bubble some ten years ago. Salesforce.com is just one example, some of the online conferencing providers are as well in the market for years now. But only few of them support at least basic standards like SAML (Security Assertion Markup Language) for Identity Federation. And many still lack the support for such standards, not to talk about more advanced approaches like Information Cards or XACML.&lt;/p&gt;
&lt;p&gt;Beyond the fact of missing support for existing standards, there is the issue of missing standards. There are virtually no standards for GRC, for example for auditing and alerting (and SNMP isn&amp;#8217;t the solution for the cloud). Even XACML is more sort of a technical standard, which needs a lot of additional work to really support the authorization management issues in the cloud.&lt;/p&gt;
&lt;p&gt;There are some additional offerings for example for Single Sign-On to the cloud, there are some identity providers for the very lightweight OpenID and even less for Information Cards, and there are few offerings for Identity Provisioning from the cloud, e.g. managed services for Identity Management. Some of the more interesting vendors in the market are, amongst others, companies like Fischer (Provisioning), Ping Identity (Federation), TriCipher (Authentication), Arcot Systems (Authentication), Multifactor Authentication (again Authentication), and Fun Communications (Information Cards). But the number of offerings is still relatively small.&lt;/p&gt;
&lt;p&gt;On the other hand it is obvious that IAM and GRC will become a very fast growing segment of the IT market, for ISVs as well as for Identity Providers. And it will be as well an interesting opportunity for consultants supporting all the other providers in the cloud in enabling their applications for the IAM and GRC requirements of their customers.&lt;/p&gt;
&lt;p&gt;To become successful as a provider in the cloud, the &amp;#8220;externalization&amp;#8221; of the management of authentication and authorization as well as externalized auditing will become mandatory. Customers can&amp;#8217;t afford to manage authorizations per cloud service but will have to apply pre-defined policies. Thus, we need new standards and we need new semantics for existing standards like XACML on a much higher level than today.&lt;/p&gt;
&lt;p&gt;The entire industry, e.g. cloud providers as well as customers and IAM/GRC vendors have to work together on this. Feel free to send me your ideas and proposals on this &amp;#8211; we&amp;#8217;re currently preparing a launch of a standards initiative on some IAM/GRC issues and that might be the next one.&lt;/p&gt;
&lt;p&gt;More on IAM and GRC for the Cloud at the &lt;a title="European Identity Conference" href="http://www.id-conf.com/eic2009" target="_blank"&gt;European Identity Conference 2009&lt;/a&gt; (Munich, May 5th to 8th).&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/DxscDhML_ok" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 08 Apr 2009 10:23:30 +0200</pubDate>
			<title>The Open Cloud Manifesto</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/04/08/the-open-cloud-manifesto/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/04/08/the-open-cloud-manifesto/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;At March 30th, several vendors, including IBM, Sun, and Cisco, announced an &amp;#8220;&lt;a title="Open Cloud Manifesto" href="http://opencloudmanifesto.org/" target="_blank"&gt;open cloud manifesto&lt;/a&gt;&amp;#8221; which pleads for open standards in the cloud. The &amp;#8220;open cloud&amp;#8221; shall allow choice and flexibility of cloud platforms and cloud providers. A main target is the easy portability of applications. But, if you read that manifesto, you&amp;#8217;ll find the typical sentences about &amp;#8220;openness&amp;#8221;, &amp;#8220;avoiding vendor lock-in&amp;#8221;, &amp;#8220;the need for standards&amp;#8221;, and so on.&lt;/p&gt;
&lt;p&gt;One of the most interesting things with the short and pretty lightweight (to avoid the harsh term of  &amp;#8220;meaningless&amp;#8221;) &amp;#8220;manifesto&amp;#8221; is which vendors are missing in the list of supporters:&lt;/p&gt;
&lt;p&gt;Microsoft, Salesforce.com, Amazon, Google&lt;/p&gt;
&lt;p&gt;With other words: Several big ones don&amp;#8217;t participate in that initiative yet. And most of them have established cloud platforms.&lt;/p&gt;
&lt;p&gt;That doesn&amp;#8217;t mean that the noble intention of the initiators of the Open Cloud Manifesto (which isn&amp;#8217;t that noble given that all of them hope to earn money from the cloud) doesn&amp;#8217;t make sense. Yes, we need standards. Yes, we need portability of applications between cloud platforms. But some nice words doesn&amp;#8217;t solve anything.&lt;/p&gt;
&lt;p&gt;What we really need are standardizations. For the application packaging, for cloud governance, for cloud management and monitoring, and so on&amp;#8230; In some areas we might reuse existing standards like SAML for identity federation, in other areas standards are still missing. Thus, instead of talking about a &amp;#8220;cloudy&amp;#8221; target of an open cloud world, there should be precise actions. And these should take place in the existing standard bodies like OASIS, W3C, and so on.&lt;/p&gt;
&lt;p&gt;Standards are important &amp;#8211; not only to the cloud. At the &lt;a title="European Identity Conference" href="http://www.id-conf.com" target="_blank"&gt;European Identity Conference&lt;/a&gt;, May 5th to 8th in Munich, there will be a OASIS pre-conference workshop &amp;#8211; and there will be a lot of discussion around the Identity and Governance standards which are required for IAM and GRC, as well for internal services as the cloud. Cloud Governance won&amp;#8217;t work without such standards.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/EhQ8Iy-hXPw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 06 Apr 2009 11:48:57 +0200</pubDate>
			<title>The German ePA project – yes we can</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/04/06/the-german-epa-project-yes-we-can/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/04/06/the-german-epa-project-yes-we-can/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;OK, everyone has used that claim &amp;#8220;yes we can&amp;#8221; right now. But it fit&amp;#8217;s pretty well to the German project ePA (Elektronischer Personalausweis) which is one amongst several projects in different European countries for a new type of personal identification card. It&amp;#8217;s not an ePassport but an personal identification card &amp;#8211; you have to have the latter in Germany, you can obtain the first if you require it for international travel.&lt;/p&gt;
&lt;p&gt;In contrast to some other countries like the USA and the United Kingdom, a personal ID card is mandatory in Germany. Currently it is an &amp;#8220;old-school&amp;#8221; type of printed document. The ePA will replace this with an electronic ID card which will be issued by the German state -  using the same deployment mechanism with the so called &amp;#8220;Meldeämter&amp;#8221;, e.g. registration offices (local offices run by cities where every address change and so on has to be registred). Thus there is a personal identification included when requesting and deploying the ID card.&lt;/p&gt;
&lt;p&gt;For a long time I have been a little sceptical regarding German eGovernment initiatives. Many of the didn&amp;#8217;t convince me, either due to their obvious lacks of identity management (like in the area of tax declarations with the ridiculous ELSTER project) or because there was far too much ideology in (Linux vs. Microsoft). But the ePA proves that Germany is able to really run a leading-edge project not only in the manufacturing industry, but as well in eGovernment.&lt;/p&gt;
&lt;p&gt;The ePA supports different use cases, from the identification at border controls, the police, and in other situations up to several public use cases. The interesting point is that these use cases will then be supported by a strong authentication, based on the ePA and readers for that ID card. It will be possible, to give an example, to provide age verification &amp;#8211; while enforcing the concept of &amp;#8220;minimal disclosure&amp;#8221;. For example, the answer might be &amp;#8220;yes&amp;#8221; when asking for age verification above 18 years instead of supplying the full birth date. The ePA will as well provide the capability to store the qualified electronic signature which can be used to sign contracts and official documents as well in the private as governmental use.&lt;/p&gt;
&lt;p&gt;All these features are implemented in a well-thought way, based on distributed stores on the ID card. And they are backed by valid business models as well for providers of digital certificates (qualified electronic signature) as for relying parties, e.g. service providers which plan to support the ePA as a means for strong authentication, age verification, or other purposes.&lt;/p&gt;
&lt;p&gt;For sure there are still some open questions: What about foreigners (there will be interoperability, there will be other solutions)? How long will it take for the critical mass (the old ID card has a validity of ten years thus replacement will take some time)? How about integration with concepts like Information Cards (some companies are working on that)? But despite open questions, the concept of the ePA is a promising one which might as well support eGovernment concepts as the strong authentication for private use cases. I expect that we&amp;#8217;ll see a lot of interesting use cases and applications around ePA soon &amp;#8211; and some things you might learn as well at our &lt;a title="European Identity Conference" href="http://www.id-conf.com" target="_blank"&gt;European Identity Conference 2009&lt;/a&gt; in Munich.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/sM6i0V2b6Dk" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 05 Apr 2009 11:42:42 +0200</pubDate>
			<title>The Digital Knee</title> 
			<link>http://blogs.kuppingercole.com/cole/2009/04/05/the-digital-knee/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2009/04/05/the-digital-knee/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Since &amp;#8220;Minority Report&amp;#8221;, where Tom Cruise toted a squishy bag full of spare eyeballs around to hold up in front of iris scanners, thus fooling the access systems, biometrics has been a buzzword, if only a minor one, but it has failed to catch on in a meaningful way. A few years back I speculated that this is because every existing biometric method has serious &lt;a href="http://www.kuppingercole.com/articles/biometrie_fingerabdruck"&gt;drawbacks&lt;/a&gt;. Fingerprints fade as you grow older, and some people don&amp;#8217;t have any because they are afflicted with a rare disease  called &amp;#8220;Naegeli syndrome&amp;#8221; or &lt;a href="http://en.wikipedia.org/wiki/Dermatopathia_pigmentosa_reticularis"&gt;&lt;em&gt;dermatopathia pigmentosa reticularis&lt;/em&gt;&lt;/a&gt; (DPR) that can cause vexing social problems. Recently, two identical twins were indicted for robbing the department store &lt;a href="http://www.nytimes.com/2009/02/21/world/europe/21germany.html"&gt;KdW in Berlin&lt;/a&gt;, but had to be released when the authorities found that it was impossible to determine which of them had been actually done the heist since they share the same DNA. And many people instinctively refuse to put their eye to an iris scanner because they worry that they may be blinded by a flash of light from a malfunctioning machine.&lt;/p&gt;
&lt;p&gt;&lt;span id="more-28"&gt;&lt;/span&gt;Now, the weekly newsmagazine &lt;em&gt;The Economist&lt;/em&gt; has come up with what may prove to be the perfect biometric identifier: &lt;a href="http://www.economist.com/science/displaystory.cfm?story_id=13403161"&gt;the human knee&lt;/a&gt;. According to the story, &lt;a href="mailto:shamirl@mail.nih.gov"&gt;Lior Shamir&lt;/a&gt;, a geneticist at the National Institutes of Health in Maryland, has developed a knee-analysing mathematical algorithm for medical use. Knees, it seems, are unique in each individual human. By exploring X-ray images of the general structure of various knees and then using their brand-new algorithm to look at them in greater detail, for instance by measuring the texture of the bone through monitoring differences in individual pixels, the researchers found that the best identification was possible by concentrating on a smaller image of the centre of the joint rather than the entire knee. &lt;span class="ver12blkht"&gt;The team also points out that the algorithm can correctly identify a given pair of knees and match it to a specific individual in the database even if the original X-ray were taken several years earlier. &lt;/span&gt;&lt;/p&gt;
&lt;p&gt;According to Mr Shamir, the success rate still needs to be improved. In the &lt;em&gt;International Journal of Biometrics&lt;/em&gt;, his team reports it achieved a correct match 34% of the time. It was also able to pick the ten closest matches to a particular knee 56% of the time &amp;#8211; still far from the degree of accuracy provided by established biometric systems. But as Shamir remarks, it&amp;#8217;s early days yet for the science of knee identity management, and given time (and grant money) they hope to get there.&lt;/p&gt;
&lt;p&gt;Naturally, this raises the question of how to build a viable world-wide identity infrastructure based on knee ID. Rumors have it that Samsung is secretly developing a &amp;#8220;deskbottom&amp;#8221; knee scanner (DKS) which fits comfortably under a table. Portable models can&amp;#8217;t be that far away, and we can easily imagine laptops with built-in knee scanners.&lt;/p&gt;
&lt;p&gt;Of course there are still numerous social issues which need attention. Baring one&amp;#8217;s knees in public is frowned on in some cultures, and it may prove akward in places like airplane seats or boardroom meetings. However, over time we can expect to see a shift in cultural biases, given the obvious advantages of knee-based recognition systems. In the end, the &lt;em&gt;Economist&amp;#8217;s &lt;/em&gt;tongue-in-cheek sum-up may well prove prescient: not the ayes (or eyes), but &amp;#8220;the knees have it&amp;#8221;&amp;#8230;&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/TA3y45Md1Bk" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 04 Apr 2009 10:01:22 +0200</pubDate>
			<title>Is SSO the key to the desktop?</title> 
			<link>http://blogs.kuppingercole.com/cole/2009/04/04/is-sso-the-key-to-the-desktop/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2009/04/04/is-sso-the-key-to-the-desktop/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;&lt;!--[if gte mso 10]&gt;&lt;br /&gt;
&lt;mce:style&gt;&lt;!   /* Style Definitions */  table.MsoNormalTable 	{mso-style-name:"Normale Tabelle"; 	mso-tstyle-rowband-size:0; 	mso-tstyle-colband-size:0; 	mso-style-noshow:yes; 	mso-style-priority:99; 	mso-style-qformat:yes; 	mso-style-parent:""; 	mso-padding-alt:0cm 5.4pt 0cm 5.4pt; 	mso-para-margin-top:0cm; 	mso-para-margin-right:0cm; 	mso-para-margin-bottom:10.0pt; 	mso-para-margin-left:0cm; 	line-height:115%; 	mso-pagination:widow-orphan; 	font-size:11.0pt; 	font-family:"Calibri","sans-serif"; 	mso-ascii-font-family:Calibri; 	mso-ascii-theme-font:minor-latin; 	mso-fareast-font-family:"Times New Roman"; 	mso-fareast-theme-font:minor-fareast; 	mso-hansi-font-family:Calibri; 	mso-hansi-theme-font:minor-latin;} --&gt;&lt;/p&gt;
&lt;p&gt;&lt;span lang="EN-US"&gt;I recently had a cup of coffee with a couple of interesting youngsters from Hamburg, Christian Evers and Philipp Spethmann, who have set themselves a truly impressive goal. They are out to wrest nothing less than the control of German desktops from giants like iGoogle, T-Online, Yahoo! &amp;amp; Co. And they believe the way to do this is by providing consumers a safe and simple way to log onto their favorite websites.&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;&lt;span lang="EN-US"&gt;Their company, founded two years ago with money from Ammer Partners, one of Germany&amp;#8217;s big venture funds (yes, there still are functioning venture funds over here; many of them, in fact), is called &amp;#8220;&lt;/span&gt;&lt;a href="www.allyve.com"&gt;&lt;span lang="EN-US"&gt;allyve&lt;/span&gt;&lt;/a&gt;&lt;span lang="EN-US"&gt;&amp;#8221; (pronounced &amp;#8220;alive&amp;#8221;), and they describe their product as &amp;#8220;the keyring of the Internet.&amp;#8221; What it boils down to is a set of widgets that provide single sign-on &amp;#8211; they prefer the term &amp;#8220;open authentication&amp;#8221; &amp;#8211; to a pre-defined list of favorite online sites. This in not the kind of OA that the OATH initiative is propounding; in fact allyve seems to be intent on doing things their own way instead of following the standards path (open or not). Good luck, I say. &lt;/span&gt;&lt;/p&gt;
&lt;p&gt;&lt;span lang="EN-US"&gt;&lt;span id="more-11"&gt;&lt;/span&gt;However, that is beside the point here. What I found fascinating was Christian and Philipp&amp;#8217;s approach to getting online authentication to market. Instead of trying to convince other vendors to help them spread the good word, they are putting their bucks (or rather, their venture capitalist friend’s bucks) into building up a partner network of big e-commerce companies. And they are actually going on national TV to plug their system &amp;#8211; something not even the behemoths of Identity Management have had the guts to do yet, at least in Germany. (&amp;#8221;Viral will only take you so far&amp;#8221;, Christian says.)&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;&lt;span lang="EN-US"&gt;The partner deals are simple: You let us program a widget that gets your customers online with a single click directly from the allyve website, and we&amp;#8217;ll make sure they keep coming. Oh, and yes, it&amp;#8217;s free! You don&amp;#8217;t have to pay us a cent. We&amp;#8217;ll find another way to refinance ourselves, possibly through ad revenues, possibly by charging some kind of a premium user fee (we&amp;#8217;ll work out the details later; right now all we want is to achieve critical mass as quickly as possible).They also have plans to market a &lt;/span&gt;&lt;span lang="EN-US"&gt;licensed &lt;/span&gt;&lt;span lang="EN-US"&gt;B2B version of their system which will provide single-point authentication within Intranets and extended enterprize networks; Olympus already uses their system to log on 6,000 employees in Europe. However, the B2C space is where they are concentrating their efforts, and the one where they are achieving their greatest success.&lt;br /&gt;
&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;&lt;span lang="EN-US"&gt;That&amp;#8217;s probably why their list of partners is already so impressive. They have gone after the big social communities like Facebook, Myspace and Xing, dating services (parship, firend-scout24), big-name web commerce sites like eBay (they&amp;#8217;ll partner with anyone these days, it seems) and Amazon, and the leading German media companies and newspaper publishers like Axel Springer (&amp;#8221;Bild.de&amp;#8221;) and Spiegel-Online, as well as the leading customer bonus programs (&amp;#8221;Payback&amp;#8221;, &amp;#8220;Happy Digits&amp;#8221;) and the big German airline Lufthansa. These are all high-volume players in their respective fields, and joining allyve doesn&amp;#8217;t cost squat, so hey, why not? &lt;/span&gt;&lt;/p&gt;
&lt;p&gt;&lt;span lang="EN-US"&gt;The result is that Christian and Philipp have more than 85.000 signed-up users, twice the number they had three months ago, and they plan to keep growing by double digits every month for the foreseeable future. They also have plans to grow outside of Germany. One of their first steps was to register patents on their key systems, one for the way that the user&amp;#8217;s personal data is aggregated and the second on their &amp;#8220;deep-link&amp;#8221; technology that takes users straight to the desired content page instead of simply logging them in on the operator&amp;#8217;s homepage. Negotiating the right to do this is the tricky part of each partner deal, but so far none of the big guys seems to be complaining. allyve has even managed to recruit providers like AOL, Yahoo!, 1&amp;amp;1, and Web.de who I would have assumed are competitors. No, says Philipp, they have other things to think about, and if someone wants to bring them oodles of eyeballs, who cares?&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;&lt;span lang="EN-US"&gt;Technically, what allyve is doing may be &amp;#8220;single sign-on lite&amp;#8221; (after all, its simply a bunch of widgets, each one individually programmed to fit the vendor&amp;#8217;s API), but the result is impressive. And these two young kids are way ahead of the pack in terms of market visibility. So maybe they&amp;#8217;re doing something right. Who knows? Time will tell.&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-US"&gt; &lt;/span&gt;&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/t_2FZ7NliNY" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 01 Apr 2009 23:37:00 +0200</pubDate>
			<title>In Praise Of Sabbaticals</title> 
