The weaknesses I refer to are documented at https://www.blackhat.com/presentations/bh-usa-07/Tsyrklevich/Whitepaper/bh-usa-07-tsyrklevich-WP.pdf. Frankly none of them are showstoppers, and you can tick off a some by mashing up with information cards.

Agree with you completely !! I would however like to know your views on the weaknesses of OpenID like systems.

My ideal world scenario is a flexible identity management system which will maintain individual identities as a common, Open ID like system but also allow for linking these to enterprise identity management systems on need. Reminds me of my bank account which gets linked as a salary account to different companies based on the place that I work ..

For documents, the ideal would be a web based document management system which uses Open ID for identity management and IRM for rights management based on identities. What say ??

Vishal
gupta_vish@yahoo.com

I’m not sure that I agree with the “daddy” concept. This might work fine in a tightly integrated static value chain, the whole point of my reference to ‘The World is Flat’ is that value chains are becoming more dynamic (and global). If user provisioning becomes a precursor activity to doing business (with anybody) then I think that quickly becomes a problem. That’s why I lean towards something that can be self service and uses a global namespace (and OpenID ticks that box, but has a bunch of weaknesses of its own).

Once you accept that there’s a need for a global IDM namespace (rather than one scoped by an enterprise directory) then you can’t just use file system ACLs for classification purposes. I think the heart of this problem is that we’ve often thought about content solely in the context of how it’s used within the enterprise electronic border (e.g. inside the firewall). As that border is forced to become more permeable (and reperimiterized around key data centre assets) then that forces a rethink about who outside the organisation has a need to use (and various regulatory things also force more serious consideration of who inside the organisation does not).

Hopefully my forthcoming post on entitlements services will clear up the last point. I’ll try to get it out this week.

Client Integration : No solution except for standardization ..

Content classification : I have seen an extremely simple yet effective solution to the problem .. the solution is instead of everyone trying to figure out which policy to apply for the rights to be applied to specific folders within a file server or a document management system. The file servers / DMS already provide the required access control mechanisms and by a one to one association with the folder a specific policy can be applied without the end user really knowing about the details. Educating end users on which documents to place in each folder is by itself not an easy task but its a challenge that the enterprise has to live with anyways !!

I am not sure I understand what you mean by the “entitlement services” bullet so …

Check out the following blog on this topic …

http://www.edrm.blogspot.com/

I have not been posting for the last few weeks but intend to keep it updated often going forward ..

Vishal