Making Digital Services Secure and Trustworthy
Blog Topics
Access Control
- » HOW TO Visualize Access Control Use Cases
- » Reality of XACML PEP-PDP Interoperability - Part III
- » Converging Logical and Physical Access Control via XACML
- » Identity Oracles - Trust is Ephemeral, Contracts are Eternal
- » Identity Oracles - A Business and Law Perspective
- » Identity Oracles and their role in the Identity Eco-System
- » Future of Identity Management is… Now!
- » Reality of XACML PEP-PDP Interoperability - Part II
- » Reality of XACML PEP-PDP Interoperability
Architecture
- » Identity Establishment, Management and Services
- » A C2G Identity Services Overview of Canada
- » Near Real-Time Anomaly Detection and Remediation
- » The Missing Link Between Tokens and Identity
- » FRAUD as a Digital Platform Service
- » The Trusted Role of an Attribute Broker
- » Proprietary Attribute Validation (Remote Identity Proofing) APIs
- » Fraudulent Account Activity Signaling and NISTIR 7817
- » Fraudulent Account Activity Signaling in Broker/Proxy Models
- » Proxy Architecture
- » What Capabilities are Enabled by Public Sector Federated Identity Platforms?
- » Balancing Identity Assurance and User Enrollment UX
- » Why Protocol Profiles are Critical for Interoperability
- » Purity and Pragmatism in Standards Profile Compliance
- » Can Web APIs Bridge the Sharing and Safeguarding Gap?
- » If Identity is the New Money, Standardized Assurance is the Currency of Trust
- » Credential Manager in the Token and Attribute Manager Separation Model
- » Anonymity in the Token and Attribute Manager Separation Model
- » Gov of Canada Approach to Separating Credential (Token?) and Identity Assurance
- » Can NIST E-Authentication Guideline SP 800-63-1 Support a Token-Attribute Separation Model?
- » A Model for Separating Token and Attribute Manager Functions
- » Standards Compliance - Balancing Purity and Pragmatism
Attributes
- » How Identity Resolution Can Help Attribute Providers Overcome Blindness
- » Attributes are the New Money
- » Identity Validation as a Public Sector Digital Service?
- » The Venn of Identity Proofing and Identity Resolution Attributes
- » Should RP Business Process Data Collection and Validation be Outsourced to a CSP?
- » Quantitative Criteria for Evaluating Identity Resolution Data at the RP
- » Standardizing the RP Requirements for Identity Resolution
- » Context and Identity Resolution
- » The Trusted Role of an Attribute Broker
- » Data Minimization with Front Channel SAML Attribute Requests
- » Is a CSP In a Federation, Without Identity Attributes, a Token Manager?
- » U.S. Federal Government's Identity Federation Framework
- » Identity Establishment and the Role of the Public Sector
- » HOW TO Choose Attributes to Uniquely Identify a Person
- » Identity? Privacy? Authorization? It is all about Context!
- » An Emerging Standard for Identity Proofing and Verification
- » Visualizing the Needs of Attribute Consumers and Attribute Providers
- » User Attributes - More than Identity
- » Comparing BAE v2 SAML Profile(s) and OASIS XASP
- » FICAM Backend Attribute Exchange v2 Release Candidate available
- » What is the Federal ICAM Backend Attribute Exchange (BAE) v2?
- » Want ABAC? Across Organizations? Start with Policy!
- » IIW East Session on Role of Government as Identity Oracle (Attribute Provider)
- » Government's role as an Attribute Provider
- » Conveying Attribute Assurance
- » SAML v2 Profiles for PIV Subjects and Backend Attribute Exchange
- » The Zen of Identity Attributes
Authentication
- » Protecting Personal Data with Multi-Factor Authentication and Identity Proofing
- » Why Multi-Factor and Two-Factor Authentication May Not Be the Same
- » Do the Majority of Public Sector Digital Services Need Credentials?
- » Are We Conflating Identity Verification and Compensating Controls?
- » Who Else Wants a Portable Token as the First Authentication Factor?
- » The Value of Sameness in a World Demanding Identity
- » Public Sector Identity Assurance Guidelines and Standards
- » The Missing Link Between Tokens and Identity
- » Should Level of Assurance be Scalar or a Vector?