			<link>http://blogs.kuppingercole.com/cole/2009/04/01/in-praise-of-sabbaticals/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2009/04/01/in-praise-of-sabbaticals/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;In early 2008, I asked my colleagues at Kuppinger Cole + Partner for leave of absence in order to take a &amp;#8220;Sabbatical&amp;#8221;, a kind of timeout. No, not because of burnout or anything dramatic like that, but rather because distance tends to sharpen your perspective, and I was worried that I was getting too wound up in the nitty-gritty of Identity Management as a specialized field.&lt;/p&gt;
&lt;p&gt;As a more or less non-technical person, I had begun to believe that the issues addressed by this industry are much wider than many of us seem to realize. And in order to truly appreciate what is going on I felt I needed to take a step back.&lt;/p&gt;
&lt;p&gt;In &amp;#8220;Through the Looking-Glass&amp;#8221;, Lewis Caroll describes a world on the other side of the mirror which closely resembles our own, but is subtly different.&amp;#8221;How would you like to live in Looking-glass House?&amp;#8221;, little Alice asks her kitten. While it appears to look just like the world on this side, &amp;#8220;it may be quite different on beyond&amp;#8221;, she speculates.&lt;/p&gt;
&lt;p&gt;&lt;span id="more-8"&gt;&lt;/span&gt;In fact, as it turns out the world beyond the looking-glass is very like our own, but often slightly different rules apply. In a game of chess, for instance, the king can move as often as he wants &amp;#8211; but people still play chess (in fact, the entire book can be viewed as a complicated chess problem, as Martin Gardner famously proves in his immortal book, &amp;#8220;The Annotated Alice&amp;#8221;).&lt;/p&gt;
&lt;p&gt;I have begun to view the Internet as a kind of world beyond the computer screen; one that, like Caroll&amp;#8217;s Looking-Glass House, is strangely familiar, yet subtly different from ours. And as more and more people start to spend more and more time behind their screens, they become accustomed to how following a slightly different set of rules there.&lt;/p&gt;
&lt;p&gt;One of the biggest differences is that it is much more difficult to prove who you are in the world beyond the screen. And while is exciting and fascinating to don a cloak of invisibility for a while, the anonymity and unaccountability originally associated with cyberspace (the place, as John Peter Barlow famously remarked, &amp;#8220;where we are when we talk on the phone&amp;#8221;) tends to create problems that grow greater the longer we live there.&lt;/p&gt;
&lt;p&gt;As we stare at ourselves in the virtual looking-glass, many of us are beginning to ask the existentialist question: “Who am I when I’m online?” Am I the same person that is sitting in front of the computer typing on the keyboard, or am I someone else? And regardless of the answer: How do I prove I am who I am (or think I am)?&lt;/p&gt;
&lt;p&gt;Simon Clatworthy, professor of Interaction Design at the Oslo School of Architecture and Design (AHO), uses the term “Digital Me” as a way of differentiating between the living, breathing me and the me that spends a significant part of his time accessing digital information, using digital products, communicating through digital media and playing digital games. I agree.&lt;/p&gt;
&lt;p&gt;Consequently, I now strongly believe that it is the job of Identity Management to enable individuals to lead happy and fulfilling lives beyond the computer screen – and not to determine how many angels can dance of the head of the latest IdM product update. Hopefully, my Sabbatical will have made me more aware of the fundamental forces that are shaping the perception of digital identity and the drivers that will determine its future. And yeah, it feels good to be back.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/_aPf90A7lgI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 29 Mar 2009 19:38:45 +0200</pubDate>
			<title>The wild ride that was TEC 2009</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2009/03/29/the-wild-ride-that-was-tec-2009/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2009/03/29/the-wild-ride-that-was-tec-2009/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;I just came back from this year&amp;#8217;s Expert conference, TEC 2009. Last year it was still called the &amp;#8220;Directory Expert&amp;#8217;s Conference&amp;#8221; (DEC). This year the conference has been extended to include training on Microsoft Exchange as well, hence the name change. And of course not to forget that Quest has taken over Netpro &amp;#8211; but has this really changed the scope or focus of TEC? Not at all, as was very immediately visible from the start, with a very funny introductory video. It started off just like a very glitzy marketing presentation that turned quickly into a hyperbole of fuzzy marketing buzzwords and photos of smiling executives. The initial bemusement turned into bewilderment, and quickly I could see some rolling eyes and frowns around me, just when the marketing fuzz stopped right in the middle of it, and into the video stepped the image of Gil Kirkpatrick, DEC&amp;#8217;s founder and Quest&amp;#8217;s Chief Architect who, looking annoyed, asked the marketing voice what all of this was about. Nothing at TEC was going to change from what DEC was &amp;#8211; this was no marketing trade show, but rather a place for people to learn and exchange experience about Microsoft products &amp;#8211; specifically Active Directory and Exchange. The video then stopped to make place for the real Gil Kirkpatrick coming on stage to a big applause and delivering the welcome speech.&lt;/p&gt;
&lt;p&gt;As a sign of the times, the conference was somewhat smaller as last year &amp;#8211; the organisers spoke about a difference of about 30% of attendees compared to last year&amp;#8217;s DEC. When Gil asked the audience who had to jump through extra hoops to get to TEC, several hands flew up. Those who went however, had an excellent, varied and carefully balanced programme waiting for them. As with all conferences, it can sometimes be a challenge picking a presentation to go to from multiple presentations going on at the same time. I was ver pleasantly surprised to see that some key presentations were given more than once so that I could attend them even though I had missed them the day before. Also, presentations were recorded this time and will soon be made available to attendees which especially for me is an additional value.&lt;/p&gt;
&lt;p&gt;The &amp;#8220;day before&amp;#8221; &amp;#8211; i.e. Sunday, several pre-conference workshops had already been given. This was a tough decision for me, as I was torn between going to Laura Hunter&amp;#8217;s workshop on ADFS and Bahram Rushenas&amp;#8217;s workshop on codeless provisioning with ILM 2. I chose ILM and the workshop turned out to be very informative, as it gave me a very good glimpse into codeless provisioning with ILM. I still felt sad to have missed Laura&amp;#8217;s ADFS workshop that has received high praises (which did not surprise me as Laura is an passioned expert on this topic, as well as a gifted speaker). But one can&amp;#8217;t have everything! &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt; &lt;/p&gt;
&lt;p&gt;The second workshop was again on ILM. Dave Lundell, a DEC veteran and one of the most knowledgeable sources on ILM that I have met to date, presented on the topic &amp;#8220;Taming the Chaos – Building a Practical Lifecycle Mgt. Application in the ILM “2” Portal&amp;#8221;. I knew it was going to be good because I already attended (and raved about) his ILM 2 workshop last year at DEC. This one turned out to be a truly wild ride! Dave and his colleague Brad Turner from Ensynch pushed the envelope by demonstrating what I&amp;#8217;ve often heard but never really seen &amp;#8220;in action&amp;#8221;: that ILM 2 is more than just a provisioning tool, but in fact a whole platform that allows all kinds of lifecycle management for enterprise data. He took an excellent example out of the world of enterprise IT: the management of an OID (Object Identifier) management. Enterprises can receive an OID tree within the &amp;#8220;private enterprise&amp;#8221; branch by requesting it from IANA. This OID tree can then be used to number enterprise-specific schema extensions, SNMP objects and other things that need an OID and are used within an enterprise. The OID space should be properly managed in order to give it the correct structure and making sure that no OID is assigned twice. This unfortunately is very rarely done in any enterprise &amp;#8211; perhaps because of its technical nature and because the negative effects are usually not visible immediately when the OID tree space not managed properly &amp;#8211; and there are few who &amp;#8220;do it right&amp;#8221; and properly manage their OID space. Dave and Brad showed how to implement OID management with ILM 2. This was very interesting because it gave us participants a deep dive into the guts of ILM 2, its data structures and workflow possibilities. It also really pushed ILM 2 to its current limits. Ensynch has written several custom workflows and contributed them via the codeflow web site in order to get around some current limitations in ILM 2. Those guys continue to amaze me.&lt;/p&gt;
&lt;p&gt;Of course, the news about Microsoft&amp;#8217;s delaying ILM 2&amp;#8217;s official release for a whole year put a bit of a damper on the party. Disappointment was tangible from customers and vendors alike. I can certainly understand that although ILM 2&amp;#8217;s maturity has evolved since last year, Microsoft wants to play it safe and gain some more experience with deployments, and iron out some kinks that are still present in the current beta version. That however doesn&amp;#8217;t help those partners of Microsoft who have made a significant investment for ILM 2&amp;#8217;s supposed imminent release. Gemalto for example, was poised for a big launch and threw a big party that, well, was still a great party although with excitement rather muted because the cause for the celebration was gone. Attendees were also very disappointed, many of them having come to TEC specifically for the purpose of sharpening their skills in order to prepare for an imminent deployment of ILM 2.&lt;/p&gt;
&lt;p&gt;But back to positive aspects of TEC 2009, which were many &amp;#8211; an you obviously can&amp;#8217;t blame Quest or TEC for Microsoft delaying ILM 2! The first presentation I went to was Brian Puhl presenting on his experience over the last few years rolling out federation agreements. As one can expect from Brian, it was interesting, funny and thoughtful. Of the lot of information provided I especially liked Brian&amp;#8217;s experience with the entirely non-technical problem around creating trust agreements &amp;#8211; and the multiple iterations of procedures that Microsoft went through until they had a model that actually works. In the beginning, there was the list of the &amp;#8220;10 commandments&amp;#8221; &amp;#8211; you shall do this, you may not do that, and you must do it like this, and so on. The resulting list was probably bullet proof from the standpoint of mitigating every conceivable risk, but turned out to be so draconic that nobody, not even Microsoft&amp;#8217;s departments could comply with it. The next iteration was an extensive questionnaire about the state of security and management of identities that a partner had to fill out. The problem there was that many partners certainly did not want to divulge all this information about their internal controls and security subsystems that they thought were confidential. The next iteration then was a definition of a lowest common denominator &amp;#8220;bar&amp;#8221; that a partner had to jump over in order to qualify for federation. Three &amp;#8220;bars&amp;#8221; were defined with diffierent classifications for non-critical, medium-value and high-value and confidentiality content. To qualify, a partner had to vouch that certain criteria were met. Each criteria then had a point score, and the resulting total score would determine which &amp;#8220;bar&amp;#8221; the customer had reached, and hence qualified for within the federation agreement. This turned out to be very workable.&lt;/p&gt;
&lt;p&gt;Another TEC-veteran is Pamela Dingle, formerly of Calgary-based Nulli Secundus Identity Management consultancy. Pamela has just flown the coop and started a company called &amp;#8220;Bonzai Identity&amp;#8221; with the goal to help enterprises get to grips with identity management by carefully nurturing good practises, aligning business processes, making sure that data is correct, and helping organisations make the &amp;#8220;right decisions&amp;#8221; over time. She writes that &amp;#8220;It is like gardening; you will have much better luck making small adjustments throughout the life of your garden than you will allowing a wilderness to grow and then wading in with a machete&amp;#8221;. Her talk at TEC was entitled &amp;#8220;A survivalist&amp;#8217;s guide to identity management&amp;#8221; and focused on the business process shortcomings and warnings signs that can really bog down identity management projects. A great overview and invaluable compilation of experience that can avoid very costly traps and maximise the value of those projects.&lt;/p&gt;
&lt;p&gt;TEC is legendary for bringing out the best of Active Directory experts and get not just best practises from the real pros, but also hard-core technical info that you can&amp;#8217;t find in other places. There is a gang of &amp;#8220;usual suspects&amp;#8221; whose presentation I always try to attend because it doesn&amp;#8217;t get much better than that when you want to learn about Active Directory and dive deep into the technology. Apart from Brian Puhl, who is responsible for running AD in Microsoft&amp;#8217;s IT department, there are Laura Hunter, Joe Kaplan and Dmitri Gavrilov. Interestingly enough, those AD Gurus have become quite turned on by ADFS and federation, and (except for Dmitri) presenting on that topic.&lt;/p&gt;
&lt;p&gt;This has been the first time I&amp;#8217;ve had the honour to speak at this TEC, and even twice! My first presentation was on the subject of authorisation: once you&amp;#8217;ve authenticated the user, then what? How do, can and should applications decide how to allow (authorise) a user to do and see things? It is a subject that I&amp;#8217;ve focused on quite a bit over the last months and something that I am dedicating a whole track to on May 6th at our European Identity Conference in Munich. I couldn&amp;#8217;t help feeling that this particular presentation was a bit of an &amp;#8220;odd one&amp;#8221; at TEC, because I unfortunately could not just yet teach people how to use technology to do it: We are still early in the game because big vendors such as Microsoft and Sun have yet to commit to standards in this area, come up with frameworks and stipulate good practises. It&amp;#8217;s not completely satisfying when at the end of the presentation you have illustrated the problems and pain, but can&amp;#8217;t really point to a solution yet. However I see encouraging signs that vendors are taking this seriously and thinking about ways to tackle these problems. It is not just a lack of technology, but the fact that, well, there certainly is a lack of standardised technology and the current &amp;#8220;best practises&amp;#8221; that encourage application developers to just hardcode security into their applications just exacerbate the problem. I would obviously like to see more interaction between the vendors instead of everybody just thinking within their own box. At our European Identity Conference I am bringing some of the thought leaders, visionaries and experts together and will try to rally them into working together to find solutions together as an industry.&lt;/p&gt;
&lt;p&gt;My second presentation was on the TEC&amp;#8217;s equivalent of a &amp;#8220;Friday afternoon&amp;#8221; &amp;#8211; on the last day of the conference shortly before lunch. I was very excited about the topic because I was presenting about &amp;#8220;Cool LDAP Innovations&amp;#8221;. As TEC is about Active Directory I thought it was important to share a different perspecitve on what is happening outside of AD with other directory servers. Since AD world is essentially closed (you can&amp;#8217;t rip out AD from a windows network) there is no competition in this space, and in my opinion very little innovation. Compared to other directory servers, AD and ADAM has fallen behind in technology, so I felt a bit tongue-in-cheek, talking about some cool stuff that other vendors were doing. The evening before I managed to itercept Nathan Muggli and asked him if he&amp;#8217;d attend, and he kindly did. I finished early and a lively discussion started. After a few minutes I was delighted to see the whole thing starting to look like a BoF session and I decided to sit down in the middle with the other participants and we continued disussing.&lt;/p&gt;
&lt;p&gt;Kevin Kampman from the Burton Group (technically a competitor, but I prefer to see him and his co-workers as distant colleagues) gave a presentation entitled &amp;#8220;the case for identity services&amp;#8221;. Out of the pain points that he highlighted I could identity the same ones I talked about in the &amp;#8220;authorisation&amp;#8221; presentation the day before. It&amp;#8217;s great when a smart experienced guy like Kevin arrive at the same conclusion &amp;#8211; it means that we definitely have a case!&lt;/p&gt;
&lt;p&gt;I&amp;#8217;ve had to scramble after Kevin&amp;#8217;s presentation, grab a quick lunch and then hop into the car to drive back to Los Angeles where I came from this time. I had thought that the drive through the desert would have been more exciting, but I&amp;#8217;ve since been told that for things to get spectacular, Death Valley or Arizona would be the best option (both close, but I didn&amp;#8217;t have time for the detour). Just having gotten back to Europe this morning, I am still thinking back about this intense and englightening experience and am definitely looking forward to the next one!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/CXkAfuDb2QA" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 26 Mar 2009 10:00:03 +0100</pubDate>
			<title>There are many facets of Privileged Account Management</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/03/26/there-are-many-facets-of-privileged-account-management/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/03/26/there-are-many-facets-of-privileged-account-management/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;The PAM/PIM/PUM (Privileged Account/Identity/User Management; I prefer PAM) market is one of the boom markets in IT. I&amp;#8217;ve blogged about that recently (&lt;a title="PAM market" href="http://blogs.kuppingercole.com/kuppinger/2009/03/12/privileged-account-management/" target="_blank"&gt;here&lt;/a&gt; and &lt;a title="Novell enters PAM market" href="http://blogs.kuppingercole.com/kuppinger/2009/02/20/novell-enters-pam-market-the-first-deal-in-the-next-wave-of-acquisitions-in-iam/" target="_blank"&gt;here&lt;/a&gt;). And I&amp;#8217;ve talked with many vendors in that market segment about what they are currently delivering and about what they have in mind for the future. These briefings and the ongoing analysis on PAM proves my thesis that it is still a relatively immature market (not saying that all the products are immature &amp;#8211; there are some really good tools out there&amp;#8230;).&lt;/p&gt;
&lt;p&gt;The PAM market currently is in the typical situation of all emerging markets:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;There are mainly small vendors.&lt;/li&gt;
&lt;li&gt;First large vendors are entering the market, mainly through acquisitions.&lt;/li&gt;
&lt;li&gt;There is no &amp;#8220;standard feature set&amp;#8221; but many different approaches to solve the problems of PAM.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;The latter part is particular interesting to me. Besides the frequently limited support for different platforms and applications as well as for different types of privileged accounts, there are many different technical approaches and features. Some vendors focus on limiting administrative capabilities, other store passwords centrally, some support single sign-on features and so on. Last week I had a briefing with &lt;a title="Cyber-Ark" href="http://www.cyber-ark.com" target="_blank"&gt;Cyber-Ark&lt;/a&gt; which recently announced their PIM Suite v5. Adam Bosnian of Cyber-Ark had a slide in his presentation which showed the evolution from their first solution towards the state of their new suite of PAM solutions. That included aspects like&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Privileged Password Management&lt;/li&gt;
&lt;li&gt;Privileged User Provisioning&lt;/li&gt;
&lt;li&gt;Privileged SSO&lt;/li&gt;
&lt;li&gt;Privileged Session Management&lt;/li&gt;
&lt;li&gt;On-Demand Privileges&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;That list shows that there are many element. When talking with Novell about their Fortefi deal (not really an acquisition, more sort of an asset deal), they also talked about different elements like managing (and limiting) the access as well as auditing privileged access.&lt;/p&gt;
&lt;p&gt;Even while some vendors (like Cyber-Ark) are adding more and more features, there is, from my perspective, still no complete solution which fully addresses every part of the PAM problem. Thus it is important first to analyze the specific requirements before choosing a PAM platform. And: Any selection should keep in mind that privileged accounts are found in every operating system as well as in many applications (including the technical users).&lt;/p&gt;
