Some answers on Identity enablement

James McGovern has a habit of posing questions and then naming the people he would like to answer them. This time around, I had the privilege of having my name read out on the roll call. Actually he posted it just before I went on my week-long holiday hence I'm only getting around to it now.

Here are his questions (in blue) and my attempts at some answers (hopefully I don't sound like a complete fool - I'll settle for mildly foolish):

[JM] Protocols:Nowadays, the folks over at the Burton Group such as Bob Blakely, Dan Blum and Gerry Gebel have put together the most wonderful XACML interoperability events. The question that isn't addressed is if I am building an enterprise application from scratch, should I XACML-enabled, think about integrating with STS, stick to traditional LDAP invocation or something else?

[IY] I'm not 100% sure what James is asking and my answer will probably be different if James actually means something other than what I've interpreted it as. I read the question as being once the decision's been made to use XACML, how should one be dealing with authentication? Talking about an STS (I assume James means Security Token Service) vs LDAP refers to 2 different "layers". In reality nowadays, you're ultimately authenticating to a directory of some sort. Usually you do this using the LDAP protocol under the covers. Whether you know this or not depends on the overall design.

Note that using XACML means you are pushing policy definitions around to ultimately get your Policy Enforcement Point to be able to come up with an authorisation decision. When you talk about STS or LDAP, you're typically referring to authentication which ultimately produces some sort of credential for the user within their session. Authentication and authorisation (or entitlements as people seem to like calling it nowadays) are related, but separate things that can be implemented differently as long as there is a point where they interoperate. Usually the most important part is where the authentication mechanism passes the security principal onto the authorisation mechanism so it can make an identity based, access control decision (that is also hopefully fine grained and context aware).

That said, I'm going to ignore the XACML consideration for a moment...

There are a few common approaches to take when writing authentication for applications:
1) Take a service-oriented approach (e.g. SOA or web services)
2) Leverage an API or application programming standard (e.g. JNDI, JAAS)
3) Use the native protocol of the authentication store (e.g. LDAP, SQL)

Option 1 is the most difficult to set up because this type of infrastructure is typically not built in organisations today. But it IS the most extensible option and hides the implementation specifics from every application that needs to perform authentication. Whether the underlying store is a directory, database, file system or even a mainframe does not matter. You also get the benefits served up by leveraging a web service. For example, you just need to know how to format your message (this is actually not a problem if you use a standard as it is usually taken care of by some other service) and where to send your request (via the URI). You obviously also need network connectivity to that location. There are no headaches around what libraries to import, whether your authentication services are co-located with your application or whether you need to go screw around with configuration settings and files because you are actually calling a service that is not located on the same application server as you. Keep in mind that you don't necessarily have to use an STS, although it is probably the best approach today if you're going with a service-oriented design.

Option 2 still leverages standards of sorts. JNDI and JAAS for example are both standards in their own rights. They just happen to be tied into a programming language and platform. This option is probably still easier than option 1 because organisations will more than likely have this infrastructure more or less set up. It's a matter of getting the programmers to code to these standards/APIs and then setting up the application infrastructure to hook into the relevant authentication stores. Again, this is probably already done if you're using a standards-based Application Server (e.g. J2EE). You will however, have configuration files to screw around with and changes to any of the infrastructure will potentially require applications to be modified. You're also tied into the platform somewhat. For example, if you use JNDI you're stuck with Java and the directory under the covers. With a web service, it doesn't really matter what programming language is used or what the authentication store is. You can swap components out without modifying the other loosely coupled pieces. You're supposedly able to do this easily if you code to API standards, but that's rarely true. There's usually re-configuration and some re-writing required.

Option 3 requires intimate knowledge of the protocol or tools required to access the authentication store. If using LDAP, you need to know LDAP query syntax. If using SQL, you have to know how to write SQL queries or stored procedures. It also means you cannot change your authentication stores and schemas without re-writing your applications.

They each have their benefits, but it boils down to the age old discussion around tight coupling vs loose coupling. The looser the coupling of your infrastructure components, the more extensible they are. You lose performance however and it usually takes more effort and time to build a loosely coupled system because of all the design considerations to take into account. (Note: The performance issue is usually one that can be designed around if you have the budget. You put enough redundancy, load balancers and hardware in place and you can usually get something to perform within your service level agreements (SLAs). If your network hops are large, just do a better job of negotiating your SLAs - easier said than done I know).