- » What are KBA Metrics?
- » Identity Assurance and Knowledge Based Authentication
- » Leveraging User Experience Expectations at the RP
- » Identity Establishment, Verification and Validation
- » Is a CSP In a Federation, Without Identity Attributes, a Token Manager?
- » Are Federated Credentials and Continuous Identity Verification Compatible?
- » U.S. Federal Government's Identity Federation Framework
- » Who are the Natural Source of High Assurance Credentials for Public Sector Services?
- » Does KBA and Public Sector Online Services Have a Future?
- » Dear Maryland, Will You Be Wasting My Tax Dollars on Passwords?
- » Castles with Glass Doors
- » What is the Value of an Assertion of Identity at LOA 1?
- » Likelihood of Alien Invasions and Assurance Levels
- » Why I Will Not Ride The (Trust) Elevator
- » FFIEC and NIST Authentication Guidance. Does a Token Venn Diagram Exist?
- » These Are Not The LOAs (1+,2+,3+) You Are Looking For. Move Along
- » NIST SP 800-63-2, Electronic Authentication Guideline, Released for Public Comment
- » NIST SP-800-63-1 Multi-Token Assurance Level Matrix
- » HOW-TO Conduct a Risk Assessment to Determine Acceptable Credentials
- » How do you define step up authentication?
- » Canvas Theory of Identity LOA vs Canvas Theory of Access Control
- » NIST SP 800-73-3 and PIV-I
CyberForge
Event
- » Government’s role in Identity Establishment [Event]
- » FICAM TFS Program at IDESG TFTM Committee [Event]
- » FICAM Information Sharing Day and Vendor Expo [Event]
- » SIA Government Summit 2013 [Event]
- » 5th Annual Adobe Government Assembly [Event]
Federation
- » RFI - EMV Enabled Debit Cards as Authentication Tokens?
- » What Is the Role of Transaction Risk in Identity Assurance?
- » Who Else Wants a Portable Token as the First Authentication Factor?
- » The Value of Sameness in a World Demanding Identity
- » FRAUD as a Digital Platform Service
- » Should RP Business Process Data Collection and Validation be Outsourced to a CSP?
- » Why are U.S. Financial Institutions Not at the Identity Table?
- » Why are U.S. Financial Institutions Not at the Identity Table?
- » Is a CSP In a Federation, Without Identity Attributes, a Token Manager?
- » Are Federated Credentials and Continuous Identity Verification Compatible?
- » What Capabilities are Enabled by Public Sector Federated Identity Platforms?
- » U.S. Federal Government's Identity Federation Framework
- » Who are the Natural Source of High Assurance Credentials for Public Sector Services?
- » Does a Credential of Last Resort Need to be Offered by Public Sector Services?
- » Does Public Sector Identity Federation have a Compelling Gain-to-Pain Ratio?
- » Local Credentials and Life in the Federation Glass House
- » User Enrollment Challenges with PKI Credentials
- » How To Enroll a User, Even When There are No Shared Identifiers
- » Here Be Dragons - Social Security Number and Federation User Enrollment
- » If You Don't Plan For User Enrollment Now, You'll Hate Federation Later. Redux.
- » Role of Multi-Sided Platforms in Identity Federation
- » Federated Credential Use. A Tale of Poultry and Public Sector
- » Relying Parties as IdPs and Assurance Level Escalation
- » Will Consumer IdPs Become the Maginot Line of Federated Identity?
- » HOW-TO Incorporate Risk Management into Assurance Level Determination
- » Implications of US Gov Accepting Externally-Issued Credentials
- » US Gov public web sites required to accept federated credentials
- » HOW-TO Fast Track to Federation for Web Sites
- » FICAM Trust Framework Provider Trust and Privacy Criteria
- » Federation Flows 3 - Authorization
- » Federation Flows 2 - Attribute Exposure
- » Federation Flows 1 - Authentication
- » Federal ICAM Support for Identity Federation Flows
- » SAML 2.0 Assertion Syntax
Hiking
- » Backpacking the Glacier National Park Gunsight Pass Trail
- » Relaxing, Recharging and Hiking in Banff National Park, Canada
- » Backpacking Yellowstone National Park
- » Recommended Hike - A.T./Neighbor Mountain/Jeremy's Run
- » Back on the Grid ...