&lt;p&gt;I&amp;#8217;m convinced that we&amp;#8217;ll observe to things within the next 24 months:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;The PAM tools will converge to a common standard feature set plus some additional capabilities &amp;#8211; like it has happened for example in the are of Client Lifecycle Management some time ago.&lt;/li&gt;
&lt;li&gt;There will be some acquisitions of smaller vendors, mainly by the established players in the IAM market. They will start integrating PAM into their suites.&lt;/li&gt;
&lt;li&gt;There will be, on the other hand, new vendors which become visible &amp;#8211; especially because there are several small vendors out there which have solved that problem for a small number of enterprise customers and specific platforms sometimes years ago. Some of them and probably some start-ups will enter the market.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Don&amp;#8217;t forget to attend my &lt;a title="Kuppinger Cole Webinar" href="http://www.kuppingercole.com/events/n40049" target="_blank"&gt;webinar today&lt;/a&gt; on another hot topic, Cloud Computing.&lt;/p&gt;
&lt;p&gt;And you definitely should attend the &lt;a title="European Identity Conference" href="http://www.kuppingercole.com/events/eic2009" target="_blank"&gt;European Identity Conference&lt;/a&gt;.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/G4i8CG0IjPw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 23 Mar 2009 15:57:19 +0100</pubDate>
			<title>Cloud Computing – just a hype or change of paradigm?</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/03/23/cloud-computing-%e2%80%93-just-a-hype-or-change-of-paradigm/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/03/23/cloud-computing-%e2%80%93-just-a-hype-or-change-of-paradigm/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;In a &lt;a title="Kuppinger Cole Webinar" href="http://www.kuppingercole.com/events/n40049" target="_blank"&gt;webinar&lt;/a&gt; on Thursday I’ll talk about the hype and reality of Cloud Computing. It is interesting to observe that Cloud Computing made it beyond the IT magazines and into the business/economic publications. But the promises you find there (at least in German publications) are probably somewhat overhyped.&lt;/p&gt;
&lt;p&gt;From my perspective, there are some things to note:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Cloud Computing is, in many areas, built on existing approaches – anyhow, there are many new aspects in it&lt;/li&gt;
&lt;li&gt;Cloud Computing will change the IT landscape of organizations fundamentally&lt;/li&gt;
&lt;li&gt;Cloud Computing will provide new business opportunities – some of the promises from the “internet bubble” some 10 years ago will become reality&lt;/li&gt;
&lt;li&gt;Cloud Computing will influence the economics of IT – for vendors, providers, integrators, and customers&lt;/li&gt;
&lt;li&gt;Cloud Computing will take its time to become reality&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;With other words: Yes, Cloud Computing is something that goes well beyond a hype. It is a fundamental shift in IT which can be compared with the introduction of Personal Computers or the Internet becoming a mass market. But it will take some time. Some of the key elements of a successful Cloud Computing infrastructure are still relatively immature. The organizational readiness, application and management platforms, and cloud security, to name just a few, are far from being mature.&lt;/p&gt;
&lt;p&gt;On the other hand there are some obvious advantages and promises that will drive adoption. Reliable, flexible services at a fixed price are attractive. For sure, some vendors and some solutions will disappear. Others will appear. But overall, Cloud Computing as a concept is a must for today’s organization. It has to be evaluated as part of any IT strategy. But Cloud Computing isn’t a no-brainer. A strong strategy and a clear view on threats and opportunities is mandatory to do the (partial) move to the “cloud” successfully. But overall, the approach of Cloud Computing will lead to a situation where we understand IT as set of services which we can “orchestrate” (at a higher level than only within applications) and exchange in a flexible way. And that service view will also heavily affect what we do in internal IT. We will have to clearly describe services, to add a price tag to them and to understand, which services under which considerations can be consumed from the cloud.&lt;/p&gt;
&lt;p&gt;And: Don&amp;#8217;t miss &lt;a title="European Identity Conference" href="http://www.id-conf.com" target="_blank"&gt;EIC 2009&lt;/a&gt;!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/hszPXpYFZRE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 21 Mar 2009 17:54:07 +0100</pubDate>
			<title>Innovations in the world of LDAP</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2009/03/21/innovations-in-the-world-of-ldap/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2009/03/21/innovations-in-the-world-of-ldap/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;I&amp;#8217;ve recently been to Sun&amp;#8217;s directory labs in the the beautiful city of Grenoble, France to talk about what Sun has in store with their two directory servers: DSEE and OpenDS. I&amp;#8217;ve used many predecessors of DSEE (starting with the good old Netscape Directory Server) on several projects over the last decade and used to know it inside out. I&amp;#8217;ve grown quite fond of it, and so has everybody else I know who has used the product. I wasn&amp;#8217;t exactly sure why Sun embarked on its OpenDS project. Why reinvent from scratch what is already a perfectly great product? This question was on my mind, and I was eager to find out why.&lt;/p&gt;
&lt;p&gt;When it comes to directory servers, most analysts like to classify them according to the market segments they address. In no particular order, they are: operating system/network, telco and service provider, enterprise and embedded. When it comes to the operating system/network directory servers, Active Directory rules &amp;#8211; not necessarily because it is the best for this purpose (and just to be clear: it&amp;#8217;s not bad either!), but &amp;#8211; well &amp;#8211; it&amp;#8217;s so intrinsically linked to Windows that you don&amp;#8217;t really have a choice. When Novell Netware was around, NDS and e-Directory was another candidate in that area, but it&amp;#8217;s pretty much down to AD at this point in time. It&amp;#8217;s in the other segments where it gets really interesting because there is some very active development and strong competition.&lt;/p&gt;
&lt;p&gt;The Telco/Service provider directory segment is particularly interesting because only the highest scalable directory servers can even attempt to survive in this area. Sun has been very strong in this area for many years, and for a good reason: experience and continuous improvement. I&amp;#8217;ve been involved first hand in several very large deployments of Sun Directory Server 5.0 (I think it was during the time when Sun called it &amp;#8220;iPlanet Directory Server&amp;#8221;). At that time, in the early years of this millennium, we deployed the server for hosting several hundreds of millions of entries. Yes indeed, about 120 Million entries! This was 2002, and at the time the sheer scale was pushing the envelope quite a bit -  but it didn&amp;#8217;t just work, it actually worked quite well! Performance, Multi-master replication, and resilience were absolutely key for these types of installations. And sure &amp;#8211; in the early versions of 5.0 there were some kinks that had to be ironed out of the replication protocol, but even then it was quite amazing how scalable the directory was, and how well it could actually be managed with such an impressive number of entries. Over the last 7 years, the directory server evolved even further &amp;#8211; multimaster replication is rock solid and Sun has tinkered continously with the software to increase scalability way beyond what was already impressive in 2002. Nowadays, there are quite a few reference customers who run Sun directory server with literally billions of entries (incidentally, many of them in China &amp;#8211; why am I not surprised &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt;  ), and this is considered perfectly normal.&lt;/p&gt;
&lt;p&gt;When it comes to reliability, a key to deploying very large directories is redundancy, and the possibility to balance loads and fail over between multiple instances. In the early days, load balancing appliances were used to do this (Alteon was really good at this in its days), but unless those applicances had specialised proxy features to handle the instrinsics of the LDAP protocol, this by itself wasn&amp;#8217;t a very good option for large deployments. Sun had acquired a company called Innosoft a decade ago, and with it came a product called &amp;#8220;DAR&amp;#8221; &amp;#8211; Directory Access Router &amp;#8211; a fully fledged LDAP proxy. Over the years, Sun has enhanced DAR and bundled its next generation into Directory Server (now known as &amp;#8220;DSEE&amp;#8221;, Directory Server Enterprise Edition&amp;#8221;) at no additional cost. Being an important cornerstone of very large and complex directory deployments, it fits like a glove into the directory service and extends it by offering extensive request routing functionality, high availability and performance features and simple mapping features. Previously, only the CA eTrust directory had these features.&lt;/p&gt;
&lt;p&gt;I can talk all day about deploying telco directory services, because I&amp;#8217;ve used to do it for a living, and am still fascinated by the sheer volume and raw power involved &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt;  But there&amp;#8217;s another two very glorious aspects of directory services, and they can be found in the enterprise and in the still fairly recent embedded directory segment.&lt;/p&gt;
&lt;p&gt;The enterprise directory segment is where most of the innovation is happening. Enterprises are typically not as focused on performance, and often more interested in integration, security and manageability. Integration is a very big topic, because the directory service is a crucial piece in any identity management infrastructure. And we&amp;#8217;re usually not talking about &amp;#8220;a&amp;#8221; directory either &amp;#8211; most enterprises have many different directory servers, containing either different user populations, or part of the same users but for different purposes. It is in the integration area where much innovation has happened in the directory area. Is doesn&amp;#8217;t surprise me that most enterprise directories nowadays feature simple virtual directory functions. That was not the case five years ago, when I worked for a virtual directory vendor. At that time directory service vendors did not foresee virtualisation features as being an important part of their portfolio &amp;#8211; perhaps because some of those vendors were also selling an &amp;#8220;identity manager&amp;#8221; type provisioning system and thought that any directory integration could be solved by deploying a full-blown provisioning system and brute force copying data around &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt;  Well, this wasn&amp;#8217;t really a feasible solution in all cases, so it is only natural that virtual directory companies such as OctetString and Maxware were acquired, and other vendors are &amp;#8220;rolling their own&amp;#8221; virtualisation features.&lt;/p&gt;
&lt;p&gt;Some of the features that are not obvious, but extremely useful in the enterprise scenario are exactly those that allow a directory server to easily interoperate with provisioning, virtualisation and synchronisation products. Technically, the features in LDAP server that are relevant here are persistent queries, incremental updates and proxy auth. These are low-level features that are absolutely crucial when identity &amp;#8220;managers&amp;#8221; and provisioning services interface with directory servers.&lt;/p&gt;
&lt;p&gt;Some other desired features within the enterprise directory segment are about password services and policies. In the vast list of featureds to be found in most modern directory servers are sophisticated access control lists that are expressive enough to configure a finely grained access control policy for deciding who gets access to what type of information. This used to be very important in the past but is getting less important as access control rules on the directory servers tend to be simpler nowadays, because changes typically ocurr through provisioning systems, and not that much any more directly to the LDAP server. Password policies are also a typical feature used in enterprise directory servers (you know &amp;#8211; minimum length, character combination, auto-lockout,auto-expiry, and all those things). And of course, keeping track of when users last logged on &amp;#8211; very helpful in order to identity dormant accounts.&lt;/p&gt;
&lt;p&gt;Another important detail is also how passwords are stored, and how they can be migrated from one server to the other. As a general rule, it&amp;#8217;s always good to offer administrators choice. Obviously passwords need to be well protected. But the approach of some directory vendors (specifically Microsoft and Novell) to &amp;#8220;secure&amp;#8221; their directories has backfired &amp;#8211; the directory servers hoard the passwords and don&amp;#8217;t even offer any possibility for administrators to export encrypted password hashes. You may wonder whether this &amp;#8220;secure&amp;#8221; feature is actually a hidden &amp;#8220;lock-in trap&amp;#8221;! That has created a secondary market around password &amp;#8220;synchronisation solutions&amp;#8221; in order to overcome the deficiency in the product itself, where the product&amp;#8217;s designers thought they had to be smarter than the poor administrators who actually need to deploy, migrate and maintain them.&lt;/p&gt;
&lt;p&gt;Last but not least, let&amp;#8217;s not forget about one of the very important aspects of enterprise directory services. They need to be simple to deploy, administer and maintain! In the telco area it may be considered acceptable if the directory administrator team features several fully trained relational database administrators, but in enterprise environments that can be too much overhead. Directory servers that make use of relational databases for storing their directory data, such as Oracle&amp;#8217;s OID and IBM&amp;#8217;s Tivoli Directory Server can point to the advantages of running a directory services platform on a rock-solid database foundation (in these cases, Oracle and DB2 respectively). But the extra administration overhead can be considerable. CA has traditionally used the Ingres relational database for its eTrust Directory Server, but has now in the latest Version 12 switched to something called &amp;#8220;DXgrid&amp;#8221; &amp;#8211; a revolutionary internal memory-mapped storage that not only offers incredible throughput, but also eliminated a significant portion of administration. Sun has since always used a simpler, but very fast and highly scalable data store for its directory server called BerkeleyDB &amp;#8211; the same used also in most installations of OpenLDAP.&lt;/p&gt;
&lt;p&gt;After mumbling on for quite a discourse I actually wanted to get to the point of Sun&amp;#8217;s OpenDS, and the question that I wrote in the beginning of this entry. Why reinvent from scratch (OpenDS) what is already a perfectly great product (Sun DSEE)? As it turns out, there&amp;#8217;s been a new segment for directory server that is steadily growing: the one of embedded directory services. For example, packaged solutions that require a directory server internally. Or &amp;#8220;black box&amp;#8221; appliances with a provisioning interface that contain &amp;#8211; guess what &amp;#8211; a directory server. A few years back, it was OpenLDAP that was typically shipped with those solutions, because it was free, open and could be embedded easier than other full-fledged directory server products. Now it is OpenDS that is continuously gaining ground, and for good reason. With its incredibly easy set-up, minimal administration, OpenDS epitomises what an embedded directory stands for. And on top of that, the scalability and performance are world-class. Development on OpenDS is, as the name implies, well &amp;#8211; open. The development team features Sun employees and others outside Sun, just like OpenSSO. The release cycle is short and new features list is growing at an incredible rate.&lt;/p&gt;
&lt;p&gt;So will OpenDS one day replace DSEE? Most likely. But this is still far in the future &amp;#8211; for the next few years Sun is actively investing in DSEE as its flagship directory whilst continuing to nurture OpenDS and offering it as an embedded directory server, as well as to anyone interested in quickly deploying a directory server. Now, when I say &amp;#8220;quickly&amp;#8221; &amp;#8211; I&amp;#8217;ve managed to install it, extend the schema and load some data into it in less than fifteen minutes! Now that&amp;#8217;s what I would call &amp;#8220;quickly&amp;#8221;. And once I had it up and running on my slow and overloaded laptop, I ran the &amp;#8220;slamd&amp;#8221; LDAP benchmark tool against it on the same laptop, and got back thousands of searches per second. Not bad at all! Now that&amp;#8217;s what I call innovation in the world of LDAP &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt; &lt;/p&gt;
&lt;p&gt;I&amp;#8217;ll be speaking at TEC on Wednesday the 25th of March, on the topic &amp;#8220;Cool LDAP Innovations&amp;#8221;. OpenDS will definitely get a mention. On the presentation, I&amp;#8217;ll also talk about some other real innovations that happened over the last few years in the directory services area. If you&amp;#8217;re there, be sure to drop by!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/TiSnYucR1YQ" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 20 Mar 2009 00:00:00 +0100</pubDate>
			<title>Wer war Root? Was Sie über Privileged Account Management (PAM) wissen sollten</title> 
			<link>http://www.kuppingercole.com/podcasts/wer_war_root.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/wer_war_root.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/wer_war_root.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/KO6IvWbXOqI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 18 Mar 2009 13:59:51 +0100</pubDate>
			<title>Deep dive into unknown depth (of PKI and HyperV technology)</title> 
			<link>http://blogs.kuppingercole.com/rohr/2009/03/18/deep-dive-into-unknown-depth-of-pki-and-hyperv-technology/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2009/03/18/deep-dive-into-unknown-depth-of-pki-and-hyperv-technology/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Recently, we announced that a report on strong authentication with tokens would be released. The response to that was tremendous - from either side of the market. Some (customer) companies pre-registered to get it, some vendors called back to make sure their products were included, and guess what: NOT all of them were included. This led to two things: me going back to square one and getting briefings with all &amp;#8220;new&amp;#8221; vendors&amp;#8221; and rewriting some portion of the report as well as me tinking: &amp;#8220;if I do not know these vendors try to get into the market - how should the market (aka customers) know?&amp;#8221;. Looks like some vendors did invest a lot in product engineering, such as AXSionics e.g., but a lot of those at the same time did not invest much into developing their go-to market strategies and a marketing plan. There are a number of sayings arounds marketing (such as that 50% of the budget is wasted, one just does not know which half this is) but let me get that straight: a complex service or solution such as strong authentication does not sell by itself. You need to analyse the market, identify your tagert customer base and address these possible customers as directly as possibly. I do not judge print media here, but simply advertising in a trade magazine will hardly work&amp;#8230;&lt;br /&gt;
We as analysts have to serve both sides of the market, thus granting us a very special position that allows us to gain deep insight into customer needs as well as into current market situations. We certainly are no &amp;#8220;know-it-alls&amp;#8221; as the above introduction reflects, but we certainly can add valuable information to either authentication strategies or marketing plans! Ok, enough shameless self-marketing at this point and back to the deep dive:&lt;br /&gt;
I guess one thing that sets KuppingerCole apart from other analysts is the technological background of the analysts. Most of us are or have been IAM practioners before switching to &amp;#8220;critize mode&amp;#8221;. This background makes us TEST what vendors tell us - in my personal situation that means: drowning in cards, tokens, readers and software for strong authentication. I really love this retreat to &amp;#8220;playing&amp;#8221; with technology - at least as long as it works! My test stopped working last week, when I tried to use a Microsoft PKI to issue certificates for my Vista laptop. Little did I know what horrors the switch from XP to Vista on my test client would bring&amp;#8230;&lt;br /&gt;