Option 1 is the loosely coupled approach which should "identity proof" your environment for a longer period of time (notice I didn't say forever). Option 3 is the tightly coupled approach. Option 2 is something in between. The one to pick depends on requirements, time and cost constraints. The choice will be determined by how much of the authentication infrastructure specifics you want to burden your developers with.

Bringing the XACML considerations back into the picture, I would go for option 1. If you're going to take the effort and XACML-enable your applications, why would you "get cheap" and not go with the use of an STS? It also makes everything nice and clean from an application programming standpoint. Developers will only have to worry about using security services. They won't need to remember that for certain security related things, they need to use the web service while for others they have to use the API or go direct to the source over LDAP or SQL.

[JM] Virtual Directories: What role should a virtual directory play in an Identity metasystem? Should virtual directory be a standalone product in the new world and simply be a feature of an STS? If an enterprise were savage in consolidating all directory information into Active Directory, why would I still need virtualization?

[IY] I don't come across too many organisations that use a virtual directory. Maybe it says something about the maturity of their Identity Management infrastructure. Or maybe it means that they don't see the need and are quite happy replicating things using meta-directories and synchronisation.

Leveraging a virtual directory is very much a technology choice and dependent on each organisational environment. If they have lots of identity stores and have a nightmarish amount of information that would take a long time to integrate and synchronise, then a virtual directory makes sense. If an organisation has a fairly small number of stores or their strategy is to leverage a specific central store like Active Directory, then they probably don't. On the flip side, one could argue that the virtual directory could become this "central store".

I'm not for or against virtual directories. I just think there's a time, environment and place for the choice between a virtual directory or a synchronisation solution like a meta-directory. As for using a virtual directory as part of an STS, the argument is very similar to what I've just outlined.

[JM] Entitlements: One missing component of the discussion is authorization and their is somewhat too much focus on identity. Consider the scenario where if you were to ask my boss if I am still an employee, he would say yes as he hasn't fired me yet. Likewise, if you ask him what are all of the wonderful things I can access within the enterprise, he would say that he has no freakin clue, but as soon as you figure it out, please let him know. Honestly, even in my role, there are probably things that I can do but shouldn't otherwise have access to. So, the question becomes how come the identity conversation hasn't talked about any constructs around attestation and authorization?

[IY] People are too busy crapping on about OpenID and CardSpace all the time :-)

Seriously, I think it's got to do with the way things in the identity space evolve. Before you can deal with entitlements and attestation, you need to know who people are and what they can use (i.e. what they can "log into"). It's a very high level approach sure. But that's how organisations typically start looking at the whole issue.

Also, Identity Management is not an easy issue to solve. As a result, it's taken a long time to get around to thinking about authorisation properly. It doesn't mean we will never get there. We just have to be a little more patient. All the GRC initiatives going on around the place are certainly helping. Attestation is usually one of the first things that get addressed in any GRC initiative because it needs to be done to satisfy the regulators and auditors.

Once organisations realise that having a proper authorisation infrastructure in place makes their lives a lot easier from a management and audit perspective AND it'll save them money (instead of having to re-invent the authorisation wheel for every application), they'll start to do something about it.

It's also about evangelism, education and focus. The focus isn't there yet so there's no education. Evangelism comes from the industry as a whole. The large vendors are usually the ones with the marketing clout to get the messages out in a meaningful way. Unfortunately, they chase the dollars. Until recently, there hasn't been sufficient sales revenue or qualified opportunities to justify evangelising authorisation. It's the next cab off the rank I think. We might have to wait a year or 2 for organisations to get through the early phases of their GRC initiatives before authorisation gains real traction.

[JM] Workflow: Have you ever attempted to leave a comment on Kim Cameron blog? You will be annoyed with the registration/workflow aspects. The question this raises in my mind is what identity standards should exist for workflow? There are merits in this scenario for integrating with the OASIS SPML standard, but I can equally see value in considering BPEL as well.

[IY] I don't think there needs to be identity standards for workflow in the traditional sense of technical standards. A generic workflow standard (e.g. BPEL) across all disciplines is good enough and will be better in the long run. Workflows are very dynamic, can get very complex and will be different for each organisation even if they are trying to do similar things. This makes standards tricky. Then there is also workflow from a business standpoint. When technical folk talk standards, they usually mean nuts and bolts (e.g. XML specifications). Those in the business world don't care that a worklow is written in BPEL. They care that they have to write a frigging workflow procedure from scratch. They would probably find some standards around business process definitions useful. It might be prudent of us to define easily extensible procedural workflow templates for Identity business transactions perhaps? Now that would REALLY be something.

