Digital Identity

Preface

In late 2000, Governor Michael Leavitt of Utah asked me to serve as his CIO and a member of his cabinet. Governor Leavitt had a strong belief in the power of e-government to transform government operations and thought that my private-sector experience as CTO for an early e-commerce start-up, http://iMall.com, and then as vice president of product development at Excite@Home was just what was needed to help build e-government in Utah.

I spent almost two years working on that vision and building an infrastructure to support it. While I was CIO, I struggled to learn how to build flexible, interoperable infrastructure in a large, loosely coupled organization. Many of the issues we faced, such as privacy, naming, directories, authentication, and digital signatures, were identity issues. Many more of them were about how to execute an enterprise strategy in a decentralized organization. State governments are not alone in those challenges.

I have a deep respect for the power of digital identity, and I am convinced by my experiences in e-commerce and as CIO that digital identity was a foundational element in modern IT systems. I can't imagine an agile, business-responsive IT infrastructure that doesn't have at its core a flexible, interoperable identity infrastructure.

Not long ago, Doug Kaye sent an email to a group of folks that said, essentially: "The world needs a book on digital identity. Would any of you like to write it?" I thought that sounded fun, and this book is a direct result of Doug's question.

Throughout this book, you'll find stories from my experiences as a CTO and CIO that illustrate identity concepts. Interestingly, when I had those experiences, I wasn't usually thinking about digital identity. Consequently, I was surprised to find that many of my past experiences were directly related to the subject of this book. In relating these experiences, I don't want to take undue credit for what happened. Literally hundreds of people participated in the experiences I relate, and I'm grateful that they did. I learned a lot.

Who Should Read This Book

This book is designed to familiarize CIOs, IT managers, and other IT professionals with the language, concepts, and technology of digital identity. As I said, I believe that managing digital identity is one of the most fundamental activities in IT and that a good identity management strategy is the key to not only protecting the enterprise from attack, but, more important, providing flexible access for partners, customers, and employees to needed information and systems.

The concepts in this book apply equally well to a wide variety of organizations. While this book primarily talks about digital identity in the context of business, the concepts are as applicable, and opportunities as great, for non-profit groups and government agencies. As I mentioned, my experiences cover the public and private sectors as well as large and small organizations. When I use the word "enterprise" in this book, I mean any business or organization—for-profit or not. The term can even apply to business units, provided their decisions about identity are relatively independent from other business units in the larger organization.

This book is not a book with code examples and recipes for building digital identity management systems. Even so, it is a technical book that explains the technology of digital identity in some detail. More importantly, the book puts the technology in context and shows how it can all be put to the task of managing digital identities inside your organization.

The book is divided into three sections. The first section is about the core concepts in digital identity, including privacy and trust. The second section discusses the technology of digital identity. The third section portrays in some detail a process, called an identity management architecture (IMA), that you can use to build a digital identity infrastructure in your organization, regardless of its size or organization. The information in the last section is prescriptive in nature. Because of my experiences, I have a clear philosophy on how to build an IMA. I present a rather a detailed series of steps that show how to create an IMA and how to use it.