I used to run a pretty straight forward test environment for certificates, namely a Win2k3 Enterprise Edition server mit Certificate Services. All was well with the usual XP clients and users receiving certificates, using smartcards and tokens of all types to do the SC-login. Well, Vista and W2k3 Certificates Services do not work together that easily, namely some components that allow the certificate enrollment procedures via browser. Ok, testing certificates and cards in a productive environment is not the best idea anyway, so I decided to give Server 2008 a shot, using virtual machines on 2008 HyperV as the basis for my lab. Being a strong user of VMware before, HyperV set some traps for me: storing the virtual machines in a subdirectory of the &amp;#8220;public&amp;#8221; user directory of the system drive was one. Saving the machine state in a similar location AFTER I had re-routed the location of the images to D: drive was even more nuisance. Not being able to &amp;#8220;import&amp;#8221; such an image if it had not been &amp;#8220;exported&amp;#8221; before almost drove me crazy. I ended up with some 100 Gigabytes of mostly useless images and wasted tremendous amounts of time with this&amp;#8230;&lt;br /&gt;
Oh, did I mention networking? Have you ever tried to setup a Win2k8 domain with DHCP in the virtual realm and then have DHCP clients (aka, my Vista laptop) receive their IP info over the physical interface of the host machine? Fun stuff to do - works (sometimes), unless you try to join the domain with this client (networking to/from the virtual realm stopped working after reboot of the newly joined client). A &amp;#8220;restart&amp;#8221; of the network interfaces at the host machine worked, allthough I still do not know why&amp;#8230;&lt;br /&gt;
Anyway, now I am set to create myself multi-tiered (or teared?) PKI environments comprising a W2K8 based PKI, some EJBCA and all the paraphernalia one has to gather&amp;#8230;&lt;br /&gt;
Only thing I miss yet, is a decent Hardware Security Module (HSM) for my EJBCA to recover encryption certificates not created with SC-based key material.&lt;br /&gt;
I certainly grew some extra grey hair with this, but at least I am up-to-date with my PKI infrastructure!&lt;br /&gt;
Looking forward to your responses, inquiries and &amp;#8220;didn´t you know&amp;#8230;&amp;#8221; comments&amp;#8230;&lt;br /&gt;
Sebastian&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/0qah2DaxHQA" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 18 Mar 2009 12:57:38 +0100</pubDate>
			<title>Dynamic authorization management</title> 
			<link>http://blogs.kuppingercole.com/kuppinger/2009/03/18/dynamic-authorization-management/</link> 
			<guid>http://blogs.kuppingercole.com/kuppinger/2009/03/18/dynamic-authorization-management/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/kuppinger"&gt;Martin Kuppinger&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Authorization management is becoming increasingly popular. But there are, in fact, two very different approaches:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Static authorization management, where changes are provisioned to the target systems.&lt;/li&gt;
&lt;li&gt;Dynamic authorization management, where authorization decisions are externalized to authorization engines at runtime.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;The latter require changes to the applications, but they lead to the externalization of authentication and authorization (and hopefully as well auditing) from applications. Everything can be easily managed from outside of the applications.&lt;/p&gt;
&lt;p&gt;Whilst static authorization management is provided by provisioning systems (at the more technical level) and by several GRC vendors (from a business control perspective), vendors of solutions for dynamic authorization management are still relatively rare and, besides this, in most cases relatively small. Besides Oracle with their Entitlements Server and, to some degree, CA with their Embedded Entitlements Manager, vendors include companies like &lt;a title="Bitkoo" href="http://www.bitkoo.com" target="_blank"&gt;Bitkoo&lt;/a&gt; or &lt;a title="Engiweb" href="http://www.engiweb.com" target="_self"&gt;Engiweb&lt;/a&gt;, to name some of the two which are particularly interesting. And, for sure, Microsoft&amp;#8217;s approach for claims leads in that direction &amp;#8211; but at least in the current approach, authorization decisions aren&amp;#8217;t externalized yet.&lt;/p&gt;
&lt;p&gt;From my perspective, externalizing these decisions from applications definitely makes sense. Policies can be managed centrally, changes are effective immediately, and application developers don&amp;#8217;t have to think much about security. They just rely on external decisions. In fact, things are moved from coding not only to deployment, but to runtime.&lt;/p&gt;
&lt;p&gt;There are three challenges:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;The authorization engines have to be fast&lt;/li&gt;
&lt;li&gt;They have to be integratable with other IAM/GRC tools for a consistent management&lt;/li&gt;
&lt;li&gt;The applications have to be adopted to a specific solution&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;The first part is just an architecture and engineering task which has been solved by several vendors. The second requires, from my perspective, standards for the description and exchange of policies which are still widely missing. The third part could also be addressed by standards. That would give customers the choice between different authorization engines. As long as these standards are missing, customers should, with respect to the last bullet point, focus on implementations which require few changes in applications to minimize the risks of vendor lock-in. On the other hand, the advantages of such approaches are significant &amp;#8211; and vendors like Bitkoo and Engiweb are succesful because of that fact.&lt;/p&gt;
&lt;p&gt;From my perspective, companies should start looking at these approaches today and really start externalizing security out of the code.&lt;/p&gt;
&lt;p&gt;By the way: We&amp;#8217;ve given our European Identity Award in the category best innovation in 2008 to some of the vendors mentioned above. Attend &lt;a title="European Identity Conference" href="http://www.id-conf.com" target="_blank"&gt;European Identity Conference 2009&lt;/a&gt; and learn, amongst many other things, who will be awarded as innovator this year.&lt;/p&gt;
&lt;p&gt;The need for standards&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/CrswZWRSNFY" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 11 Mar 2009 00:00:00 +0100</pubDate>
			<title>Getting Attestation Right - Improving Audit Performance, Lowering Costs</title> 
			<link>http://www.kuppingercole.com/podcasts/getting_attestation_right.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/getting_attestation_right.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/getting_attestation_right.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/OiURQW4XkMw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 11 Mar 2009 00:00:00 +0100</pubDate>
			<title>Fraud Prevention and Multi-factor Authentication</title> 
			<link>http://www.kuppingercole.com/podcasts/multi-factor_authentication.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/multi-factor_authentication.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/multi-factor_authentication.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/5h9Jm4XOqjM" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 02 Mar 2009 00:00:00 +0100</pubDate>
			<title>Risk Management Trends</title> 
			<link>http://www.kuppingercole.com/podcasts/risk_management_trends.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/risk_management_trends.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/risk_management_trends.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/-WHl7WSDMkk" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 13 Feb 2009 00:00:00 +0100</pubDate>
			<title>Reducing Compliance Costs through Risk-Based Segregation of Duties Management</title> 
			<link>http://www.kuppingercole.com/podcasts/reducing_compliance_costs.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/reducing_compliance_costs.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar Recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/reducing_compliance_costs.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/MzvJ_PMJV2o" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 13 Feb 2009 00:00:00 +0100</pubDate>
			<title>Zehn Gründe, warum Sie gerade jetzt in IAM und GRC investieren sollten</title> 
			<link>http://www.kuppingercole.com/podcasts/iam_und_grc_investierenwmv.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/iam_und_grc_investierenwmv.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;a href="http://www.kuppingercole.com/events/n40047"&gt;Kuppinger Cole Webinar&lt;/a&gt; recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/iam_und_grc_investierenwmv.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/QQtvLq9gx2Q" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 13 Feb 2009 00:00:00 +0100</pubDate>
			<title>Key Risk Indicators (KRIs) als Frühwarnsystem zur Verringerung operationeller Risiken</title> 
			<link>http://www.kuppingercole.com/podcasts/key_risk_indicators.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/key_risk_indicators.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/key_risk_indicators.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/DCzOqohwCQg" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 30 Jan 2009 00:00:00 +0100</pubDate>
			<title>Cutting Costs through Lean Role Management</title> 
			<link>http://www.kuppingercole.com/podcasts/cutting_costs_through_lean_role_management.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/cutting_costs_through_lean_role_management.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/cutting_costs_through_lean_role_management.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/Plqn4pX2lrM" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 23 Jan 2009 00:00:00 +0100</pubDate>
			<title>Service Oriented Security (SOS)</title> 
			<link>http://www.kuppingercole.com/podcasts/service_oriented_security.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/service_oriented_security.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/service_oriented_security.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/z7yYkYUDD7o" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 20 Jan 2009 00:00:00 +0100</pubDate>
			<title>Entitlement Management - Business and Technical Perspectives</title> 
			<link>http://www.kuppingercole.com/podcasts/entitlement_management_perspectives.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/entitlement_management_perspectives.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Kuppinger Cole Webinar recording&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/entitlement_management_perspectives.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/GRfDCGxt6lc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 20 Dec 2008 00:00:00 +0100</pubDate>
			<title>Reducing Authentication &amp; Authorization Risks in Today's Open Flexible Business Environments</title> 
			<link>http://www.kuppingercole.com/podcasts/reducing_aa_risks.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/reducing_aa_risks.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Kuppinger Cole Webinar recording&lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/reducing_aa_risks.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/djV1toI2Xpc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 20 Dec 2008 00:00:00 +0100</pubDate>
			<title>Trendstudie Rollenmanagement</title> 
			<link>http://www.kuppingercole.com/podcasts/trendstudie_rollenmanagement.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/trendstudie_rollenmanagement.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Kuppinger Cole Webinar recording&lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/trendstudie_rollenmanagement.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/y_y7KQibcTs" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 20 Dec 2008 00:00:00 +0100</pubDate>
			<title>IAM and GRC Market Today and 2009</title> 
			<link>http://www.kuppingercole.com/podcasts/iam_grc_today_2009.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/iam_grc_today_2009.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;What We Have Observed This Year and What We Expect for 2009&lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/iam_grc_today_2009.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/v23c1BgRvgQ" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 19 Dec 2008 14:01:17 +0100</pubDate>
			<title>Meet local - act global: CAST eV on Internet Crime</title> 
			<link>http://blogs.kuppingercole.com/rohr/2008/12/19/meet-local-act-global-cast-ev-on-internet-crime/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2008/12/19/meet-local-act-global-cast-ev-on-internet-crime/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Yesterday I had the pleasure to attend this year´s last CAST workshop in Darmstadt, Germany. CAST,&lt;br /&gt;
Competence Center for Applied Security Technology, is a non-profit organization that provides security information for its members as well as the broader public. CAST is led by representatives of academia (Technical University of Darmstadt) and applied research (Fraunhofer SIT and IGD) as well as corporate and SME members. Yesterdays´ event had &amp;#8220;cybercrime and forensics&amp;#8221; as headlines and the keynote was delivered by the famous president of the Federal Policy of Germany, Joerg Zierke (who attracted quite a number of additional participants, obsviously).&lt;br /&gt;
Zierke talked a lot about why Germany is very special with regard to cybercrime: on the one hand, internet safety and security is quite mature here, compared with the UK, US or other leading countries. On the other hand, criminal activity also is very elaborate and specialized individuals co-operate in ever changing teams - cross-border and and cross-competence. The president brought lots of evidence for his claims, especially regarding trojans &amp;#8220;hand-crafted&amp;#8221; to target German banks, browser data-manipulation and online-fraud in general. While creating giggles and smirks when claiming DDoS attacks were executed with emails (aka using smtp), he showed substantial knowledge of the threats and attacks currently seen. Zierke went on to showcase cases of child-pornography and &amp;#8220;real&amp;#8221; terrorist activity and explained communication schemes of these cells. Impressive, scary and at the same time disturbingly &amp;#8220;close&amp;#8221;&amp;#8230; Anyway, he lost my support (and I guess most of the others as well) when he drew the conclusion that all this could only be tackled, handled and investigated, if the much-discussed BKA-law (comparable to the patriot-act in the US) would be set into place.&lt;br /&gt;
From this rather general talk, the topics went into more and more detail, ranging from judicial analysis of new cyber-laws, a presentation about their use in jurisdiction across business-related fraud detection (impressive presentation by PwC!) up to forensic analysic of digital photography. All in all the event covered a breadth of topics I rarely see anywhere else.&lt;br /&gt;
All that I missed was the INTERnational perspective, hence the topic of my post &lt;img src='http://blogs.kuppingercole.com/rohr/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /&gt; I can only urge lawyers, forensic specialists, cryptanalysts and politicians/judges/law enforcement (LE) to work closer together. Especially expert advice of all of the former groups to the latter three is needed. LE is usually drowning in open cases, judges have no clue what goes on &amp;#8220;in the internets&amp;#8221; and politicians are seldomly aware of what evil might lurk behind that link (or what good can be created through others).&lt;br /&gt;
Experts of all cyber-related technologies are needed as advisors and subject matter experts!&lt;br /&gt;
Do not ask what this community can do for you (e.g. tax-cuts &lt;img src='http://blogs.kuppingercole.com/rohr/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt; ) - ask your judges, police-officers and politicians what you can do for them!&lt;br /&gt;
WARNING: you might end up explaining to your &amp;#8220;senator-of-choice&amp;#8221; how to send email&amp;#8230;lets´ not talk about using S/MIME or PGP here &lt;img src='http://blogs.kuppingercole.com/rohr/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt; &lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/en0-MaoiiBI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 10 Dec 2008 09:50:16 +0100</pubDate>
			<title>The Empire Strikes Back!</title> 
			<link>http://blogs.kuppingercole.com/rohr/2008/12/10/the-empire-strikes-back/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2008/12/10/the-empire-strikes-back/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Well, I thought nothing could puzzle me regarding the IAM market these days - acquisitions, mergers, emerging start-ups.&lt;/p&gt;
&lt;p&gt;This ONE &amp;#8220;acquisition&amp;#8221; really hit me: Dick Hardt joins Microsoft! I almost dropped my morning espresso shot, when I received his (mass-)email&amp;#8230; Once I read through his blog-posts &lt;a title="professional move" href="http://identity20.com" target="_blank"&gt;here&lt;/a&gt; and &lt;a title="personal move" href="http://blame.ca" target="_blank"&gt;here&lt;/a&gt;  though, I fully understand and congratulate both Dick and my former co-workers at Microsoft! It almost makes me wish I was still there ;-) - now with even more big AND versatile brains in Redmond it must feel like the &amp;#8220;in the old days&amp;#8221;&amp;#8230; Nevertheless, I think the (not so evil) empire really was able to &amp;#8220;strike back&amp;#8221;. Hiring Dick shows that Microsoft really wants this IAM thing to work - not only product-wise for the enterprise market, but also for the general population &amp;#8220;BORGrosoft drones&amp;#8221;, which most of us still tend to be&amp;#8230;&lt;/p&gt;
&lt;p&gt;It really makes me book a flight to Seattle next spring to have some good Mac&amp;amp;Jack´s Amber, deep-fried turkey (see Dick´s blog) and most of all: some great discussion on Identity 2.1 , as I would call it from now on!&lt;/p&gt;
&lt;p&gt;Dick &amp;amp; Jennifer: I wish you all the best in and around Redmond, it IS a great place to stay in the US!&lt;/p&gt;
&lt;p&gt;Ray &amp;amp; Kim: nice catch &lt;img src='http://blogs.kuppingercole.com/rohr/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt; &lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/sm35FNxnnfQ" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 09 Dec 2008 13:59:20 +0100</pubDate>
			<title>Role-over</title> 
			<link>http://blogs.kuppingercole.com/rohr/2008/12/09/role-over/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2008/12/09/role-over/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Looks like IAM and GRC is all about roles, doesn´t it? Well, for the sake of simplicity it does. Simplicity you ask, having had trouble defining these in a year-long struggle and ending up with worthless collections of access rights and user profiles due to the latest merger and the finance -crisis consolidation?&lt;/p&gt;
&lt;p&gt;You have pretty good company as many organizations face these problems. A few years back when I worked for CA, a good portion of the IAM projects also included considerable amounts of work to be done on roles. VAAU, at these times the preferred role-mining specialist in the market, helped a lot getting this work done, especially in the early phases of the projects.  As companies are comparable to living organisms, they tend to change over time (sometimes rapdily), thus affecting the roles and profiles user might be mapped to.&lt;/p&gt;
&lt;p&gt;Early role-mining only provided insight to the current situation the snapshot or analysis was made, leading to frustration and incorrect roles once the IAM system was about to be delpoyed. Vendors like former VAAU (now with SUN) and the recently acquired Eurekify (now with CA) learned their lessons, providing consistency checking and automated role-monitoring as new key-features. This evolved the early role-mining tools from providing fuzzy &amp;#8220;best-before&amp;#8221; role data into helpful GRC supporting tools, that constantly check if former analysis is still valid. One example: if members of a certain group of user sharing the same role get the similar exception or add-on to their access rights, Eurekify would suggest to make this exception a part of the role. This helps to manage expceptions before they become a labyrinth while making the life of admins and auditors easier.&lt;/p&gt;
&lt;p&gt;Speaking of &amp;#8220;easier&amp;#8221;&amp;#8230; during my recent briefing with a former Eurekify EMEA VP and now CA employee, the question came up on how CA will leverage the power of Eurekifys tools in their customer base. I was told that both existing IAM customers - regardless of which vendor they chose - will remain to be primary focus of the team, as the above mentioned role-management and role-auditing capabilities are available for all major IAM products in the market. I was pleased to hear that CA will continue to sell Eurekify technology without limitations - and was even more happy to hear that integration will extend the available webservice interfaces. &lt;/p&gt;
