Maturity models for privacy and identity

Greetings and salutations to you all! ;-)

I just read an awesome post to Toby Stevens blog on his maturity model for privacy. Check it out at http://www.highwest.com/. I thought that I'd share my comment I posted to his blog. Kim Cameron's cross-post was equally enlightenting: http://www.identityblog.com/2005/08/19.html

Let me know what you think? I will take a stab at developing a maturity model for identity and cross-reference it to Toby's model. I'll post it to this blog for public comments, especially the likes of Toby, Kim, Doc, Kaliya, et al. Imho, the industry needs to have these two strands of DNA (identity and privacy) laid out in a map that is digestable and realizable by society, business and governments, without having any individual give up the right to own his/her respective identity and privacy to sensitive information - either dynamic or static, as described in my earlier post......

So on to my comment to Toby's post at http://radio.weblogs.com/0146815/2005/08/22.html

Toby,

Great work on putting together the maturity scale. I believe calling it a maturity model for privacy is important. Privacy translates into protecting against access (authorized or not) critical, sensitive information, either owned by a person or a company that describes either a person or a company. In thinking about identity and privacy over the last 6 years, I have concluded that privacy follows from authorization which in turn follows from authentication. Knowing that privacy has been compromised results from monitoring access and reporting against unauthorized viewing by anyone, either authenticated or not. Authentication relies upon the proper verification of alleged identity - prove to the privacy guard who you are so that your profile can be assessed as to whether or not you have the appropriate rights to access that critical, sensitive information.

Therefore, with my understanding of how to convert identity into access to privacy, I would suggest an addendum to your maturity model:

1. Data Protection
Place the data under the strongest, state of the art lock and key, coupled to an authorization engine that converts identity to a profile and policies to access the data.

2. Authentication
This is the complete process of proving identity. Using a set of identifier acqusition systems, the alleged user steps through a number of challenges to prove his/her identity which requires a percentage of accuracy that matches the level of protection required for the information to remain private, i.e., for certain eyes only for a certain amount of time. This process requires tight coupling to the authorization and reporting/auditing in order for the information owners to know who is accessing what, when, where, why, and how. Once identity is assured (to a certain sigma - from six sigma vernacular), the authenication approval leads to the next section, data sharing. Effective authentication requires a federated identity management ecosystem to exist, where "trust" can be shared among organizations. In turn, federated authentication follows from the trust among these organizations, first from the point of view of culture, working processes, and finally technology. However, where in federation does the concept of fail-safe lie wrt authentication. How deep does that trust go, and how deep is it "programmed" into an organization's policies?


3. Data Sharing
This process actions the authentication approval or credential to a set of policies that govern the privacy. Now the system knows exactly who is requesting access, data sharing leverages the authorization policies to see exactly what portion, if any, of the privacy can the authenticated user access, for how long, on what display/device, during which time intervals, and at what location These are equivalent to the concept of considerations in traditional digital rights management. Moreover, the policies should have a section that assesses whether authenticated user and/or their role have the "right" to retain a copy, for how long, on what device/display/format, where to store, etc. An important aspect of data sharing is this retention policy. For example, the biggest problem today in consumer privacy issues is that the consumer is not aware who or what organization has what portion of their critical and sensitive information, how accurate are those copies, etc. More importantly, there is no mechanism for the consumer to automatically delete the information from these distributed datastores. Data sharing is about control and storage, and aging of critical, sensitive information by and to authenticated users.

4. Data Rejection
Imho, data rejection is a sub-process of data sharing since it is one of the "commands" that result from assessing the access profile of the authenticated user against the sought after privacy information. Anonymity is truly impossible if authentication of users to access privacy is effective. There is no room for anonymity in privacy data access; however, there are some uses in data sharing, not necessarily privacy, that do not require any or some identity verification and validation, e.g., accessing news sites, accessing free-websites that are offering free access to some product or service, etc. The real question is, "Can anonymity be realized in an all-digital organization, society, government? What place does anonymity have on the Internet?"


Toby, I do hope this helps. I am quite interested in your feedback. I am posting my thoughts on digital identity and privacy on my blog entitled, "Names, traits, and trails" at http://robmarano.blogspot.com. I welcome an open discussion on this.

Best wishes on the EPG. Please let me know how I can be of assistance. I know quite a number of people that would be interested in this both in the UK and the US! I spent almost 8 years in the UK working in infrastructure management in the City...

I totally support your efforts in the need and public definition of a maturity model for privacy and identity. You have my support! I'll start to disseminate this at my monthly meetings on the topics in NYC. I run the NY Digital Identity MeetUp. More info at http://digitalid.meetup.com/3

I'd love to hear your feedback...

Thanks for the opportunity to post to your blog...

Warmest regards,
Rob
--
(I-Name) http://public.xdi.org/=Rob.Marano
++
++ The NY Digital Identity MeetUp Group http://digitalid.meetup.com/3
++