Rapid-fire funding of identity companies continues with SignaCert...quoting:

SignaCert, a service provider that enables trust-based computing for enterprises everywhere, announced today that it has secured $10 million in Series A funding from DCM-Doll Capital Management, Intel Capital, SmartForest Ventures and Garage Technology Ventures.

Two other bits of news that caught my eye this morning:

1. Fischer announced Roundy's Supermarket as a customer.

And - look!

2. Actimize has now firmly joined the identity dance.

BMC's .NET announcement is followed a services ecosystem of system integrators and professional services:

Optimal IdM Partners With BMC Software to Provide Identity Management Solutions for Microsoft.Net

ILANTUS Announces Services in Support of BMC Identity Management for .NET

I consider this announcement to be significant. I know from interacting with enterprise folks that there is a need for IdM in a .NET world - especially when it supports the out of the box functionality of AD and ADFS.

It would seem that such a product aims at the 2-5 thousand person shop -- a sweet spot for Microsoft's midsize business products, and word on the street is that the Microsoft's sales channel will be pushing this as well...

You'd have to figure that if there is a market here BMC will prove that out fairly quickly (and you'd think they already know via good product marketing research -- or so one would hope ;-). And if there is a market, BMC should have a good nine months (typical product development cycle) before any real competition appears...

...very interesting...

How about a strong auth vendor you've never heard of?

Try Bharosa - multi-factor online authentication, and they just signed a deal with the U.S. Air Force...

No, not the digital kind - the kind that deals with identity management and physical access...

Perhaps this topic is heating up...

Just the other day, I was saying to someone that I couldn't believe their corporate environment still forced them to use LotusNotes. I mistakenly thought that Lotus was a company that happened long before Ray Ozzie sold Groove to Microsoft ;-)

Well, silly me, not only is Lotus still going (see LotusSpere) - as it turns out, there are *identity* products for Lotus:

PistolStar has Password Power - an LDAP SSO mechanism for Lotus

and

HADSL has the Federated Identity and Resource Manager -- a delegated administration tool for Lotus Domino...

...the federation piece is what surprised me a bit - I mean, federated identity is a bit of a new thing, so having a Lotus module for it was what caught me off guard......but at second-glance, it doesn't look to be standards-based...

From eWeek:

The Internet is becoming an ever-growing scam trap for Americans, with nearly half of the fraud-related complaints filed with the FTC last year having to do with online activities and accounting for $335 million in losses to consumers. Major traps include auctions, shop-at-home offers, sweepstakes and lotteries, and the foreign money offers that plague nearly every e-mail in-box.

E-mail, according to the complaints, is the communications medium of choice for fraudsters. Last year, 35 percent of the complaints stemmed from contact made initially through e-mail, up from 26 percent in 2003. The percentage of complaints stemming from phone calls remained at 17 percent over the past three years.

Yes - its precisely what you would anticipate - Iris scans to positively ID adults that want to access the school to pick up the kids....You can read more here, but the thing that really interested me was ALL of the vendors involved in making this work:

Eyemetric Identity Systems
LG Electronics
Iridian Technologies
Tailgate Detection
HP servers and desktops (running AMD)
and ProCurve networking

...a nice detail of the stack that's needed...

You've probably noticed that I've been "highlighting" companies in this space -- which is to say I've been linking to them and saying "ever heard of them?" -- mostly because I'm betting that a lot of people in the "digital identity" space haven't.

And you've also probably noticed that (as predicted) the talk around Strong Authentication (especially in the FFIEC context) grows and grows...

As such, today's "highlighted" company:

Vasco - "the authentication company"

No, its not some nefarious program being run by Big Brother....its the growing idea that *physical* (often called "logical") access should be placed on a network and controlled via identity management's access control and provisioning components....ie, a convergence of physical and electronic access control.

Several years ago, we tried to have a session about this at Digital ID World, and it kinda fell flat -- maybe its time has come ;-)

Quoting:
Lenel has worked on physical security for various agencies, including NASA, which Regelski says is furthest along in integrating physical- and logical-access control.

Experts say physical-security staffs don’t have a lot of experience with IT and are understandably nervous about putting their systems on a network. When physical-access control systems ride on an IP network, they become vulnerable to hackers, viruses and other security risks.

One of the first guys that Phil ever interviewed in the Identity space was Drummond Reed -- a guy that's been laboring around the idea of identity for over 10 years, and the creator of XRI/XDI...

Drummond has now commented on Bob Blakely's recent (and brilliant) post. Drummond takes Bob's thoughts and relates them to an Identity Rights Agreement.

Yes - we, at Digital ID World, agree with this analysis:

2005 saw significant activity in the identity management market, driven by a combination of factors, particularly regulatory compliance, SOA approaches, growing concerns about identity theft and national identity card initiatives. The leading infrastructure, application and enterprise management vendors responded, with the likes of BMC, HP and Oracle, following the likes of CA, IBM and Sun, and acquiring identity management specialists in 2005 to bolster their capabilities in the enterprise market. At the same time, we saw ongoing development in grass roots identity initiatives such as Light-Weight Identity (LID), OpenID and Yadis (Yet Another Decentralised Identity Interoperability System!), together with offerings from vendors such as Sxip Identity, all focussing on user-centric identity. The Liberty Alliance continued its work on federated identity standards, converging its work with that of OASIS with SAML 2.0, and branched out into other areas, such as strong authentication and social networking. IBM and Microsoft, meanwhile, continued to evolve the WS-* identity specifications, submitting WS-Trust, WS-SecureConversation and WS-Security Policy to OASIS.