&lt;p&gt;Keeping this open mind and easy way to dsicover, integrate and manage will definitly be advantageous to CA partner community, providing audit, role-mining and compliance services with the former Eurekify tools.&lt;br /&gt;
I am looking forward to what happens next regarding the role-management tools and offerings - and also to what and when CA merges the Eurekify capabilities into their GRC and IAM tools!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/ZTyqnFKyllU" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 09 Dec 2008 00:00:00 +0100</pubDate>
			<title>Enterprise Role Management</title> 
			<link>http://www.kuppingercole.com/podcasts/enterprise_role_management.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/enterprise_role_management.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Kuppinger Cole Webinar recording&lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/enterprise_role_management.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/F3rExsYstaw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 19 Nov 2008 00:00:00 +0100</pubDate>
			<title>Regeln für erfolgreiches Rollenmanagement</title> 
			<link>http://www.kuppingercole.com/podcasts/regeln_fuer_erfolgreiches_rollenmanagement.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/regeln_fuer_erfolgreiches_rollenmanagement.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; 10-min&amp;uuml;tige Pr&amp;auml;sentation&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/regeln_fuer_erfolgreiches_rollenmanagement.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/1lI8jPa-9m4" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 19 Nov 2008 00:00:00 +0100</pubDate>
			<title>Integration - die Zukunft des Risikomanagements</title> 
			<link>http://www.kuppingercole.com/podcasts/integration_die_zukunft_des_risikomanagements.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/integration_die_zukunft_des_risikomanagements.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; 9-min&amp;uuml;tige Pr&amp;auml;sentation&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/integration_die_zukunft_des_risikomanagements.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/vEi-qwtHJVA" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 19 Nov 2008 00:00:00 +0100</pubDate>
			<title>Identity Management Roadmap 2009</title> 
			<link>http://www.kuppingercole.com/podcasts/idm_roadmap_2009.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/idm_roadmap_2009.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; 10 minutes audio-enhanced presentation&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/idm_roadmap_2009.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/htFUQi4PHxI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 19 Nov 2008 00:00:00 +0100</pubDate>
			<title>Identity Management and GRC Trends 2009-2019</title> 
			<link>http://www.kuppingercole.com/podcasts/idm_and_grc_trends_2009-2019.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/idm_and_grc_trends_2009-2019.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; 9 minutes audio-enhanced presentation&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/idm_and_grc_trends_2009-2019.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/DwvxIo3U6FA" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 17 Nov 2008 16:02:02 +0100</pubDate>
			<title>Consolidation… as expected</title> 
			<link>http://blogs.kuppingercole.com/rohr/2008/11/17/consolidation-as-expected/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2008/11/17/consolidation-as-expected/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;The recent acquisition of EUREKIFY by CA does not come as a surprise, it was rather expected to happen sooner or later after the OEM/reseller agreement had been published. CA took what was left for grabs after SUN had (more to our surprise) settled an agreement with VAAU, who also had been in close cooperation with CA (and others) before. The consolidation regarding the role mining and role management market is in full progress and it is to be expected that each large IAM player in the market will cooperate if not acquire one of the smaller role specialists left in the field. As from the side of Eurekify, overall good/euphoric feedback on the deal was received. I tried to contact Dave Hansen to get his personal quote on the deal, but yet my sources at CA have not been able to push through to him. I, personally, think that this acquisition is good for CA and will strengthen their position, especially during the presales phase. Role mining and analysis as a service has become more important to assess the IAM-readiness of customers, allthough the value-add derived from an in-depth analysis is far bigger  than just acting as a bait to prospect IAM customers. I expect CA to position and integrate their newest toy as a core component in their GRC/IAM offering, as role modeling, provisioning, audit and the like are interwoven with each other and need to be dealt with in a joint effort.&lt;/p&gt;
&lt;p&gt;Good luck! I am looking forward to a personal dialogue with IAM guys at CA!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/8medV_m3o-0" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 12 Nov 2008 15:30:56 +0100</pubDate>
			<title>More on “Geneva” and the Identity Metasystem</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2008/11/12/more-on-geneva-and-the-identity-metasystem/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2008/11/12/more-on-geneva-and-the-identity-metasystem/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;One and a half weeks ago I was speaking in our Webinar about the Identity Metasystem and Microsoft&amp;#8217;s implementation of it (codename &amp;#8220;Geneva&amp;#8221;). The news was still very fresh &amp;#8211; I had just been to Microsoft&amp;#8217;s Professional Developer&amp;#8217;s Conference and scrambled to get the presentation together. We had almost 100 participants, and many questions were being asked. I slightly overshot the one hour reserved for my Webinar, but even after 70 minutes, the majority of the participants were still online. I then started answering some more questions, but there were still too many of them. If you missed the webinar from last week: &lt;a href="http://www.kuppingercole.com/podcasts/311008-geneva.wmv"&gt;it is available here&lt;/a&gt;.&lt;/p&gt;
&lt;p&gt;Tomorrow, the 13th of November &lt;a href="http://www.kuppingercole.com/events/n40033"&gt;we&amp;#8217;re hosting another webinar on the topic&lt;/a&gt;, at 10 AM PST/1 PM EST/7 PM CET. I will do this one a bit different, and allocate at least half of the time for questions.&lt;/p&gt;
&lt;p&gt;Some of the questions we had last time were:&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;This seems ok for Consumers, is it relevant for large enterprises?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;Absolutely. The Identity Metasystem has several parts, some of them are more relevant for enterprises and other more relevant to consumers. The parts of the Identity Metasystem that are most relevant to enterprises are the whole concepts around claims, trust agreements, secure token services, and of course WS-*. In &amp;#8220;Geneva&amp;#8221;, the components would be the Framework and the Server.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;What about using Claims on non-Microsoft platforms?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;An excellent question, and one that definitely warrants a longer explanation than this one here. I am definitely going to talk about this topic some more tomorrow. Microsoft has now with &amp;#8220;Geneva&amp;#8221; released the first full implementation of the Identity Metasystem. There is no such &lt;em&gt;complete&lt;/em&gt; implementation available for Java or for other non-Microsoft systems, but many parts of it already exist on other systems too.&lt;/p&gt;
&lt;p&gt;Let me step back for a minute and state that the &amp;#8220;Identity Metasystem&amp;#8221; is a &amp;#8220;system of systems&amp;#8221; &amp;#8211; it&amp;#8217;s a methodology, and uses many building blocks, such as SAML security tokens, WS-* and public key infrastructure. Many, if not most of these building blocks already exist on other systems. Major vendors such as Oracle, Sun and others offer interoperability with the Identity Metasystem, and some aspects of a development framework (albeit proprietary at this point) in their access management products.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Would you include &amp;#8220;Geneva&amp;#8221; in an Identity Management architecture today?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;I would most definitely plan for it in an architecture, and &lt;em&gt;especially&lt;/em&gt; make developers aware of the framework. Keep in mind that &amp;#8220;Geneva&amp;#8221; is still in beta, and the final release will only be next year. But that doesn&amp;#8217;t mean that one should hold off including it in the plans, and preparing for it. In fact, for those who really don&amp;#8217;t want to wait, Microsoft has a &amp;#8220;Technology Adoption Program&amp;#8221; that will support users that want to adopt the technology &lt;em&gt;now&lt;/em&gt;. Microsoft&amp;#8217;s &amp;#8220;Geneva&amp;#8221; implementation of the Identity Metasystem is all about manageing Identity in an easier and safer way. That will be important in the long run not just for cost savings, but also as one of the key elements in the transition of IT departments from a cost centre to a strategic asset. Does the last sentence sound like just another pompous example of lofty analyst-speak? &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt;  Think again. The cost of handling identity in today&amp;#8217;s enterprise environments are significant. It reminds me of the mid eighties, when most office software (Wordstar, Lotus 1-2-3, and even Microsoft Word in its first incarnations as a MS-DOS program) were shipped with one or two floppy disks full of printer drivers. That&amp;#8217;s right &amp;#8211; different native printer drivers for each program! How much time was invested by every software vendor to enable the same thing (printing) all over again? How much time was saved when operating systems such as MacOS and Windows (and probably others) implemented a &amp;#8220;printing framework&amp;#8221; that could just be harnessed by whatever programmer wrote applications for that operating system? The identity metasystem is an important piece in the puzzle to make IT easier and more agile. So I couldn&amp;#8217;t think of any reasons not to consider the Identity Metasystem, and &amp;#8220;Geneva&amp;#8221; on a Windows environment). This is all standards-based, interoperable and open!&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;What is the timeline for &amp;#8220;Geneva&amp;#8221;?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;According to Microsoft, the RTM (final release) will be available in second half of 2009.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;What protocols does &amp;#8220;Geneva&amp;#8221; use? WS-Trust and SAML 2.0? If both protocols are possible, is claim transformation between those protocols possible?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;The current beta release of &amp;#8220;Geneva&amp;#8221; supports SAML 2.0, but apparently there are some current limitations in the beta that will soon be overcome &amp;#8211; I need to confirm this but as far as I remember from PDC, it seemed that the current beta of &amp;#8220;Geneva&amp;#8221; Server will work as a SAML 2 IdP (Identity Provider),  but not yet as a SP (Service Provider) &amp;#8211; but again, this is just a temporary limitation in the beta and should be available soon. Claims transformation is one of the key points of &amp;#8220;Geneva&amp;#8221; server, and yes &amp;#8211; the transformation between the protocols is definitely one of the uses foreseen.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;What about compatibility of Zermatt now, and &amp;#8220;Geneva&amp;#8221; framework in the future?&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;A difficult question to answer. Officially, &amp;#8220;Geneva&amp;#8221; framework is still in beta. &amp;#8220;Zermatt&amp;#8221; was release several months ago, so it has even matured a bit before &amp;#8220;Geneva&amp;#8221; was released. This is the first Geneva beta, not yet architecturally or functionally complete, and Microsoft is seeking directional feedback. Microsoft invites developers, architects and other interested parties to learn about the software, experiment in labs, and send feedback. Having said this, from a protocol standpoint there will be compatibility since the protocols are mature. There &lt;em&gt;may&lt;/em&gt; of course be some evolution in the &amp;#8220;Geneva&amp;#8221; framework that may be backward incompatible. My personal guess is that if at all, they&amp;#8217;d be minor. However I think it is likely that the framework will incorporate new functionality. Then again I have no crystal ball, and even if I had, I wouldn&amp;#8217;t know how to use it &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /&gt; &lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/2nc8aLsrNZA" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 12 Nov 2008 02:35:10 +0100</pubDate>
			<title>Ensim: Crusade to Europe</title> 
			<link>http://blogs.kuppingercole.com/rohr/2008/11/12/ensim-crusade-to-europe/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2008/11/12/ensim-crusade-to-europe/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Just a short note after meeting up with some ENSIM representatives (thanks for the opportunity!): after building some reasonable references in the european market and the recent acquisitions in the &amp;#8220;MS infrastructure management market&amp;#8221;, there definitly will be some growth potential for ENSIM in EMEA. Whereever AD and ID management is needed and automation is key, one should check out if the quite modular and customizable set of solutions could make a fit. I´ll look into the technology a bit deeper at the end of the year - so check back for more info and the capabilities of their products.&lt;/p&gt;
&lt;p&gt;Also, I was informed that their local representation in Europe is going to be extended to accomodate the rising number of requests for demos and PoCs. Good for us at KCP to have some techies to talk to in our own time zone &lt;img src='http://blogs.kuppingercole.com/rohr/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt; &lt;/p&gt;
&lt;p&gt;Off to the evening reception at IIW, cu all soon!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/xyhB3UHkZBw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 12 Nov 2008 02:22:16 +0100</pubDate>
			<title>Creating Authentication Strategies</title> 
			<link>http://blogs.kuppingercole.com/rohr/2008/11/12/creating-authentication-strategies/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2008/11/12/creating-authentication-strategies/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Joining a special &amp;#8220;reality&amp;#8221; session was the best choice I made while attending IIW. Not only was this a wonderful opportunity to compare our KuppingerCole approach to providing insight and second opinion on the exact topic, but getting a deeper understanding of how to analyse and structure the whole process from the point of the Identity Architect. Most important was to learn about the projection and &amp;#8220;5 year plan&amp;#8221;, especially regarding assertions, federation and -naturally (for me) smartcards and certificates. Great to learn also, that usage of TPM (Trusted Platform Modules for Trusted Computing) as a secure storage for softtokens and certificates is gaining momentum (years after manufacturers started integrating them int PCs and laptops). I will definitly check back with the &amp;#8220;anonymous&amp;#8221; presenter during the next years to see his strategy evolve, especially as my recent learnings on biometric authentication schemes, SSO and strong auth in general were my pay-back to the architect.&lt;/p&gt;
&lt;p&gt;To my special friends at Infineon: hey, your products are actually in need on this side of the ocean &lt;img src='http://blogs.kuppingercole.com/rohr/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt; and there IS business to be made with TPMs!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/ofFBT1bL3Hw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 12 Nov 2008 02:06:57 +0100</pubDate>
			<title>Meet in real world, connect online - v2.0</title> 
			<link>http://blogs.kuppingercole.com/rohr/2008/11/12/meet-in-real-world-connect-online-v20/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2008/11/12/meet-in-real-world-connect-online-v20/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;One of the fancy things about conferences like IIW is that lots of entrepreneurs and start-up people mingle with each other, which is how came to &amp;#8220;poke around&amp;#8221; a little. POKEN is a cute little way to give the traditional exchange of the business cards and the following procedure of scanning/creating vcards a tad bit easier&amp;#8230;&lt;/p&gt;
&lt;p&gt;Dave Brown of POKEN had a little session on how to facilitate the exchange of contact information without the hassle of activating bluetooth, entering data manually or other hurdles. One can get a small (and cute) token  called poken (USB and wireless, sor of NFC) with an individual ID in it and that &amp;#8220;connect&amp;#8221; to other poken owners just by bringing the two pokens together. Easy as a handshake - especially cute as the pokens look like 4-fingered hands &lt;img src='http://blogs.kuppingercole.com/rohr/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt; &lt;/p&gt;
&lt;p&gt;During this process, the pokens actually handshake and exchange their IDs, which are then stored in the flash part of the device. Once you hook the poken up to your computer, it reads the IDs recently learned and finds the corresponding contact information (in the InfoCard format) online. This InfoCard contains as much information as the related poken owner wants it to contain, enabling one to share a single website, email, phone number or other attribute, or offer full profile information if desired. Fun and useful fact: one can chose between up to three &amp;#8220;profiles&amp;#8221; depending on the context you meet a poken-person in.&lt;/p&gt;
&lt;p&gt;I overheard that the poken could also be put to use as sort of a simple hardware credential, but I will need to investigate further&amp;#8230; Meanwhile, if you are interested, check out &lt;a href="http://www.doyoupoken.com"&gt;www.doyoupoken.com&lt;/a&gt;. You can connect your personal poken to your profile there and start &amp;#8220;pokin´around&amp;#8221;.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/XPcytTxs2jk" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 10 Nov 2008 20:24:45 +0100</pubDate>
			<title>IIW2008b</title> 
			<link>http://blogs.kuppingercole.com/rohr/2008/11/10/iiw2008b/</link> 
			<guid>http://blogs.kuppingercole.com/rohr/2008/11/10/iiw2008b/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/rohr"&gt;Sebastian Rohr&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Howdy?&lt;br /&gt;
I am sitting in the lounge of IIW2008b, or the Internet Identity Workshop, Fall 2008, in the Computer History Museum, Mountain View, CA. Well, I am expecting the start of the event, as it will be kick off at 1 PM&amp;#8230; I am really looking forward to this as I travelled all around California the last two weeks and the impression have been overwhelming so far. According to Dave Kearns, (thanks for a delicious dinner!) it will be quite a nice event!&lt;/p&gt;
&lt;p&gt;Stay tuned for some up-to-date info what´s happening here!&lt;/p&gt;
&lt;p&gt;Sebastian&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/MsoDnuJeU8Y" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 04 Nov 2008 00:00:00 +0100</pubDate>
			<title>Webinar: Microsoft´s new Geneva Claims based Platform</title> 
			<link>http://www.kuppingercole.com/podcasts/311008-geneva.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/311008-geneva.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Recording of a Webinar held by Kuppinger Cole Senior Analyst Felix Gaehtgens on Microsoft&amp;acute;s new Identity Platform &amp;quot;Geneva&amp;quot;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/311008-geneva.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/oYRT4gbynCc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 31 Oct 2008 09:04:41 +0100</pubDate>
			<title>Please join me for my identity metasystem / Geneva Webinar!</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2008/10/31/please-join-me-for-my-identity-metasystem-geneva-webinar/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2008/10/31/please-join-me-for-my-identity-metasystem-geneva-webinar/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;This has been an intense week at PDC 2008 &amp;#8211; the first one ever for me. I&amp;#8217;m sure it won&amp;#8217;t be my last!&lt;/p&gt;