[JM] Education: Right now the conversation regarding identity is in the land of geeks and those who are motivated to read specifications. There is a crowd of folks who need things distilled, the readers digest version if you will. Traditionally, this role is served by industry analysts such as Gartner and Forrester. What would it take for this guys to get off their butts and start publishing more thoughtful information in this space?

[IY] I don't think industry analysts are ever going to write a "readers digest" version of anything related to Identity. It doesn't help them make more money from selling reports and holding conferences for specialised groups of people while charging them thousands of dollars each. Unfortunately, I think the fastest way to get simplified Identity education out there is through the marketing dollars of the large vendors. Consulting organisations (including analysts like Gartner and Forrester) will never simplify anything because they need for things to remain (or sound) complex so they can keep charging for their "expertise".

[JM]Conferences: When do folks think that the conversation about identity will occur at other than identity/security conferences? For example, wouldn't it have been wonderful if Billy Cripe, Craig Randall and Laurence Hart where all talking about the identity metasystem in context of ECM?

[IY] Ummm how about never...which is fine by the way. The Identity industry needs to make things so dead simple and ubiquitous that there is no need to talk about it. It should just be there. Therein lies the challenge facing us all today.

So you want to remove the Verdasys agent

This post isn't going to interest many people (so I'll keep it short), but I'm considering it a "community service announcement".

Since I wrote my "Back to Identity" post, people have been landing here via search engines using variants of the phrase "how to remove Verdasys". I assume these are employees of organisations that have the Verdasys Digital Guardian (DG) agent installed on their machines and are trying to get around the system.

I have news for you. If DG is deployed within your environment the way it is in most organisations (with tamper-proof and invisible features turned on), you can't. That's not to say it absolutely cannot be removed. The system or security administrators (whoever is responsible for the DG environment) within your organisation will know how to because they have access to the administrative console and other related details (passwords and so on). Why don't you go ask them? :-)

CA positioning itself to be a GRC vendor that matters

I've been away for the past week on a short break (Athens and Santorini - if you haven't been to Santorini, you MUST add it to your to-do list). Naturally, that means that I've missed a whole bunch of news and have to catch up.

CA made a bunch of announcements last week regarding their line of security related products. The first about a new release of CA Identity Manager, another regarding CA Access Control, a third referring to CA GRC Manager and the last in relation to a brand new product called CA Security Compliance Manager.

I found the Identity Manager and Access Control announcements boring because they are just upgrades to existing products which almost all their competitors have. Upgrade announcements are boring because they are about new features which no one will really understand until they see them in action...and even then the competitors will all say "oh yeah we can do that too" even if they can't and just get the sales engineer to hack something together for the demo or POC that looks like it's out of the box.

I found the other 2 announcements much more interesting from a strategic standpoint...

The first thing I noticed was that they are sticking to the industry norm of using a completely boring name for new products while at the same time managing to use the same name as another vendor (e.g. all the major software vendors have a product called Identity Manager which does all the provisioning, de-provisioning, password management and account workflow related activities). In this case however, they have managed to use the same name as a product IBM has (Tivoli Security Compliance Manager) but for a completely different purpose.

The second thing I noticed was that they suddenly have 2 GRC centric products. If you are a regular reader, you'll know that I'm now doing some work in the GRC area after my year long sojourn into DLP so anything GRC related gets my attention.

Like many industry terms floating around (especially newer ones), GRC means different things to different people. It also means there are many software vendors out there claiming to solve all your GRC problems. What people don't necessarily always understand is that there are many different approaches (and drivers) for a GRC program within an organisation. Most commonly, a GRC initiative is viewed from one of the following angles:

• Risk Management
• Finance/Audit
• IT Security
• Business Controls/Operations

This is not an exhaustive list and most of the time there's a fuzzy line between each. In other words, there's always going to be overlap. I should also point out that an approach is not necessarily the same as a driver, but they can be the same thing. For example, the driver might be that the organisation needs to meet regulatory requirements. The combination of the regulatory requirements and the business areas affected will determine what approaches need to be taken. Or the driver might simply be that business controls need to be better monitored, controlled and audited to improve the bottom line. In this case, the approach is the same as the business driver.

