Oracle launches identity governance project
85767
(InfoWorld) - Oracle on Wednesday announced a new project to tackle one of the thorniest problems facing enterprises: the proliferation of sensitive identity information across enterprise networks. The Identity Governance Framework is an initiative to develop specifications for sharing identity data across heterogeneous applications. The project has the support of identity and access management (IAM) vendors Ping Identity, Sun Microsystems and Securent, as well as CA and Novell. The framework and will eventually be turned over to a standards-setting body, according to Amit Jasuja, vice president of product development for Oracle's security and identity management products. The Identity Governance Framework (IGF) grew out of Oracle's efforts to integrate identity and access management technology it acquired from Thor Technologies, OctetString and other companies, Jasuja said. "We realized that a solution that just works with the Oracle stack is not what customers need," he said. Instead, problems such as lost data on laptops and identity theft point to the need for overarching standards that govern all the sensitive data squirreled away in data repositories across an enterprise, such as human resources, customer relationship management and custom-built internal applications. Oracle estimates that between 60 and 80 percent of sensitive data reside in these kinds of repositories, rather than in better protected enterprise databases, he said. "Finding out where all that information is turns out to be a huge forensic exercise," Jasuja said. "You have to root through every application repository and application logic and code to figure out how the [sensitive data] is being used." IGF addresses that problem by establishing a governance model that allows organizations to create "contracts" between applications and repositories of identity data. The model would cover how data flows within an enterprise and outside the enterprise to supply chain or business partners, he said. IGF has the following four components: -- CARML, the Client Attribute Requirement Markup Language, is an XML-based language used by application developers to define contracts that specify how applications can use certain kinds of data. -- CARML API is an Application Programming Interface that application developers can use to consume identity data in a way that conforms to the policies that govern that data. -- AAPML or Attribute Authority Policy Markup Language, defines policy rules regarding the use of identity-related information from an identity source. -- Identity Service is a service for securely accessing identity data from multiple identity sources based on established policies.Â  Open source and standards groups, including Eclipse.org and OASIS, are also working on the problem of federating identity information, but OASIS' SPML (Service Provisioning Markup Language) and Eclipse's Higgins Trust Framework are more about creating consistent user identities that work between systems, rather than managing sensitive data, he said. "Nobody's asking whether I can propagate a social security number outside my country boundary and put it into system somewhere else," he said. Still, Oracle believes that IGF properly belongs under the umbrella of some standards setting organization, he said. The company plans to reach a deal to hand off its API, as well as AAPML and CARML work to such a group within the next 90 days or so. While Jasuja wouldn't say which group Oracle was considering. However, he acknowledged that a top concern is the speed with which the group can shepherd the IGF specifications through to standards. Both OASIS and Eclipse are possible partners for IGF. Notoriously slow IEEE is not high on the list of groups that might take over Oracle's work, he said. "Our goal is to take this into a standards organization as quickly as possible to get the (intellectual property) stuff figured out, and not sit around and waste a lot of time and energy," he said.
432783
Hewlett-Packard has launched the FOSSology Project, a tool for tracking and monitoring the use of free and open-source software within an IT environment.
363836
Oracle has revealed the identities of the four people it will nominate to the board of PeopleSoft as it pushes ahead with its efforts to take control of the company.
687492
SAN FRANCISCO -- Data integration will be one of the major themes at Oracle's OpenWorld conference this week.Â
663379
A Windows version of Oracle's flagship database, plus administrative tools, joins the Linux edition.
467586
IBM on Thursday said it has joined the Liberty Alliance, indicating that industry support is shifting toward the identity-management group&#39;s standard for using a single ID and password to access Web services across organizations.
7619
IBM, Google, Microsoft, Verisign and Yahoo have joined the corporate board of the OpenID Foundation, giving a boost to the groupâs efforts to simplify the process of signing into Web sites.
667187
Big companies exploring ways to verify identities online
654037
Oracle has launched a new set of business intelligence (BI) tools for its grid-enabled database technology. The BI 10g product has been separated out of Oracle&#39;s existing application server software.
562711
While most of Oracle's recent purchases have focused on growing its applications business, the vendor's latest proposed purchase will beef up its growing identity management operation.
134607
InfoWorld - Oracle is making a number of moves to improve access management and other security features for its users.