&lt;p&gt;If you&amp;#8217;ve followed our Kuppinger Cole news, you may have seen my article about Microsoft&amp;#8217;s Geneva announcement. I was very excited about this announcement, because of the importance of the identity metasystem for the future. Microsoft clearly putting its money where its mouth is and fully jumping onto the bandwagon of a fully interoperable, open claims-based identity metasystem. This is not just interesting if you run Microsoft software. This has a profound and positive impact on our industry as a whole.&lt;/p&gt;
&lt;p&gt;I am holding a Webinar today (Friday morning in the Americas=afternoon in Europe, Middle East, Africa) to put all of this into what I think is the proper perspective and outlining why I think this is such a big deal, why this is relevent for you and how you can profit from this. You are all cordially invited!&lt;/p&gt;
&lt;p&gt;&lt;a href="http://www.kuppingercole.com/events/n40030"&gt;http://www.kuppingercole.com/events/n40030&lt;/a&gt;&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/UnEIE-1GgQI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 20 Oct 2008 00:00:00 +0200</pubDate>
			<title>GRC Panel: Bridging the gap</title> 
			<link>http://www.kuppingercole.com/podcasts/grc_panel.mp3</link> 
			<guid>http://www.kuppingercole.com/podcasts/grc_panel.mp3</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Join &lt;strong&gt;Martin Kuppinger&lt;/strong&gt;, founder of &lt;em&gt;Kuppinger Cole&lt;/em&gt;, as he discusses the perception and evolution of Enterprise and IT GRC with &lt;strong&gt;Martin Kling&lt;/strong&gt;, Solutions Manager GRC at &lt;em&gt;IDS Scheer&lt;/em&gt;, &lt;strong&gt;Dave...&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/grc_panel.mp3"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/8iN-1At4fbE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 08 Oct 2008 17:08:42 +0200</pubDate>
			<title>It’s the authorisation, stupid!</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2008/10/08/its-the-authorisation-stupid/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2008/10/08/its-the-authorisation-stupid/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;As the US presidential election is in full swing, I thought it would be a great time to dust off &lt;a href="http://en.wikipedia.org/wiki/It%27s_the_economy,_stupid"&gt;Bill Clinton&amp;#8217;s catchy statement from way back when&lt;/a&gt; and seize it for my own agenda. As the industry is increasingly focused on the identity metasystem that will delivering identity to applications, and much attention is given to strong authentication, I believe that authorisation is a very much neglected topic. Very unfortunately so.&lt;/p&gt;
&lt;p&gt;It appears as if many of us have just about accepted the fact that authorisation is the domain of applications. Large enterprise software suites typically implement their own security infrastructure. Some others outsource this to the underlying operating system, most notably Microsoft Windows. We seem to be content to deliver identity data into applications, and letting them take care of deciding who gets access to what. This I find dangerous, and going down a very wrong path in the long run. Let me explain why.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Doing it over and over again&lt;/strong&gt;. Is your organisation building custom apps? Every application developer of a custom-built application has to implement access control and authorisation &lt;em&gt;yet again&lt;/em&gt;. Most developers are really not that savvy or even passionate about security. After all, software development is mostly about finding new ways to do things, not so much about restricting one to do things (unless you&amp;#8217;re writing security software, of course). I find it very scary that in many organisations, access control has been implemented differently many times, by many different teams. How can you be sure that everybody got it right? What&amp;#8217;s the sum of all bugs in all of the authorisation code? How much time and money has been spent reinventing and rewriting the same wheel over and over again?&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;What access management?&lt;/strong&gt; Controlling access is done in very segregated approaches. It&amp;#8217;s not uncommon to find multiple identity &amp;#8220;universes&amp;#8221; next to each other in isolation. We have managed to apply band-aid to the &amp;#8220;identity wound&amp;#8221; of having disconnected pieces of identities in different stores through provisioning systems and virtual directories. But the &amp;#8220;authorisation wound&amp;#8221; is untreated and oozing. Yes, there are a variety of &amp;#8220;access managers&amp;#8221; and &amp;#8220;SOA security&amp;#8221; solutions out there. Do they really solve the problem? No, because usually they are too coarsely grained, and therefore only relieve some of the symptoms of weak application security without really curing the underlying problem.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Sleepless nights at audit time?&lt;/strong&gt; Regulations are getting tougher, and audits are taking much more time and money. Once central security services were in place, their mechanisms would need to be scrutinised just once, and after that it&amp;#8217;s just about auditing their use inside the applications. At this time role management software is touted to be the magic bullet, albeit in the form of another band-aid to the &amp;#8220;authorisation wound&amp;#8221; (as described in the next paragraph).&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Incompatible entitlement systems&lt;/strong&gt;. We are seeing a growth in GRC (Governance, Risk-Management and Compliance) tools that build data warehouses of entitlement information, and then try to make sense of the whole mess. Those entitlements are usually completely different in structure and interpretation, and trying to distill this hodgepodge into higher level business roles is a daunting task that needs continuous readjustments. True, the tools offered by the vendors in this space are getting better and better. But effectively the aim is to bring some order into chaos &amp;#8211; to fight the never-ending battle against entropy. On the other hand &amp;#8211; just think about it &amp;#8211; even if only 50% of the authorisation could be derived from business processes, business roles and other high-level information, that&amp;#8217;s already 50% less entitlements that would need to be managed.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Lack of vision and/or willingness of the industry to cooperate.&lt;/strong&gt; Barring some notable exceptions, the large vendors don&amp;#8217;t have a vision for solving authorisation systematically, or are keeping their cards very close to the chest. Oracle is one of the exceptions here, with a &lt;a href="http://blogs.oracle.com/davidchappell/2008/04/serviceoriented_security.html"&gt;mission statement&lt;/a&gt; that this is important and needs to be solved. Other vendors have ad-hoc solutions for offering fine-grained authorisation for custom applications, mostly in the form of embeddable entitlement &amp;#8220;managers&amp;#8221; or agents. Some are having a field day bashing the XACML standard, and whilst they are right in that it does not solve all problems, it certainly addresses quite a few of them. Hey, SAML does not by itself fully secure your web services, but it certainly does its part in the effort. My word processor does not write my reports by itself, but it certainly helps me getting them done.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Service oriented What?&lt;/strong&gt; In a brave new SOA world, applications are no longer monolithic, but comprised of many services interacting with each other. Identity and access control is an important part of this. Whilst this year has brought us much further in the Identity field with WS-* on the path of becoming mainstream, authorisation is not just a large and ugly pothole on that road, it&amp;#8217;s a crater. Unless the industry comes together to adopt an interoperable, standards-based approach to access control,&lt;/p&gt;
&lt;p&gt;What now? I may be painting a bleak picture, but it&amp;#8217;s not all bad. Several small companies are taking the lead right now to create enterprise-wide access management technology, driven by compliance requirements. Larger vendors are certainly mulling their options. But it&amp;#8217;s the time for us in the industry to get cracking, and come up with the methodologies, standards, services, protocols and APIs to solve this once and for all. Until this is done, IT won&amp;#8217;t really be dynamic, and many SOA benefits will remain elusive to most of us.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/KGVKpNYeoMc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 26 Sep 2008 15:57:16 +0200</pubDate>
			<title>Looking back at DIDW</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2008/09/26/looking-back-at-didw/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2008/09/26/looking-back-at-didw/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Two weeks ago I was at Digital ID World in Anaheim, CA, followed by a briefing in Redmond. My mind is still returning to this action-packed event every once in a while, and I am still trying to make sense of it all. For me the most interesting aspect of DIDW has certainly been to meet face to face with lots of the usual suspects, some people I &amp;#8220;know&amp;#8221; virtually, but have never met face to face, and some new acquaintances. Over the next few week, as my busy research agenda allows, I will write up on some of the cool stuff, new technologies and new evolutions of products that I&amp;#8217;ve learned about during those three days.&lt;/p&gt;
&lt;p&gt;Just thought I&amp;#8217;d just pay tribute to some of my experiences during those three days. For me as well as for many others, DIDW started off with a visit to the new &amp;#8220;IDTBD&amp;#8221; (ID To Be Determined) initiative that the Liberty Alliance sponsored. Bob Blakeley from the Burton group stood in the middle of a fully crowded room (including people standing outside). After a somewhat tedious roll call where everybody present stated why they actually went to this meeting, the discussion came into full swing. The idea behind the &amp;#8220;IDTBD&amp;#8221; was to provide an infrastructure framework for projects around identity. Instead of every project getting tied down with bureaucracies, legal agreements and organisational matters, IDTBD would provide support and let participants focus on what they can do best. I thought the idea was pretty good, but &lt;a href="http://vquill.com/2008/09/yaug-yet-another-umbrella-group.html"&gt;not everybody thought the same&lt;/a&gt;. As organisational matters like these were not my forte, I disappeared after the break, and when I walked past the open door an hour later, I could see that a very small crowd was still in very animated discussion.&lt;/p&gt;
&lt;p&gt;I had my fun with Sun that afternoon, evening and night, and honestly, I had a blast. Sun brought me in twice for their Identity Buzz TV show. Daniel Raskin was my host, and we talked about open source within identity management &amp;#8211; the specific nuances and what customers can expect from it. We also talked about one of my favourite topics, the identity bus (I did a round-table at our European Identity conference back in May), and in that one I managed to turn it around and have Daniel add his thoughts to the discussion (later on that week, I had the pleasure of meeting again with Stuart Kwan who explained me his vision, but more to that later). It was great to meet Daniel, I only had the virtual pleasure up to that point, and can attest that he is at least as cool and knowledgeable in real life as well. I also had some quality time with Pat Patterson, who I&amp;#8217;ve met before, but only shortly between doors, and it was good to catch up. Saachin was there as well and turned on several light bulbs in my head when he talked to me about Sun&amp;#8217;s 3 month roadmap for deploying Role Manager within an enterprise. My head was spinning a bit after so much information, and I was really grateful when Saachin&amp;#8217;s colleague Neil Gandhi patiently spent a good two hours briefing me and walking me through the product in great detail a day later. As &lt;a href="http://blogs.kuppingercole.com/rohr/2007/12/27/wow-for-vaau/"&gt;my colleague Sebastian Rohr&lt;/a&gt; and other noted, Sun certainly made a killing snapping up Vaau earlier this year, and now I can fully appreciate Sebastian&amp;#8217;s enthusiasm.&lt;/p&gt;
&lt;p&gt;John Barco very cunningly demonstrated a concept that is likely to pop up in the same basket as identity theft: identity exchange. &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /&gt;  By wearing Nicholas Crown&amp;#8217;s badge around his neck the next day, he had me confused, because I just met both of them in person for the first time the day before. I had some great discussions with both of them later, especially with Nick, whom I talked after the Ping Identity party until the not-so-wee-anymore hours. Oh yes, the Ping party. Aren&amp;#8217;t they legendary! As this event was held at the &amp;#8220;Blues house&amp;#8221;, the &amp;#8220;house drink&amp;#8221; was a blue liqueur. It did not glow in the dark, but turned out to be somewhat of an acquired taste. Andre Durand&amp;#8217;s team were busy making sure that everyone held at least one cup in their hands at all times. I decided to be careful with it. At the party I made some great acquaintances, and ran into Doug Anter from Covisint. In a very forward-looking spirit that is common after successive libations in the later evening, we decided to set up a &amp;#8220;breakfast briefing&amp;#8221; for 9 AM the next morning. This turned out not to be painful at all (perhaps I can attribute this to my special care with the house drink), but to the contrary highly interesting, as I have an article in preparation on Covisint&amp;#8217;s offerings on &amp;#8220;Identity as a Service (IaaS)&amp;#8221;.&lt;/p&gt;
&lt;p&gt;In the same area, I was equally impressed with a briefing that I received earlier from Eric Olden who is the founder and CEO of Symplified. Having founded Securant in 1995 (which he later sold to RSA), he well understands the need, but also the entry barrier for small and medium enterprises when it comes to identity and access management. Symplified provides identity and access management as a service in both directions &amp;#8211; incoming and outgoing. On the outgoing side, Symplified can connect an enterprise&amp;#8217;s users to internal and external SaaS services (such as Salesforce, Workday, ADP, etc.) with single sign-on. On the incoming side, access to resources is controlled through a proxy layer that is either hosted by Symplified itself, or runs inside an organisation in several form factors: appliance or virtual machine. I think there is a photograph of myself wearing a Symplified T-Shirt towards the end of the Ping party.&lt;/p&gt;
&lt;p&gt;Another very interesting briefing I received was from AEP Networks&amp;#8217; J. Alan Bird who is extending identity throughout the network with identity based access control. Their IDpoint solution tags every network packet (actually, the payload within IP packets) from an authenticated client PC with a special token. Specialised identity routers then act like firewalls by checking access against tokens and making access control decisions. A sophisticated auditing and reporting engine is included that can act as a feed to current GRC (Governance, Risk-Management and Compliance) solutions. As identity management has traditionally focused mainly on application security, I think that this pioneering approach offers a significant manageabilility gain and a previously not well-addressed need for extending GRC towards the network layer. I am convinced that this will become an important topic, especially with investments in strategic GRC projects increasing.&lt;/p&gt;
&lt;p&gt;Oracle was a main sponsor at Digital ID World, and many of its brightest minds were roaming around. I was particularly happy to finally meet face to face with Nishant Kaushik whose blog I read regularly and recommend (it&amp;#8217;s on my blogroll). Same with Clayton Donley, who I&amp;#8217;ve seen already seen previously from far away, but have never had the opportunity to shake hands with. I had a great follow-up discussion with Eric Leach on Oracle&amp;#8217;s new access management suite (he had briefed me on it a month before). And of course Phil Hunt, whose efforts around the Identity Governance Framework &lt;a href="http://blogs.kuppingercole.com/gaehtgens/2008/02/25/why-libertys-identity-governance-framework-is-so-important/"&gt;I wrote about previously&lt;/a&gt;. When I finally got to meet Dennis MacNeil in person, he gave me some good advise and helped me understand better how the individual pieces fit into Oracle&amp;#8217;s strategy.&lt;/p&gt;
&lt;p&gt;Understanding that it is impossible to mention everyone and everything that I met and discovered, it is perhaps worth mentioning what I wish I could have done. The time was limited, and unfortunately the exhibition floor closed very promptly, and I just plainly ran out of time. Matt Flynn was there and I shook his hand but had to run off and couldn&amp;#8217;t catch up with him anymore. He will not escape me next time (or rather, I will not escape him) &lt;img src='http://blogs.kuppingercole.com/gaehtgens/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /&gt;  I also ran out of time and couldn&amp;#8217;t properly catch up with the folks from Optimal IDM anymore, who briefly told me about the new features added to their virtual directory product. Equally with my old colleagues from Symlabs who would have loved to show me the upcoming full virtual tree feature in the next version of their virtual directory. Charles Andres who is now the head of the Information Card Foundation was all over the place but unfortunately so was I (and at the Information Card Foundation&amp;#8217;s booth I ran into Axel Nennker, which was really cool). I did not have time for Sailpoint and Novell unfortunately &amp;#8211; although I did have a brief chat with Dale Olds and some of the other &amp;#8220;Bandits&amp;#8221;, but would have loved to spend more time with his colleagues as well. Next time it will be!&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/XWAGw7FPdzA" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 18 Jul 2008 09:21:49 +0200</pubDate>
			<title>Mini-review of Microsoft “Zermatt”</title> 
			<link>http://blogs.kuppingercole.com/gaehtgens/2008/07/18/mini-review-of-microsoft-zermatt/</link> 
			<guid>http://blogs.kuppingercole.com/gaehtgens/2008/07/18/mini-review-of-microsoft-zermatt/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/gaehtgens"&gt;Felix Gaehtgens&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;I&amp;#8217;ve written a &lt;a title="Microsoft releases new &amp;quot;Zermatt&amp;quot; Identity Developer Framework" href="http://www.kuppingercole.com/topstory/17.07.2008"&gt;short analysis on Microsoft&amp;#8217;s new &amp;#8220;Zermatt&amp;#8221; framework&lt;/a&gt; that can went up on &lt;a title="Kuppinger Cole" href="http://www.kuppingercole.com"&gt;our website&lt;/a&gt; yesterday. For those who have missed the announcement, Zermatt is a new developer framework from Microsoft that makes it easy for developers to work with claims, and is also a foundation for building secure token services (STS). In the analysis, I also included some of my thoughts on the &amp;#8220;claims-based model&amp;#8221; in general, and specifically about the lack of an authorisation model. I think this is perhaps the largest gap currently for applications using WS-Trust, WS-Federation and the claims-based model, exacerbated by the fact that Microsoft currently provides no vision how this will be eventually be addressed.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/csPB_qnQGhI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 07 Jun 2008 10:28:27 +0200</pubDate>
			<title>Yubikey - New Hardware for Strong Authentication</title> 
			<link>http://blogs.kuppingercole.com/resch/2008/06/07/yubikey-new-hardware-for-strong-authentication/</link> 
			<guid>http://blogs.kuppingercole.com/resch/2008/06/07/yubikey-new-hardware-for-strong-authentication/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/resch"&gt;Joerg Resch&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Recently I came across YubiKey, which is a hardware token generator from a young Swedisch comapny called &lt;a href="http://www.yubico.com"&gt;Yubico&lt;/a&gt;. YubiKey is a small and slim USB device with just one button. If you push it, the device produces a 1-time password and sends it to the server. Compared to token generators in card format, you don´t need to manually enter your 1-time password anymore through a computer keyboard, which makes YubiKey unreachable for trojans directly listening to keyboard entries. One more remarkable thing is, that Yubico offer an identity platform for their device, which already contains an OpenID Server.&lt;/p&gt;
&lt;p&gt;If this device holds it´s promise, there should be reason to worry for the other players in the strong authentication market. I wrote a mail to Yubico´s CEO &lt;a href="http://www.yubico.com/about/people/"&gt;Stina Ehrensvärd&lt;/a&gt;, asking for some background and a sample device, and got an answer within minutes. So I´now waiting for the YubiKey and will keep you informed.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/eQ3RByBD_yo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 06 Jun 2008 10:18:34 +0200</pubDate>