As a result, there a lot of GRC software vendors that don't necessarily compete with each other even though at first glance you might think they do (usually because they stick the term GRC in their description). In fact, it makes sense for a lot of vendors out there to partner with each other to provide a more complete solution for organisations because none (including the large vendors) actually cover off the entire GRC solution. Whether an organisation needs the complete solution is an issue for another day.

Here's why the CA annoucement is interesting. CA GRC Manager looks to be enterprise risk management focused. They've now added CA Security Compliance Manager which looks to be IT Security focused. It's starting to look like organisations have decided that IT Security Governance needs to be centred around identities, which is why IT Security GRC is sometimes referred to as Identity Centric GRC. In my opinion, this means CA Security Compliance Manager competes directly with the likes of Sailpoint and Aveksa. Notice that I haven't mentioned any of the large vendors (e.g. IBM, Oracle, Sun, Novell, SAP) in this space. This is because they don't have anything that competes. Here's why:

• IBM don't have a GRC product. They use a combination of IBM Tivoli Identity Manager (ITIM) and IBM Tivoli Compliance Insight Manager to do GRC-like tasks. IBM, I'm afraid nice looking reports and some ugly ITIM screens that do some level of attestation but business users can't figure out how to use doesn't cut it.
  
• Oracle have a product, but it hooks into all their Finance, ERP and CRM applications. This means it's very focused on business controls.
  
• Sun thinks Role Management = GRC. I have news for you Sun. Even in combination with some of the things Sun Identity Manager does, you're still not there.
• SAP have solutions, but they all hook into...well, SAP! Just like Oracle, it's focused on business controls.
• Novell are even worse off than the others because they are still peddling their provisioning and access control solutions as being able to solve all your governance and compliance problems.
  

It looks like CA is ahead of the curve in this case. Keep in mind I'm talking strategy and ability to execute and bring something to market. I'm sure all the other large vendors I've mentioned have some sort of plan. A lot of the discussion behind closed doors is probably around who they should acquire to fill the gaps. That said, the new CA Security Compliance Manager doesn't look to have some of the functionality that Sailpoint and Aveksa have, but they've essentially just released a version 1.0 of a product and they have the marketing dollars to make up for it in the initial stages. They can also claim to have integration into their GRC Manager product and their Identity and Access Management suite so that's also a leg up on Sailpoint and Aveksa because they can sell the "suite concept" instead of convincing organisations to go with a "best of breed" approach that smaller vendors have to preach.

Thinking out loud, it might make sense for CA to partner with SAP on a joint GRC marketing campaign. I seriously doubt Oracle (or CA) will agree to such a concept. Or maybe SAP should just buy CA and be done with it.

Paranoid about your passwords?

I came across this today. It's pretty handy if you are sick of trying to think of (and remember) complex passwords.

For those familiar with authentication schemes, it essentially blends the concept of challenge/response questions with passwords. The way I like to think of it is by using the following example...

The challenge (called "phrase" on the site) could be something like "what is my password for site x" and the response (called "password" on the site) is just a word you use as a "password key" so to speak. The site will spit out an actual password, which you can use as your real password for whatever site you use it for.

Metaphorically, it's like going to a locker (perhaps at an airport or a train station) to get your house keys so you can go home. Thankfully, you only have to go to a website instead of navigating through traffic or the public transport system to get your house keys.

Apparently there's no "magic" behind how it generates your password for you. Read about it here.

It's not foolproof, but it's certainly better than using a weak, simple password because it's better than single factor authentication. I wouldn't go as far as calling it a 2 factor authentication mechanism because using the traditional definition requires that the authenticating site handle the authentication factors directly and that the authentication factors are two out of the following three: something you know (e.g. password), something you have (e.g. smartcard), something you are (e.g. fingerprint).

But if you think about it, handling your password this way requires that you know something (what challenge/response combination to use) and also generates you a "token" of sorts (usually this comes from something you have - in this case, you could argue that this is the website). I know it's the same token each time so it's effectively a password but it's not something that's easy to guess. One could view it as a "pseudo token" that is generated based on knowledge that you have. Call it 1.5 factor authentication if you like. Or maybe "obscured/indirect authentication". Can anyone think of a better name? In any case, I'm really stretching the multi-factor definition here. But hopefully you know what I'm getting at. In short, it's better.

