Bob Blakley Saves Some of the Best for Last from CIS 2013
Bob Blakley, Global Head Information Security Innovation at Citigroup and my former colleague from Gartner and Burton Group has posted his Cloud Identity Summit (CIS) 2013 presentation in slideshare. It’s called “What if Identity Were Pass-By Reference” and it presents “a drama in text messages.” The 95 slides flip by fast, and are worth viewing. At least twice!
Alas that I missed it, having returned from CIS 2013 a day before after a harrowing start to the journey, intense standards meetings on User-Managed Access and Extensible Data Interchange (XDI) and some excellent conference opening keynotes reviewed here and there on this blog. So like other slideshare readers I can only read between the tweets on the slides. On first viewing yesterday, I commented “excellent slides by Bob BlakLey apparently referring to OpenID Connect and following the Dick Hardt style of identity management presentation.” (The identerati among us may remember Dick Hardt’s presentations, hundreds of slides long, each with just a word or two or picture at Burton Group Catalysts about 10 years ago).
On second viewing now, pausing at slide 8 where the summary of the presentation hides: “Passing a pointer to your identity is better than passing your identity.” This suggests OpenID Connect, which passes an opaque id token to be exchanged for attributes and other claims at an authorization server with user consent. The consent step and pseudonym support make the protocol privacy-friendly, or “user-centric.”
A flurry of slides on “texting the car dealer” build up to the figure below, which suggests a “vendor relationship management”, or VRM, angle on the talk.
Source: Bob BlakLey, Citigroup
Someday we may be able to buy cars like this online (with a whole lot more control of the terms and conditions buried in the fine print). That’s if Doc Searls (author of “The Intention Economy”) and fellow-members of the VRM Project have their way. But the grand vision of VRM needs some building blocks at a lower levels, including user-centric identity, legal hacks, personal clouds and more.
The slides continue with examples themed around “if identity dealers sold cars” and profoundly “what does the car dealer know that the identity architect doesn’t?” So if we substitute “identity system” for architect the implication is that identity is the gateway to VRM and much more, will in keeping with Andre Durand’s (CEO, Ping Identity) theme of “Identity – the Enabler of Next.“
Bob answers his own question with “the car dealers knows how to deal with counter-offers.” Negotiation is what that great American tradition at the dealership is all about. The presentation goes on to show identity-related protocol negotiation examples, and perhaps proposals for enhancement. If you were there, or if you’re Bob reading this, please comment on which protocol is to be enhanced – OpenID Connect? Or something else?