			<title>CardSpace “hacked”?</title> 
			<link>http://blogs.kuppingercole.com/resch/2008/06/06/cardspace-hacked/</link> 
			<guid>http://blogs.kuppingercole.com/resch/2008/06/06/cardspace-hacked/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/resch"&gt;Joerg Resch&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;I´m definately amongst the last ones to join the crowd blaming German Universities to lag behind international standards with regards to their educational program, especially in the fields of technology and computer sciences.  But reading &lt;a href="http://demo.nds.rub.de/cardspace/PR-HGI-TR-2008-003-EN.pdf"&gt;this press release&lt;/a&gt;, issued by  the &lt;a href="http://www.nds.rub.de/index_en.html"&gt;Faculty of Network and Data Security at University Bochum&lt;/a&gt; (sorry, the English version of their website seems to not work), makes me think.&lt;/p&gt;
&lt;p&gt;The press release says, that two students of said faculty &amp;#8220;broke&amp;#8221; Microsoft´s CardSpace through some kind of man-in-the-middle-attack, where they took over an existing session between a user authenticated with an InformationCard and Microsoft´s InfoCard sandbox in manipulating a DNS server. Reading through &lt;a href="http://demo.nds.rub.de/cardspace/"&gt;the description of this &amp;#8220;attack&amp;#8221;&lt;/a&gt; shows, that the sophisticated part of their work was to manually change the DNS settings of their client computer in a way, that it resolved webadresses through an internal DNS service within their institute (where they have admin access to) which they had manipulated before in adding a round robin entry for the sandbox server, redirecting every second client request to an evil system, which then stole the session token.&lt;/p&gt;
&lt;p&gt;So, what are the learnings from this intended act of creative distruction? Yes, once again we learn (what we have known for decades now), that without a proper client certificate, man-in-the-middle-attacks are possible, independently from the authentication methods and tools used, and that SSL/TLS provide means to avoid the risk of such attacks, as well independently from the authentication methods and tools in place.&lt;/p&gt;
&lt;p&gt;It is great that University Bochum is teaching their students how these things work and eventually, we may have a generation of well educated IT experts knowing how to make corporate IT infrastructures and the Internet more secure. Maybe, they should add some HTML training courses to their timetable as well. If you look at this &lt;a href="http://www.nds.rub.de/lehre/praktika/hackerprakt/index.html"&gt;description of a &amp;#8220;hacker course&amp;#8221;&lt;/a&gt; that university is offering, some nice error messages coming from malformed HTML are displayed, like this one:&lt;/p&gt;
&lt;p&gt;&lt;span style="color: #ff0000;"&gt;System Message: WARNING/2 (&lt;tt class="docutils"&gt;&amp;lt;string&amp;gt;&lt;/tt&gt;, line 11)&lt;br /&gt;
Block quote ends without a blank line; unexpected unindent.&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;But what is the message behind that press release saying that University Bochum students broke &amp;#8220;Microsoft´s Identity Metasystem CardSpace&amp;#8221;? Just to feed some outdated opinion about Microsoft producing error-prawn and insecure Software? To my opinion, this is not enough for some productive discussion on how to increase security.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/Suw4aett-fY" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 06 Jun 2008 00:18:59 +0200</pubDate>
			<title>Is GRC something different in Europe than it is in the US?</title> 
			<link>http://blogs.kuppingercole.com/resch/2008/06/05/is-grc-something-different-in-europe-than-it-is-in-the-us/</link> 
			<guid>http://blogs.kuppingercole.com/resch/2008/06/05/is-grc-something-different-in-europe-than-it-is-in-the-us/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/resch"&gt;Joerg Resch&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Today &lt;a href="http://sailpoint.libsyn.com/index.php?post_id=346135 "&gt;I listened to a podcast&lt;/a&gt; where Kevin Cunningham and Darran Rolls from &lt;a href="http://www.sailpoint.com/company/management.php"&gt;Sailpoint Software&lt;/a&gt; talk in an interview with Jackie Gilbert about their impressions they brought back home from &lt;a href="http://www.id-conf.com/eic2008"&gt;EIC 2008&lt;/a&gt;. Besides describing EIC as an event not to miss next year (thanks!), they compare the US and European identity management markets and agree that there are more similarities than differences when it comes to GRC. Yes, compliance requirements are increasing everywhere in the world and SOX is not the only framework responsible for this increase.&lt;/p&gt;
&lt;p&gt;I think it was Kevin who mentionned one important difference: Privacy and data protection for employees  seem to be stronger regulated here in Europe than it is in the US. This may be true, although they don´t really play a role in reality, as recent  &lt;a href="http://www.dw-world.de/dw/article/0,2144,3371190,00.html"&gt;espionage cases like the one within Deutsche Telekom&lt;/a&gt; impressively show.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/abvZms-PUCw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Mon, 05 May 2008 00:00:00 +0200</pubDate>
			<title>Round table discussion of the identity bus concept</title> 
			<link>http://www.kuppingercole.com/podcasts/round_table.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/round_table.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; Round Table with Felix Gaehtgens, Dale Olds, Jackson Shaw, Kim Cameron, and Dave Kearns 							at the 2nd European Identity Conference&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/round_table.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/FHzEin5Dwmw" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 04 May 2008 00:00:00 +0200</pubDate>
			<title>Interview with Volker Smid, Novell</title> 
			<link>http://www.kuppingercole.com/podcasts/eic-interview-smid.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/eic-interview-smid.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Felix Gaehtgens interviews Volker Smid, Novell at the 2nd European Identity Conference&lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/eic-interview-smid.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/AzoKY5xNuDY" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 04 May 2008 00:00:00 +0200</pubDate>
			<title>Interview with John Aisien, Oracle</title> 
			<link>http://www.kuppingercole.com/podcasts/eic-interview-aisien.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/eic-interview-aisien.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Martin Kuppinger interviews John Aisien, Oracle during the 2nd European Identity Conference &lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/eic-interview-aisien.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/_7FuJ5zeGZs" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 04 May 2008 00:00:00 +0200</pubDate>
			<title>Interview with Siegfried Schallenmueller, Siemens</title> 
			<link>http://www.kuppingercole.com/podcasts/eic-interview-schallenmueller.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/eic-interview-schallenmueller.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;span id="BeginvidDescVPYkX5JdC8"&gt; 	Felix Gaehtgens interviews Siegfried Schallenmueller, Siemens at the 2nd European Identity Conference&lt;/span&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/eic-interview-schallenmueller.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/EGdXpOejTAo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 04 May 2008 00:00:00 +0200</pubDate>
			<title>Interview with Ariel Gordon, Orange/France Telecom</title> 
			<link>http://www.kuppingercole.com/podcasts/eic-interview-gordon.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/eic-interview-gordon.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Felix Gaehtgens interviews Ariel Gordon, Orange/France Telecom during the 2nd European Identity Conference&lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/eic-interview-gordon.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/L4p8J80nttg" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 04 May 2008 00:00:00 +0200</pubDate>
			<title>Interview with Keith Grayson, SAP</title> 
			<link>http://www.kuppingercole.com/podcasts/eic-interview-grayson.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/eic-interview-grayson.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Felix Gaehtgens interviews Keith Grayson, SAP during the 2nd European Identity Conference&lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/eic-interview-grayson.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/eIrFpiRFpRs" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 04 May 2008 00:00:00 +0200</pubDate>
			<title>Interview with Amit Jasuja, Oracle</title> 
			<link>http://www.kuppingercole.com/podcasts/eic-interview-jasuja.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/eic-interview-jasuja.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Felix Gaehtgens interviews Amit Jasuja, Oracle at the 2nd European Identity Conference&lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/eic-interview-jasuja.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/viFe019GXRQ" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 04 May 2008 00:00:00 +0200</pubDate>
			<title>Interview with Paul Heiden, BHOLD</title> 
			<link>http://www.kuppingercole.com/podcasts/eic-interview-heiden.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/eic-interview-heiden.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Felix Gaehtgens interviews Paul Heiden, BHOLD at the 2nd European Identity Conference &lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/eic-interview-heiden.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/rp-zqjzAqI4" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sun, 04 May 2008 00:00:00 +0200</pubDate>
			<title>Interview with Dave Kearns</title> 
			<link>http://www.kuppingercole.com/podcasts/eic-interview-kearns.avi</link> 
			<guid>http://www.kuppingercole.com/podcasts/eic-interview-kearns.avi</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; &lt;p&gt;Martin Kuppinger interviews Dave Kearns at the 2nd European Identity Conference &lt;/p&gt;&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/eic-interview-kearns.avi"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/fdCFmc90hPc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 29 Feb 2008 14:32:56 +0100</pubDate>
			<title>A German’s Hard Disk Is His Castle</title> 
			<link>http://blogs.kuppingercole.com/cole/2008/02/29/a-german%e2%80%99s-hard-disk-is-his-castle/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2008/02/29/a-german%e2%80%99s-hard-disk-is-his-castle/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Germans became the best-protected users of computers and the Internet today when the Federal Constitutional Court set out strict rules for government agencies anxious to spy on their hard disks. The decision was widely viewed as a slap in the face for Wolfgang Schaeuble, the hard-liner Interior Minster who has been proposing that law enforcement agencies be given broad powers to monitor the computers and e-mails of suspects on their own authority. No, the court said, you have to ask a judge first.  And if during the course of an authorized surveillance the police also happen to stumble across highly personal data, then it is their obligation to erase it “immediately”.&lt;/p&gt;
&lt;p&gt;Surprisingly, German turns out to be a rather imprecise language. Forget their perfectionist image: “unverzueglich”, the word used in the court decision, can also mean “promptly”, “unhesitatingly” or even “instantaneously”, depending on context. So that leaves the cops quite a bit of leeway and doesn’t exactly please the digital rights crowd, either. Still, better than nothing, supporters say. Especially since the court also severely limited the use of one of Schaeuble’s favourite high-tech toys, the so-called “Bundes-Trojaner”, or “federal Trojan”; a piece of software allegedly under development at the BND, the German equivalent of the FBI, and designed to sniff out suspicious correspondence between terrorists. Never mind that nobody seems to have figured out how to sneak the state-sponsored malware past a simple virus detector, much less how to get the bad guys to click on the self-extracting application. And never mind that nobody in the Berlin government seems to have heard of PGP or other easily available encryption tools.&lt;/p&gt;
&lt;p&gt;The historical dimension, if there is one, lies in the high court’s recognition of the individual’s basic right to being able to use a computer without fear of being observed. Collecting data stored or exchanged on a personal computer “directly encroaches on a citizen’s rights”, the judges decreed, given that fear of state-sponsored snooping could prevent “unselfconscious personal communication” which they deem a human right.&lt;/p&gt;
&lt;p&gt;While lawmakers will be able to pass legislation on computer spying as planned, the court has laid down strict ground rules that are intended to limit the number of cases in which it will in fact happen. The greatest hurdle is the requirement of judicial approval in each and every case, with the burden of proof of “clear evidence of a concrete threat to a prominent object of legal protection” (e.g. life, liberty, or property) clearly lying with the authorities.&lt;/p&gt;
&lt;p&gt;Unfortunately, the federal judges did not answer a number of basic questions, such as whether hacking personal data stored on another computer is to be considered a crime. This is especially interesting in view of recent German legislation that compels Internet Service Providers to keep records of all e-mail transactions for at least six months in case the police decide they want to see what a delinquent was doing. And while the judges do recognize the danger stemming from cache storage by programs like web browsers on an individual’s machine, it does not discuss caching by providers or search engine operators. Neither is their any mention of personalized portable devices like PDAs or Smartphones, leaving some confusion as to whether these are also covered by the definition “personal computer”. In fact, the brief specifically singles out PCs “such as those in many homes”, so conceivably it’s okay for the bulls to spy on your Blackberry once you leave the house.&lt;/p&gt;
&lt;p&gt;Foreigners have long struggled with the concepts behind German privacy law which many, especially Americans, find exaggerated and contra productive. If so, they will have to make an extra effort to get their head around the idea that hard disks, like homes, can be castles. But of course, anyone who has ever taken a boat ride down the Rhine is familiar with the German penchant for castle-building, so maybe it shouldn’t really come as a surprise.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/-hofoCm1aFo" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 29 Feb 2008 00:00:00 +0100</pubDate>
			<title>IAM und SOA</title> 
			<link>http://www.kuppingercole.com/podcasts/iam_und_soa.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/iam_und_soa.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; 8 Minutes audio enhanced presentation&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/iam_und_soa.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/51lW7g9Z3kc" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 29 Feb 2008 00:00:00 +0100</pubDate>
			<title>Auswahlkriterien für Provisioning-Produkte</title> 
			<link>http://www.kuppingercole.com/podcasts/auswahlkriterien_provisioning.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/auswahlkriterien_provisioning.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; 7 Minutes audio enhanced presentation&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/auswahlkriterien_provisioning.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/EVAqjYivITM" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Sat, 26 Jan 2008 18:38:35 +0100</pubDate>
			<title>It is not possible, that a single trader like Jerome Kerviel burns 5bn Euro</title> 
			<link>http://blogs.kuppingercole.com/resch/2008/01/26/it-is-not-possible-that-a-single-trader-like-jerome-kerviel-burns-5bn-euro/</link> 
			<guid>http://blogs.kuppingercole.com/resch/2008/01/26/it-is-not-possible-that-a-single-trader-like-jerome-kerviel-burns-5bn-euro/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/resch"&gt;Joerg Resch&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;It is absolutely impossible, that somebody in a position like Jerome Kerviel can hold trading positions for 50 bn Euros and burn 10% of that amount. It is impossible, because&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;banks nowadays would never rely on simple password protection for their trading systems.&lt;/li&gt;
&lt;li&gt;they all have state-of-the-art identity management in place and manage business roles in a way that one single trader could not crash the whole bank&lt;/li&gt;
&lt;li&gt;such big deals would always be routed through acknowledgement processes where duties are segregated&lt;/li&gt;
&lt;li&gt;Strong Authentication techniques and strict authorization would let all employees of a bank feel, that it is impossible to operate with multiple identities falsifying acqunowledgement processes&lt;/li&gt;
&lt;li&gt;risk dashboards would turn red and start screaming long before such a damage occurs&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;And, just to be complete: no, it is not possible to attack PIN/TAN online banking transactions, ATM Cards cannot be falsified and it never rains in Hamburg.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/CYIsGWOWdeQ" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 09 Jan 2008 16:51:48 +0100</pubDate>
			<title>identity theft &amp; offline fraud in banking industry</title> 
			<link>http://blogs.kuppingercole.com/resch/2008/01/09/identity-theft-offline-fraud-in-banking-industry/</link> 
			<guid>http://blogs.kuppingercole.com/resch/2008/01/09/identity-theft-offline-fraud-in-banking-industry/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/resch"&gt;Joerg Resch&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;In a &lt;a href="http://blogs.kuppingercole.de/resch/2007/11/20/uk-public-services-pushing-identity-theft-to-a-new-level/"&gt;recent post&lt;/a&gt;, I  wrote about those 25 Million British people, whose bank information had been &amp;#8220;lost&amp;#8221;. Jeremy Clarkson, a British TV presenter, wrote in his Sun newspaper column, that such a loss is of no value for somebody who may now own this data. To proof this, he published his own Barclays Bank account information. He now had to admit, that somebody exploited this information and transferred 500 GBP from his account to some welfare organization. So he either was lucky or didn´t have more on his account, I suppose.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/cDvjj2naW-A" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Thu, 20 Dec 2007 17:05:01 +0100</pubDate>
			<title>Customer Identities at Vodafone</title> 
			<link>http://blogs.kuppingercole.com/resch/2007/12/20/customer-identities-at-vodafone/</link> 
			<guid>http://blogs.kuppingercole.com/resch/2007/12/20/customer-identities-at-vodafone/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/resch"&gt;Joerg Resch&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Today, I had to put an end to a story lasting for months now, where I tried to change my mobile phone contract I have had at Vodafone since 1996, through cancelling any contract which may exist under my name/my address/my bank account number/my customer number(s).  It all started, when my employer was generous enough to take over my phone contract. Therefore, invoice address and bank account information had to be changed. I wanted to take this occasion and get rid of some add-ons I had been chased to subscribe to through aggressive telemarketing, which I actually never used and did not miss. And I wanted to change from one flatrated type to another one suiting better my phone habits.&lt;/p&gt;
&lt;p&gt;As telcos in general may not be too famous in terms of customer service quality, I did not expect it to be easy.  But what happened was far beyond my imagination:&lt;/p&gt;
&lt;p&gt;The first trial (phone, eMail) did not have any effect.&lt;br /&gt;
After the second trial, my contract had been changed, add-ons were not cancelled, bank account information was not changed, invoice adress was not changed.&lt;/p&gt;
&lt;p&gt;Next attempt: they still cash my bank account with a rising amount of money. But I don´t get any invoices any more. When I phone them, they cannot trace any changes in their CRM database Everything up to now seems to have reached at some wrong place. They then sent me a form by post where I have to apply for bank account and invoice address change. Several days after I did so, I received a written confirmation to my private address, that&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;They do not have a mobile phone contract under my customer number&lt;/li&gt;
&lt;li&gt;I signed the mobile phone contract in August 2003&lt;/li&gt;