It's a very simple concept (now we can all say "crap why didn't I think of that") and a good one I think if you want to add that extra little bit of security to your everyday passwords.

Back to Identity

If you've met me in person over the past year in a business situation, I was probably representing Verdasys and you were more than likely looking at doing something about your organisation's data security posture. In fact, our meeting was probably due to an organisational data leakage prevention initiative you had to be involved with.

If this is a surprise to those of you reading this, then you haven't tried very hard to figure out what I do for a day job (actually, I should say "did" - more on that in a moment) because it's readily available out on the web. In fact, Matt Flynn lists this fact on his blogroll because he bothered to look (Matt, I don't know if you read my blog regularly but you should probably remove the "Verdasys" association now).

I've been THE "technical face" of Verdasys across EMEA (Europe, Middle East and Africa) for the past year, but that association stopped just over 2 weeks ago. I say association because technically speaking, I was consulting for them in a freelance capacity. It's been an interesting experience and I learned a lot about data security, which served as the perfect complement to my experiences in the Identity and Access Management world.

As a result, I purposely avoided saying anything of significance about Verdasys due to the obvious conflict of interest. In fact, I think I only mentioned Verdasys once and that was via a direct quote from an IBM press release. I won't say too much more for now other than the fact I still believe they have a great solution and a great team to move the company forward. For me personally, it was just time to move on and opportunity came calling. I maintain very good relationships with everyone (some subscribe to this blog...hi guys) I had the pleasure of working with and wish them nothing but the best. Of course if they do something I don't particularly agree with in terms of strategy, I'll be calling them out on it (like I've been doing with every other vendor out there, including IBM).

2 months into my data security "gig", I wrote about my impressions of the data security and leakage prevention landscape at the time. I'll be doing a follow up post in the next few weeks regarding my impressions as of now so stay tuned.

As for what I've moved on to, it's like the title of this post says. I'm back in the Identity and Access Management world, but more from a strategic standpoint. I can't say much more about it not because I'm sworn to secrecy, but because it's a very interesting and fluid role and things are changing all the time. In fact, a lot of the onus is on me to help figure out what needs to be done. All I can say for now is that for the past 2 weeks I've been taking a look at the governance and compliance aspects (the industry calls it GRC - Governance, Risk and Compliance) of security, which obviously revolves around Identity and Entitlements.

Of course, as far as this blog is concerned it's business as usual.

What is this Enterprise 2.0 thing?

Phill Eriksen left a comment in response to my previous post and asks 2 questions:

1. How much Enterprise 2.0 functionality can Oracle deliver today and what is their roadmap going forward.
2. Isn't this Enterprise 2.0 message just the new 'On Demand' or 'E Business' message IBM has been pushing for 10 years?

Someone from Oracle should answer question 1. Or just wait a few months and I'm sure they can send someone from their new Enterprise 2.0 sales force out to tell us. I'm going to address question 2, because it's an area that's still very much open to debate...

No it's not. I'm not trying to defend Oracle. I'm just trying to clarify the difference. Or rather, the difference as I understand it at this point in time. In fact, if you talk to people in IBM Lotus, I'm sure they'll also agree it's not the same thing.

Enterprise 2.0 is NOT the old IBM "e-business" or "OnDemand" message (Note: I'm going to over-simplify by trying to distill the concepts down to their essence. There are other aspects that I could mention but won't because it'll take too long and people will fall asleep reading).

The "e-business" concept was essentially about businesses addressing the growing popularity of the Internet as the medium of choice. For some businesses, it was about having a web page. For others it was about linking business systems together so that organisations could get things working more efficiently while reducing the need for human intervention. This allowed for better integration between their internal enterprise applications (most of which were legacy apps) and even with partner organisations. In other cases, it also allowed consumers a direct way to transact with organisations without the middle men. The whole "e-business" meme was coined by IBM marketing and found itself being adopted by the industry. Other technology companies had their own term for the concept, but you could pretty much say "e-business" and people knew what you were referring to.