- » Tools for the Connected Backpacker
- » Hiking the Appalachian Trail in Maryland
- » Backpacking in the Rocky Mountain National Park
- » Summer in the Shenandoah National Park
Identity Assurance
- » Why Multi-Factor and Two-Factor Authentication May Not Be the Same
- » Identity Establishment, Management and Services
- » A Simple Framework for Trusted Identities
- » What Is the Role of Transaction Risk in Identity Assurance?
- » Do the Majority of Public Sector Digital Services Need Credentials?
- » Are We Conflating Identity Verification and Compensating Controls?
- » Public Sector Identity Assurance Guidelines and Standards
- » The Missing Link Between Tokens and Identity
- » Should Level of Assurance be Scalar or a Vector?
- » What are KBA Metrics?
- » Identity Validation as a Public Sector Digital Service?
- » Identity Assurance and Knowledge Based Authentication
- » The Venn of Identity Proofing and Identity Resolution Attributes
- » Breaking Identity Proofing to Enable Online Services
- » Quantitative Criteria for Evaluating Identity Resolution Data at the RP
- » Standardizing the RP Requirements for Identity Resolution
- » Context and Identity Resolution
- » Proprietary Attribute Validation (Remote Identity Proofing) APIs
- » Identity Establishment, Verification and Validation
- » Balancing Identity Assurance and User Enrollment UX
Musings
- » Are We Having a Gone With the Wind Identity Moment in the US?
- » How to Work on the Wildly Important while Walking in a Windstorm
- » The pursuit of happiness
- » Leaving GSA and FICAM
- » Will 2015 be the Year of Public Sector Digital Service Delivery?
- » My 10 Most Popular Blog Posts of 2014
- » The Monomyth Fallacy of Digital Service Delivery
- » Please Take My 2014 Reader Survey
- » DIACC Launches in Canada
- » Three Indicators for Successful Public Sector Service Delivery
- » Yahoo, Identity Federation, and You as a Valuable Product
- » International Travel and Mobile Data Access in Kerala, India
- » My 10 Most Popular Identity Related Blog Posts of 2013
- » Five Habits of an Effective Executive
- » My Three Wishes for the Public Sector Identity Genie
- » Do Not Go Gentle into That Good Night
- » Government Shutdown and Furlough
- » Never Miss a Post if Reading this Blog via RSS
- » Pace on the Path to Progress
- » Hang Together or Hang Separately? U.S. Digital and Information Sharing and Safeguarding Strategies
- » Next Steps, Lack of Blog Posts and FICAM
Privacy
- » Attributes are the New Money
- » Data Minimization with Front Channel SAML Attribute Requests
- » Personal Data and Government by Dan Geer, CISO at In-Q-Tel
- » Tell Us Once or Tell Us Each Time; Implications for Digital Services
- » User Consent in the Age of Attributes - Part 2
- » How WAYF implements informed consent for attribute release without storing PII
- » Privacy Preserving Attribute Validation using XACML
- » User Consent in the Age of Attributes
- » nymwars and All your real names are belong to US
- » Fair Information Practice Principles (FIPPs)
Quote
- » How to Bury an Issue [Quote]
- » New Ideas by William James [Quote]
- » Unfairness of Life by Marcus Cole [Quote]
- » Limits of Power by David D'Alessandro [Quote]
- » A New Day by Ralph Waldo Emerson [Quote]
- » Innovation by Niccolo Machiavelli [Quote]
- » Meditation by Chief Tecumseh [Quote]
RDT
- » How To Connect Research and Startup Communities
- » Avoiding the Echo Chamber when Building a Research Agenda
- » Building a Bridge Across the Research Valley of Death
- » Why Should Digital Service Delivery Organizations Conduct R and D?
- » Federal Funding for Blockchain Security and Identity Verification Technologies
- » Cybersecurity R&D Solicitation ($95M) Announced
I am a Public Interest Technologist. I help technical leaders gain clarity and understanding on complex architecture, information security and privacy practices, so they can enable secure, trustworthy digital services. 