&lt;li&gt;My bank information is (private bank account)&lt;/li&gt;
&lt;li&gt;My invoice address is (private address)&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;They enclosed a photocopy of my non-existent contract which they say was dated August 2003, but in fact contains August 1996 as contracting date. This photocopy is the only piece of correct information I received. Which does not help me too much, as I have it myself.&lt;/p&gt;
&lt;p&gt;Today I received a call from a person from Vodafone service or telemarketing (I don´t know, and I don´t care anymore) who tried to explain, why invoices do not reach me anymore. The person phoning me did not know, that bank account information and invoice address had changed or should have been changed. Nor did that person know anything about contract changes. He then said, that he will call Vodafone and ask about the status. Hä?&lt;/p&gt;
&lt;p&gt;I hope for the future of that company, that I am a grand exception.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/fuhhOX7aECI" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 20 Nov 2007 22:39:44 +0100</pubDate>
			<title>UK Public Services Pushing Identity Theft to a new Level</title> 
			<link>http://blogs.kuppingercole.com/resch/2007/11/20/uk-public-services-pushing-identity-theft-to-a-new-level/</link> 
			<guid>http://blogs.kuppingercole.com/resch/2007/11/20/uk-public-services-pushing-identity-theft-to-a-new-level/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/resch"&gt;Joerg Resch&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;According to &lt;a href="http://news.bbc.co.uk/1/hi/uk_politics/7103566.stm"&gt;BBC news&lt;/a&gt;, UK Chancellor Alistair Darling has admitted &amp;#8220;loss&amp;#8221; of 25m records by UK Revenue and Customs. 2 disks containing personal information including names, birth dates, National Insurance Numbers and bank account details of 25 million people, essentially of all families resident in the UK with at least one child under 16. He added, that there has been no evidence that this data has fallen into the hands of bad guys, but adviced those 25 million people to watch their bank accounts.&lt;/p&gt;
&lt;p&gt;Translated from political into real world language, this means that those disks have indeed fallen into wrong hands, and that most probably some identity theft and fraud activity is already going on.&lt;/p&gt;
&lt;p&gt;I don´t know much about how UK public services are dealing with IT governance, with compliance issues and wether they are aware of the risks related with large collections of identity information. But I assume that it is not so different to the situation over here in Germany, where governmental institutions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;are absolutely resistant against any external IT related expert advice&lt;/li&gt;
&lt;li&gt;have little or no internal expertise in that field&lt;/li&gt;
&lt;li&gt;always insist on having access to any kind of data collection, even if it does not make any sense and even if they do not have the manpower to extract identity  information from that data&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Sad enough but true - governments themselves are amongst the biggest threats to modern civilization.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/N7AqA3PVO10" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 14 Nov 2007 13:17:44 +0100</pubDate>
			<title>Talking the talk with IBM’s Tom Noonan</title> 
			<link>http://blogs.kuppingercole.com/cole/2007/11/14/talking-the-talk-with-ibms-tom-noonan/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2007/11/14/talking-the-talk-with-ibms-tom-noonan/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p class="MsoNormal"&gt;&lt;img src="http://www.cole.de/Bilder/tomnoonan_small.jpg" alt="Tom Noonan" align="left" height="239" width="202" /&gt;&lt;span lang="EN-GB"&gt;Tom Noonan of IBM ISS talks a mean speech. Yet somehow I came away slightly unconvinced from a press and analyst briefing he gave on Monday at ISS headquarters in Atlanta. &lt;o:p&gt;&lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-GB"&gt;Maybe one reason was that he hardly used the term “identity” as he described in some detail how he perceives the world of IT security and threat management. Instead he has a lot to say about security becoming a utility, about disconnected parts and the need for a “security ecosystem” where the products of each and every vendor can work together to provide seamless and coherent protection of both data (the “new currency”, he call it) and applications. &lt;o:p&gt;&lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-GB"&gt;&lt;o:p&gt; &lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-GB"&gt;I was very excited about this vision of a kind of “security open platform” which would bring together the currently deeply fractured worlds of logical IT security and Identity Management (along with physical security, just to round things off; after all, the surveillance cameras all speak IP nowadays, so why not integrate them as well?)&lt;o:p&gt;&lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-GB"&gt;A sentence like “Security will be the control system that creates policies across all applications” sounds great, but where’s the beef, Tom?&lt;o:p&gt; &lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-GB"&gt;In fact, as his VP Tim McCormick later explained to me during an interview I did with him (see “&lt;a href="http://www.kuppingercole.de/articles/interview_tim_141107"&gt;In Our Ecosystem, Anyone Can Play&lt;/a&gt;”), the only one’s who will really be able to participate are those that IBM and ISS (still two very different animals, even after a full year of integration) already have existing relationships. Okay, that’s a lot of partners, over 200 at last count. But it is a far step from an industry standard, which is what Tom obviously believes is necessary.&lt;o:p&gt;&lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-GB"&gt;I do too, by the way, so I’m rather concerned that Tom and Tim are not taking the ball as far as they could. Why not assemble an industry-wide gathering of competitors from both IT Sec and IAM, maybe under the auspices of Oasis or some other stands body, and put your chips on the table. Everybody stands to profit from cooperation – because customers will not stand much longer for being forced to deal with a whole host of vendors, each offering some important part of the puzzle, but not the whole picture.&lt;o:p&gt; &lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-GB"&gt;On paper, IBM looks like a pretty likely candidate to lead the way. After all, with the ISS acquisition they are now the market leader in managed security, which is the way to go. And with Tivoli busily buying up companies like Console, Watchfire and the likes, they can play a pretty mean game of business process protection as well as becoming a force to reckon with in the identity &amp;amp; access management space. &lt;o:p&gt;&lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-GB"&gt;Just bringing all that together within the folds of IBM remains a daunting challenge. Taking the concept to its logical end, a security and identity ecosystem that will revolve around the customer and his needs – something where this industry, as Tom Noonan freely admits, has hitherto not really done a very good job – is a different kettle of fish.&lt;o:p&gt;&lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;
&lt;p class="MsoNormal"&gt;&lt;span lang="EN-GB"&gt;Let’s see if, in the end, Tom can do more than just talk the talk.&lt;o:p&gt;&lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/xAqgmpzrUGQ" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 12 Oct 2007 14:08:36 +0200</pubDate>
			<title>Bye Bye CRM</title> 
			<link>http://blogs.kuppingercole.com/resch/2007/10/12/bye-bye-crm/</link> 
			<guid>http://blogs.kuppingercole.com/resch/2007/10/12/bye-bye-crm/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/resch"&gt;Joerg Resch&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;On this year´s &lt;a href="http://conference.digitalidworld.com/2007/"&gt;Digital ID World&lt;/a&gt; in San Francisco, &lt;a href="http://blogs.law.harvard.edu/doc/"&gt;Doc Searls&lt;/a&gt; held a keynote on &lt;a href="http://cyber.law.harvard.edu/projectvrm/Main_Page"&gt;Vendor Relationship Management (VRM)&lt;/a&gt;, a concept he has been contributing to as a Harvard (&lt;a href="http://cyber.law.harvard.edu/home/"&gt;Berkman Center&lt;/a&gt;) fellow. According to Doc, VRM is the inverse of &lt;a href="http://en.wikipedia.org/wiki/Customer_relationship_management"&gt;Customer Relationship Management (CRM)&lt;/a&gt; and provides methods and tools for individuals to deal with customers.&lt;/p&gt;
&lt;p&gt;VRM being still quite early in it´s evolution, definately is extremely interesting, as it is one of the first initiatives to look into what can be done on top of &lt;a href="http://identitygang.org/"&gt;User Centric Identity&lt;/a&gt;, besides decentralized authentication and some kind of Web-SSO. VRM puts customers into the lead position, and thus improves the relationship between demand and supply.&lt;/p&gt;
&lt;p&gt;In the &lt;a href="http://cyber.law.harvard.edu/projectvrm/Mailing_list"&gt;VRM mailing list&lt;/a&gt;, which is very interesting to listen to, there has been some discussion around the question, who actually owns identity related information. I posted the following contribution:&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Information cannot be owned&lt;br /&gt;
&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;I would like to point to the fact that &lt;em&gt;information cannot be owned&lt;/em&gt;, because it is not kind of an object which may be attributed to a subject by law (which itself is information as well). There is a very good publication about the ownership of information from Jean Nicolas Druey: &lt;a href="http://cyber.law.harvard.edu/home/uploads/339/Druey.pdf"&gt;http://cyber.law.harvard.edu/home/uploads/339/Druey.pdf&lt;/a&gt; . &lt;o:p&gt;&lt;/o:p&gt;&lt;/p&gt;
&lt;p&gt;So, talking about the persistence and flow of identity information between parties and through market places, we should not try to think, that we can own that information. If I understand the VRM discussion and the concept of user centric identity right, it is about creating a more balanced position between parties taking part in whatever market place, where some kind of “rules layer” on top of the information layer gives me the power to influence it´s flow. I´m not the owner of my doctor´s diagnosis, even if it concerns me. But I may have some rights influencing the distribution of this diagnosis, because it affects me. We need a home for these rights, instead of trying to own information.&lt;o:p&gt;&lt;/o:p&gt;&lt;/p&gt;
&lt;p&gt;VRM, how I understand it, is about creating kind of a rules metasystem above or beyond the walled gardens we currently have.&lt;o:p&gt;&lt;/o:p&gt;&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/55EpJFekz84" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Fri, 28 Sep 2007 08:32:56 +0200</pubDate>
			<title>A Prescription For A Healthcare Headache</title> 
			<link>http://blogs.kuppingercole.com/cole/2007/09/28/4/</link> 
			<guid>http://blogs.kuppingercole.com/cole/2007/09/28/4/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/cole"&gt;Tim Cole&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Anyone know where the biggest identity project in the world is going on today? Would you believe Germany?&lt;/p&gt;
&lt;p&gt;It&amp;#8217;s true, though. The &amp;#8220;Electronic Healthcard&amp;#8221; or &amp;#8220;elektronische Gesundheitskarte&amp;#8221; (known as the &amp;#8220;eGK&amp;#8221;) will soon be issued to some 80 million citizens, providing them for the first time with a digital identity aimed at reducing healthcare costs and improving the quality of service for patients. It may actually save some lives, too, by giving doctors a way to track patient histories and avoid possible side effects or drug allergies.&lt;/p&gt;
&lt;p&gt;Of course, simply handing out 80 million chip cards isn&amp;#8217;t going to transform the German healthcare system. First, some 120,000 family physicians and specialists, 65,000 dentists, 21,000 apothecaries, 2,200 clinics and 260 health insurance providers need to be hooked up, too. And this is turning out to be an identity management nightmare of truly historic dimensions.&lt;/p&gt;
&lt;p&gt;Scheduled to go online in 2006, the project has been held up by bureaucratic hassles and technical glitches. The next round of tests are now set to begin sometime in 2008, roughly two years behind schedule. And it&amp;#8217;s anybody&amp;#8217;s guess when  the system will really be up and running.&lt;/p&gt;
&lt;p&gt;Even then, hopes are low that the initial goal of lowering the costs for Germany&amp;#8217;s compulsive healthcare program will materialize. Experts agree that things like digital patient records and telemedicine can streamline the clunky system now in place. Unfortunately, that isn&amp;#8217;t going to happen anytime soon.&lt;/p&gt;
&lt;p&gt;Instead, government has chosen prescribe only the first step of the project which will focus only on the administrative side and designed to reduce paperwork. Okay, better than nothing, proponents say. But this could have been achieved by pimping the current system of insurance cards (&amp;#8221;Versichertenkarte&amp;#8221;) which already have chips baked into them but lack a photo of the patient. This, along with the fact that there is no way to quickly crosscheck to see if the patient is already being treated somewhere else, is an invitation to insurance fraud. &amp;#8220;We get whole families of Turkish guest workers coming in and using mommy&amp;#8217;s card to get free treatment&amp;#8221;, a doctor recently told me.&lt;/p&gt;
&lt;p&gt;All the goodies that might really make a difference in healthcare costs have been classified as &amp;#8220;voluntary&amp;#8221;. In the case of Germany&amp;#8217;s cash-strapped clinics, many of which are tottering on the brink of bankruptcy, this probably means never. So much for telemedicine and the future hospital.&lt;/p&gt;
&lt;p&gt;Identity management vendors face an uphill fight in pursuading German healtcare officials and clinic IT admins to invest in hot new technology. Especially so since in typical German fashion the so-called &amp;#8220;service providers&amp;#8221; (read: insurance companies) and the German government have formed a bureaucratic monster called &amp;#8220;Gematik&amp;#8221;, a joint venture charged with developing the infrastructure framework and setting the standards for things like card readers and network interfaces.&lt;/p&gt;
&lt;p&gt;Since most IdM vendors are from the U.S., they of course don&amp;#8217;t have a say in the internal deliberations of Gematik and the German government. Instead, they are currently attempting to pursuade individual public and university hosptials and private clincs to buy their products. Good luck, I say! Since Gematik takes it&amp;#8217;s cues from the Delphic oracle, no purchaser or decision maker in his or her right mind will go out on a limb today and sign a check, since they may have to mothball the system in a year or two when Gematik finally draws back the curtain and reveal &amp;#8211; surprise, surprise! &amp;#8211; something completely different than expected.&lt;/p&gt;
&lt;p&gt;Safe to say, therefore, that Germany&amp;#8217;s eGK is not only the biggest identity project in the world, but one of the most enigmatic, too. Many clinic operators will use this as an excuse to keep their heads down and wait for Gematik to get its act together. Smart operators should focus on things like standardizing their systems, beefing up their infrastructure and doing identity data housecleaning, all of which will pay off some day no matter what technical framework Gematik finally comes up with.&lt;/p&gt;
&lt;p&gt;IdM Vendors should up the pressure on Gematik to force them to provide a better glimpse of the direction they are thinking in, while touting schemes like identity federation based on open international standards as an alternative to a  national German solo effort. They might also casually suggest that the German penchant for cramming everything they can possibly dream of into a single bloated solution may not be the best way to solve the cost crisis in healthcare. They might want to use a quaint German expression to describe the worst-case end result: It&amp;#8217;s called &amp;#8220;eierlegende Wollmilchsau&amp;#8221; &amp;#8211; an egg-laying, wool-growing, milk-giving pig.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/_nK7if3742s" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Wed, 26 Sep 2007 21:18:00 +0200</pubDate>
			<title>Orange / France Telecom release OpenID Service</title> 
			<link>http://blogs.kuppingercole.com/resch/2007/09/26/orange-france-telekom-release-openid-service/</link> 
			<guid>http://blogs.kuppingercole.com/resch/2007/09/26/orange-france-telekom-release-openid-service/</guid> 
			<description>In &lt;a href="http://blogs.kuppingercole.com/resch"&gt;Joerg Resch&lt;/a&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;Ariel Gordon and Aude Pichelin from &lt;a href="http://www.francetelecom.com"&gt;France Telecom&lt;/a&gt; (FT) yesterday announced at the &lt;a href="http://conference.digitalidworld.com/2007/"&gt;6th Digital ID World&lt;/a&gt; in San Francisco release of an OpenID service to their 40 million subscribers. Congratulations to the OpenID community for this big success. It is not surprising that it is FT with it´s Orange brand being the first company running an internet scale OpenID service. On the one hand, it´s a smart company. They strongly contributed to the emergence of the SAML standard and pushed IBM into the Liberty Alliance some 3 years ago. On the other hand, if there is any industry which can make a business out of running OpenID services, it´s the telcos, because they are wired right through to our purses.&lt;/p&gt;
&lt;p&gt;But OpenID was only a smaller part of FT´s advanced identity management strategy, which consumed less than 3% of their total project budget and therefore shouldn´t have been too difficult to give it a go. The rest of the budget went into something I would call the foundation of the future (post-UMTS) telco business modell, converging management of identities for voice and non-voice services through wireline and wireless and using the SAML v2 standard to open up the whole infrastructure for plug &amp;amp; play style partnership business.&lt;/p&gt;
&lt;p&gt;Telcos on their own haven´t been too good in creating services needed or otherwise attractive enough to be broadly used, since they invented SMS. So they need partners taking care for this in order to survive.&lt;/p&gt;
&lt;p&gt;Being more and more reduced to an IP tunnel provider, telcos at least should try to make the most out of it in offering a powerful  infrastructure for mobile and wireline services. FT have done their homework in an obviously excellent way, clearly focussing on the improvement of the user experience through simplifying sign-on within their SAML based converged infrastructure. They pull authentication  information from the DSL and appliance level, add available user  information and use these to provide reliable identities even without forcing them through login and account creation processes.&lt;/p&gt;
&lt;p&gt;Ariel described, that during downtimes of their identity system with users being forced to sign on manually, online service sales drop by 50%. Even if this does not necessarily mean, that they have doubled sales, because part of those 50% would just return after the service is back up, there seems to be space for a pretty quick return on investment and revenue growth.&lt;/p&gt;
&lt;p&gt;I have invited Aude, Ariel and Hervé, the latter on being technically responsible, to come to Munich for next years &lt;a href="http://www.id-conf.com/"&gt;European Identity Conference&lt;/a&gt; and talk about latest developments.&lt;/p&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/FVS7YlE1rgM" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 03 Jul 2007 00:00:00 +0200</pubDate>
			<title>Enterprise Single Sign-on Strategies &amp; Trends</title> 
			<link>http://www.kuppingercole.com/podcasts/e-sso-7-minutes.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/e-sso-7-minutes.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; 7 Minutes audio enhanced presentation on E-SSO Strategies &amp;amp; Trends&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/e-sso-7-minutes.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/1amYJrZAFNE" height="1" width="1"/&gt;</description>
		</item>
				<item> 
			<pubDate>Tue, 03 Jul 2007 00:00:00 +0200</pubDate>
			<title>Enterprise Identity Management Strategies &amp; Trends</title> 
			<link>http://www.kuppingercole.com/podcasts/e-iam-7-minutes.wmv</link> 
			<guid>http://www.kuppingercole.com/podcasts/e-iam-7-minutes.wmv</guid> 
			<description>In &lt;a href="http://www.kuppingercole.com/podcasts"&gt;Kuppinger Cole Podcasts&lt;/a&gt;&lt;br&gt;&lt;br&gt; 7 Minutes audio enhanced presentation on Enterprise Identity Management strategies &amp;amp; trends&lt;br/&gt;&lt;a href="http://www.kuppingercole.com/podcasts/e-iam-7-minutes.wmv"&gt;Download&lt;/a&gt;&lt;img src="http://feeds.feedburner.com/~r/kuppingercole/~4/H18KmcjWQD8" height="1" width="1"/&gt;</description>
		</item>
			</channel>
</rss>