The "OnDemand" phase was the next logical step as IBM saw it. Again, other companies had their own terms and marketing buzzwords, although this time the phrase didn't quite take off like "e-business" did. "OnDemand" began conceptually as utility computing (right from viewing physical resources like memory and disk to business services) but evolved along the way because people started to realise there were a bunch of steps that needed to be performed before we got anywhere near the actual notion of "utility computing". Even now we're still not there, although we're much closer. The steps I refer to were more about making the "IT plumbing" easier to deal with when designing systems and allowing the focus to be more about the business functions and processes. Unfortunately, that meant that very few people outside of the enterprise technical community understood what benefits having an OnDemand business really meant because there really wasn't anything tangible that people could see.

"OnDemand" gave way to "Services Oriented Architecture (SOA)", which was really just a way to facilitate the "OnDemand" movement. SOA provides a standardised way to use business functions, processes and pretty much anything that needs to be utilised by many applications (or consuming services) across the board. In other words, SOA tries to turn business functions and processes into utilities. Imagine if each time you built a house, you had to go figure out how to build your own power generator and everyone built a power generator in their own way. That would REALLY suck. What happens if it breaks? You better know how to fix it...because if you can't find the person who built it for you, then you have to pay someone to take a look and try to reverse engineer it before they can even attempt to fix it. Instead most of us just go to the electricity company and pay them to supply us with electricity. We don't care how they produce it. All we care about is that it gets to us somehow.

Enterprise 2.0 should be MUCH more tangible. People should actually be able to see what is going on and hopefully experience the benefits directly in their day to day work lives. It looks like the initial focus is going to be around collaboration and information and should extend to other things as people start to "get it". If Enterprise 2.0 is done right, the "plumbing" that Enterprise 2.0 applications run on should be built on top of SOA concepts. Note that I said concepts...not necessarily SOA software from a big vendor. The key to understanding Enterprise 2.0 in my view lies in being an actual user of Web 2.0 applications and at the same time understanding enterprise technology and business. Enterprise 2.0 is about taking everything about Web 2.0 that may be useful for business and evolving alongside it.

For anyone wondering what the fuss is about, start using a social networking application like Facebook. I don't mean sign up for an account, poke around (pun intended...you'll get the pun if you use Facebook) then dismiss it as being useless or irrelevant to you. REALLY use it. You'll learn to ignore the noise (there is a lot of it in there) and learn what the useful things are...the things that make a difference to your experience as a person in real life. Take these useful things, change all the personal aspects (e.g. information) to work related ones and then imagine having it at work.

If you still don't see even a semblance of any value, go speak to your kids or someone under the age of 30. If you are under the age of 30, then you should be ashamed of yourself...or maybe you are a lawyer (I don't mean to offend the legal profession, but all my lawyer friends seem to be luddites - maybe it's because they spend all day killing trees by printing out copious amounts of documents and then reading these documents without having the need to use a computer or the Internet).

What do you think Enterprise 2.0 is?

Roundtable with Oracle President Charles Phillips

I mentioned Oracle not so long ago and the fact that they are starting to reach out to the blogging community. They've now extended those efforts properly to the UK.

Last week, I was contacted by Oracle about my availability for a meeting today with Charles Phillips, Oracle's President who has been visiting customers around Europe this week. The theme of the meeting was to be Web 2.0 and linking this into Enterprise 2.0, specifically with regards to how Oracle is addressing these areas.

I initially thought it was an open event in a large auditorium full of people and assumed I would simply be in the audience - more or less the type we're used to when someone gives a keynote speech at a conference. I later found out that it was a small event that was being held in a meeting format where the attendees had to be invited. I was a little apprehensive at first because I'm not a writer/journalist by trade, but thought it would be interesting to meet the man in person, hear what he had to say and ask a question or 2 of my own.

It turned out to be a meeting around a table with a mixture of invited participants and a handful of Oracle attendees including Chief Marketing Officer Judith Sim and Charles Phillips of course. Oracle's rationale behind selecting the invitees was basically that we were all regular bloggers about a topic of interest (related to Oracle's business somehow) and based locally in or around the UK. Whether we were media types, analysts or consultants, it did not really matter.

The only real bit of news that came out of the meeting was that Oracle are taking the Enterprise 2.0 initiative forward by implementing an "Enterprise 2.0 sales force" to take their solutions to market and more importantly, to educate their customers.

The format was "open". Oracle stressed that they wanted it to be a discussion and they hoped to have many more in future. To his credit, Charles didn't preach to us. He simply gave a brief 2 minute introduction about why he wanted to speak to us, what he's been doing all week and then opened the floor to questions for discussion.