739519
IBM's global services organization is adding "health check" services to its repertoire of technical services for SOA deployments, looking to assist users dealing with issues resulting from poor planning or partnerships with inexperienced or so-called proprietary IT vendors.The company also is offering its "identity-aware ESB," which is an enterprise service bus that combines existing IBM products to provide identity management capabilities.Health-check services and software will be offered in two workshops to be held at customer sites, featuring specialized diagnostics and triage capabilities to help identify potentially unhealthy areas and recommend cures for problem areas."We try to bring a real breadth of capability from the best practices that we've learned into these workshops," said Marie Wieck, vice president of middleware services at IBM.With some clients, IBM has had to perform somewhat of a rescue mission after clients have done an initial application and then had problems with scalability or performance, Wieck said.Workshops, which are priced in the $50,000 range or less, include IBM SOA Applications and Services and Healthcheck Workshop and Infrastructure Healthcheck Workshop for SOA. Both are 2.5-day engagements intended for midmarket and large enterprises.The applications and services workshop is intended to provide assurance that an SOA can expand beyond pilot projects. Factors such as application reuse and service use will be assessed, as will identification of rogue services as part of a governance policy. Security also will be checked for service controls and identity management.The infrastructure workshop features an assessment of infrastructure supporting applications and services layers in an SOA. Elements examined include infrastructure flexibility, the ability to adapt to spikes in demand, and verifying SOA configurations for connectivity. A service management review ensures that services are being monitored.IBM's identity-aware ESB combines WebSphere ESB products with Tivoli security and identity management software to help ensure that access to information, services, and applications is protected. Auditing of identity and access activity is enabled."Identity management is very critical so that you can ensure that only the right people get access to these services," Wieck said.An analyst briefed on IBM's efforts lauded both the SOA and ESB programs."Customers who have started with a SOA need checkpoints to have an outside source assess what they are doing and how it compares to best practices," said Judith Hurwitz, president of Hurwitz &amp; Associates. "Companies are investing a lot of money, resources, and political capital on SOA, and management wants to make sure they are on track and doing the right thing."Governance is a huge issue for customers in regards to SOA implementation. This is especially true since SOA is as much a business strategy as it is a technology strategy," Hurwitz said."In terms of ID-aware ESB ? clearly security and identity management are huge issues for companies because of governance issues related to security," she said.IBM offers information about its SOA programs at its Web site.Also on Monday, IBM is announcing an initiative to help business partners increase revenues and better serve customers. Grow Your Business (GYB) with IBM Software provides cross-brand sales scenarios across the IBM software group's product portfolio.The GYB tool recommends scenarios that utilize business partners' existing areas of expertise. Partners through the initiative can analyze software products, get descriptions of business value, and determine return on investment via an online tool. Information is aggregated into one place.An online guide to marketing and sales materials also is highlighted.
535452
Hewlett-Packard has launched the FOSSology Project, a tool for tracking and monitoring the use of free and open-source software within an IT environment.The project stems from governance work done in-house at HP, according to the Web site set up for the project.&quot;We needed a tool that would quickly and accurately describe how a given open-source project was licensed,&quot; a statement on the site reads. &quot;Rather than simply collecting a project&#39;s advertised license (as given at their website or in their documentation), this tool needed to analyze all of the source code for a given project and intelligently report all of the licenses being used based on the license declarations and tell-tale phrases that identify software licensing.&quot;FOSSology is available under the terms of the GPL (GNU General Public License) version 2 and currently has support on most GNU/Linux platforms, according to the site.It is not clear from the site how HP plans to make money through the initiative. A company spokeswoman declined comment and said Friday that more details will be announced next week.Companies like Black Duck Software are already in the FOSS-tracking business.HP&#39;s entry brought a warm welcome from Black Duck CEO Doug Levin. Levin may feel HP&#39;s involvement will help the market expand overall. &quot;We can now officially welcome HP to our market,&quot; Levin wrote on his blog . &quot;FOSSology is a nice tool for developers. It will result in software developers being better informed about their use of GPL. That makes it a very worthy tool.&quot;Right now, the FOSSology project has modules for license analysis, MIME type identification and for extracting metadata, according to the site.The site said the tool already generates detailed results: &quot;More than simply reporting, &#39;Package X uses license Y,&#39; the FOSSology tool attempts to analyze every file within the package to determine its license. The license report is thus an aggregate of all of the different licenses found to be in use by a package.&quot;FOSSology&#39;s analyses aren&#39;t foolproof, however, a statement on the site concedes: &quot;In general, the analysis results are very good guesses but should not be considered authoritative. (Or to say it simply: We&#39;re not lawyers. The code tries its best, but leave the legal decisions up to your own attorneys.)&quot;Over time, FOSSology is meant to be far more than an open-source license tracker, according to the site. Future capabilities could address bug fixes and patches, security alerts, and code reuse, as well as analysis of all types of software.The effort prompted praise on Friday from Michael Cote, an analyst with Redmonk. &quot;It&#39;s free and open source, which is nice,&quot; Cote said. &quot;So if the data is reliable and well-fed, it could be of help for people who don&#39;t want to work with Black Duck ... and others who have commercial ways to scan for open-source licenses.&quot;&quot;The interesting thing will be to see how open the resulting data is and how much reporting people do with it,&quot; he added. &quot;There&#39;s a sort of cloudy idea of how much open source is used in the enterprise, and having more accurate, free numbers would be great for the community, and more importantly, enterprises that want to get a feel for how widely used open source software is.&quot;The availability of free open-source usage data &quot;will help people make much better -- and affordable -- decisions about what open source to use and not use,&quot; Cote said.
404652
New projects seek to develop tools to manage digital identities across multiple Web sites and platforms.
254154
Bites into identity management In July 2005, news emerged of Sun Microsystems' first foray into open source identity management with the Open Web Single Sign-On (OpenSSO) project.â¦
671756
In an effort to step up its approach to "unbreakable" databases, Oracle today announced its Database Vault technology can now be used in conjunction with its E-Business Suite.
108601
InfoWorld - The Liberty Alliance Project has published a document outlining the legal issues enterprises should consider when networking their Web applications and identity systems with those of other businesses.