Charles started by saying that he understands PR as we know it is no longer working and he doesn't need it. If he wants to get at his customers, he can go directly to them very easily. He also mentioned that the purpose of his European visit was to get a feel for customer needs and how they were leveraging Oracle technology. Essentially, many are looking to simplify computing environments and of course Oracle are only too happy to help. He also noted that as a result of all the acquisitions they've made over the past few years, Oracle technology is now firmly embedded in many more organisations and is becoming a strategic platform (which means more CEO meetings as opposed to the past where they only got as far as the CIO).

I won't go through everyone's questions and Charles' answers because they weren't particularly focused or even related (I'll get to that later) and if I detail everything, this post will sound even more like the meeting minutes it is starting to resemble :-)

The topics that came up were:

• Customer Relationship Management (CRM).
• Supply Chain Management (SCM).
• Cultural differences especially in the Asian region and how Oracle looks to handle this without "pushing technology down their throats".
• Extending the Enterprise 2.0 initiatives and reaching out to the wider developer community. Judith Sim mentioned Oracle Mix as a good example of how they are currently doing it and will continue to use that avenue.
  
• Salesforce CEO Marc Benioff's Web 3.0 announcement.
• Convincing middle management about the value Enterprise 2.0 can offer.
• Linking business processes and Enterprise 2.0 concepts.
  
• Security/Identity 2.0 and Oracle's position on how it fits with Enterprise 2.0 (I asked him this in a rather long winded way).
  

In trying to help us understand how Oracle views Enterprise 2.0, Charles gave the following examples:

• Finding the right expert internally within an organisation to help with something you are doing - Charles talked about how Oracle encourages their employees to tag themselves as being "experts" in certain areas. In addition to this, others get to vote on whether you are really an expert in the areas you claim. It's the whole notion of reputation...very Identity 2.0. I was tempted to ask him about where he thought reputation fit into their Identity strategy but thought it might have been too specific and targeted a question and not appropriate for the topic we were discussing at the time (collaboration).
  
• Sharing of information between sales people within CRM systems - Teams of people typically share material informally through various methods including word of mouth or email. Oracle wants to move this informal information sharing into the CRM system to facilitate more collaborative interaction between the sales teams and help identify useful material using things such as tagging and voting so they can more easily find materials and not have to re-invent the wheel. Doing this also gives management more visibility with regards to what is working, what is useful and how to potentially improve things.
  
• Expense approval processes - Currently, the typical process involves the approval step being left to the judgement of the individual. For example, if someone expenses a flight from New York to San Francisco, the approver will look at the cost and make a "best guess" as to whether it looks reasonable. Oracle's view of how this should evolve is to allow the approver real time and historical information to help them make a more informed decision instead of guessing.
  

The word collaboration came up quite a fair bit during the meeting. It is obvious Oracle sees the ability for people to collaborate efficiently, easily and in real time as being key to making Enterprise 2.0 successful.

As for my question, I started by taking note of Oracle's very fast growth to now being one of the leaders in the security space, particularly the Identity and Access Management arena through their flurry of acquisitions (Charles responded by saying "I'm glad you noticed"). I also noted that they announced their strategy for Service-Oriented Security (which I mentioned here) and how it clearly feeds into their Enterprise 2.0 strategy from a middleware perspective. My question was around how Oracle would move forward with the following things:

1. Making sure that the whole security layer becomes more pervasive in their application and middleware portfolio.
2. Using the Enterprise 2.0 initiative to help organisations realise a better and more complete enterprise security model especially around data privacy and governance without having to spend years implementing the so called "off the shelf" solutions.
   
3. How they would look to drive their leadership position forward and become more active in the Identity and Security community with some of the Identity 2.0 initiatives, noting that he had mentioned the concept of reputation (which is a very new and misunderstood area in Digital Identity) when giving his example on collaboration and voting on whether someone was indeed an expert.
   

Charles sort of answered my question. He answered all 3 at once by saying he thinks they already have a great set of solutions and an "Identity stack" to allow for the whole pervasive notion and good integration with their other software products. In his opinion, Oracle just hasn't done enough evangelising. He thinks Oracle will help customers by bringing to market best practices and expertise they have internally and that a lot of this will be driven through education and the Enterprise 2.0 sales force (the "Enterprise 2.0 sales force + education" answer was prevalent in most of his answers to everyone's questions).

I followed up by asking if he thought a lot of the work would or needed to be done internally or whether there were more acquisitions on the horizon. I'm not sure if I said those words specifically, but that's what I meant. He reiterated that he thought they already had most of what they need and it was a matter of driving the initiatives forward with what they currently have.

His answers to my questions were a little bit generic and I could easily imagine other large Enterprise Identity and Access Management vendors like IBM, Sun or CA coming up with that answer. In fact, it was the type of answer I would have given in my IBM days when customers asked similar things (albeit in a different context to Enterprise 2.0). To be fair, I may have been too specific about Identity and he just didn't have the right product marketing people around him to answer my questions in more detail.

In my opinion, Oracle haven't quite worked out what to do with security in the context of Enterprise 2.0. They are clinging on to their notion of "Service-Oriented Security" for now as being their Enterprise 2.0 security layer. The initial focus looks to be on the whole notion of collaboration and Oracle WebCenter. For those of you familiar with the IBM world, think IBM Lotus Web 2.0. I don't know enough about each of the technologies to comment on which I think is better, but IBM and Oracle are going head to head yet again in trying to be the leader in this space.

Some of the other attendees have posted their reactions to the meeting. Here are the ones I've found (I'll add more as I find them so stay tuned):

• Dennis Howlett's ZDNet blog entry (which made the ZDNet front page for a few hours) - He lists the questions he asked and was generally positive.
• One of Dennis Howlett's twitter statuses during the meeting - I wonder if he included me in the "no idea about Enterprise 2.0 category". In the group's defence, we are all from different backgrounds and have different interests. Just because we didn't approach the whole Enterprise 2.0 thing from his angle doesn't mean we don't know anything about it. Sure there's still a lot of educating to be done because Enterprise 2.0 is still largely open to interpretation. We simply got a taste of what Oracle thinks it is. IBM probably has a different view, as will other vendors. Heck, the industry hasn't even agreed on what Web 2.0 means yet! So Dennis, give the group a break.
• Matthew Aslett - Good overview of the collaboration technologies mentioned and how they fit in with the Enterprise 2.0 initiative.
• Neil Ward-Dutton - Review of the meeting and some views on Oracle's "reaching out to bloggers" initiative.
• Stuart Lauchlan - Review of the meeting concentrating on the Enterprise 2.0 related news.
  

The list of attendees suggests to me that Oracle wanted to get people from different backgrounds and interest groups so they could get a good spectrum of ideas and varied approaches. We certainly got varied opinions and questions. Unfortunately, the whole discussion lacked a little focus and everyone seemed to be trying to link their questions in with others to give everything some continuity and fluidity (which may also explain Dennis Howlett's opinion that we were all asking "v.soft questions"). It was difficult to get everyone in a room to REALLY sink their teeth into whatever the discussion happened to be because a specific question being addressed at any particular point in time may not have been an area everyone knew a lot about. Everyone had their own interests and agendas and it showed in the questions that were asked. The discussion was probably also a victim of the fact that Enterprise 2.0 is a new area and open to much interpretation. Perhaps some sort of very loosely defined structure or pre-meeting brief around Oracle's Enterprise 2.0 plans would have facilitated more thought and discussion because the attendees would be able to do a little bit of preparation. It's a tough one because it's a bit of a contradiction to put structure around what is meant to be an unstructured session.

I'm not trying to detract from the event. All things considered, it was a worthwhile activity and a very good first attempt here in the UK. Essentially, I think what Oracle were trying to achieve was a real world manifestation of what happens in the Blogosphere: real time open discussion based on varied opinions with a theme at the centre. It was a good effort from the Oracle PR team and I think everyone in attendance appreciated the gesture. One of the other attendees remarked to me that he was VERY surprised at being invited to such an event because Oracle in the past has been particularly formal about public relations. They are obviously doing a lot of work to change that perception and the more of these types of event they do, the better they will be for it. How very "Public Relations 2.0" of them (cringe if you want at that comment but I couldn't resist).

P.S. There are some photos of the meeting and in the single photo that I'm in where you can see my face (there were a few of the back of my head), I look like I'm asleep! I obviously wasn't otherwise I would have had a lot of trouble writing this post. They must have caught me in mid-blink! No, I'm not going to post it on here :-)