2006 will see no let-up. Acquisitions will continue in the enterprise identity management market (with SAP entering the fray), as the major vendors look to fill out their “suites” with federation, strong authentication, role-based access control and virtual directory capabilities. These vendors will continue to position their suites as more comprehensive, integrated and so forth, whilst feverishly working behind the scenes to ensure that the technology lives up to the promise. The sterling work initiated by Kim Cameron of Microsoft with the “identity metasystem” will continue with the growing realisation of the need to bridge the gap between enterprise and user-centric identity. The dual paths for federated identity standards will (sadly) persist, with the WS-* family receiving a boost as Microsoft customers begin to adopt Active Directory Federation Services as part of the latest Windows Server 2003 service pack and InfoCard materialises as part of Vista towards the end of the year. IBM has a foot in both camps, which together with the “identity metasystem”, holds some promise for convergence/interoperability.

;-)

The hot story is the whole DOJ wanting Google's search records around some porn sites (Microsoft, AOL and Yahoo already complied) -- and here we are staring an identity problem in the face again.

The government is claiming they want to prevent A) kiddie porn from being distributed and B) they want to prevent kids from accessing porn......the only way to accomplish either of those with any reasonable control that doesn't cripple the web is Identity.

See, I told you there'd be news at the HIMSS show...

;-)

Yes, you read that correctly -- though it is a bit of a misnomer....basically, Google is creating (or allowing) federated network of IM, and (eventually) VOIP.

Identity-based? certainly.
Identity-rich? absolutely.

I turned around and found another identity company:

Secured Services is (quoting) "a leader in identity management and secure network access software and services..."

well, there ya go. ;-)

The acquisitions continue as GeoTrust has purchased TrustCenter - a European smart card vendor.

Quoting:

The deal gives GeoTrust a major foothold in the European market, where TrustCenter's smart-card products are used by 3,500 businesses, including SAP, Siemens, Airbus and Halifax Bank of Scotland.

Take an auditing and monitoring solution and mix it together with an application access control solution and whadya get? A vertically targeted identity solution.

See the press release for a bit more information.

By the way, if EpicTide's CEO sounds familiar to any of you, he should -- he founded OpenNetwork, an identity company that was sold to BMC Software.

Welcome back, Kurt. ;-)

Wanna know where the identity news is this week? Go check out the HIMSS conference and expo. HIMSS is the Healthcare and Information Management Systems and Socieity -- and its where identity is connecting with the healthcare field (and HIPAA compliance).

Companies like Sun, Courion, Cisco, Juniper, AEP Networks, Ping Identity, Sentillion -- they'll all be there. We'll see if we can dig up some news for you ;-)

Okay - maybe not "new" - but companies I either A) haven't highlighted here before or B) haven't heard of before.

Passfaces - a strong auth company

Purisma - customer identity management (think CRM with a IdM spin)

Paoga - personal digital identity company

See what's happening? the expansion of the market is continuing. Purisma is interesting because its taking an identity approach to B2B customer management. Passfaces is in the now constantly-growing strong auth market. Paoga appears to actually have a business in the "personal" digital identity market.

Bob Blakely's a smart guy.

And now, he's writing *very* thoughtful posts about Kim's laws.

This first one ends:
Remember the wording of Kim's First Law:

The reason the First Law doesn't work is actually very deep and subtle, and I'll write more about it soon. But I'll leave you with a hint. The nub of the problem with the First Law is the assumption that privacy is based on secrecy.

Everyone please welcome John Patrick to the Identity party!

"In the second FutureScan session, Mr. Patrick will delve into the concept of a secure Internet, determining how we can build a trusted Internet as a backbone for commerce and information exchange despite hackers, phishing, and identity fraud."

You're going to see this over and over and over again -- people and niches that weren't into identity are going to suddenly wake up to its importance. We're still sorting through all of the reasons for "why this year" - but its obvious that this will happen this year -- DRM, blogging, search, etc.

I watch CNBC incessantly (have for years)....I just heard Bertha Combs reporting from the Nasdaq marketplace mention that --

"Identix is up on the merger with Visage -- they work in that biotechnology security area."

really? huh. ;-)

It was at Digital ID World 2005 that Jamie Lewis (CEO of Burton Group) and I had a hallway chat wherein I argued that we'd see "hosted" identity management and he argued that the data was too sensitive and it wouldn't happen.

I've stood by my position (I don't know if Jamie's changed his mind -- Jamie?), so I'm feeling a little more emboldened when I find Agistics and their "OnDemand Accounts", or hosted provisioning.

Interesting company (folks from big enterprise software and 2mm in funding)...

(for the record: we love Jamie - he's been keynoting our show from Day One, even when he told us that he didn't believe the "identity market" was big enough for its own show, he still keynoted....And he'll be at this year's conference as well.)

We've had a slew of acquisitions, so isn't it about time we had a good, old-fashioned, merger?

Identix and Visage have announced just that -- in an all stock deal worth 770 million. The combined companies expect to have revenue of 220 million....not bad at all ;-)

Step One: Go to the Atlantis resort in the Bahamas on vacation.
Step Two: Have Atlantis compromise 50,000 identities of cusomters.
Step Three: Spend months monitoring your identities and years putting them back together if fraud occurs.

Makes you wanna not take vacation, doesn't it?

My morning routine is pretty steady: rise, walk doberman, make coffee, fire up the RSS reader, check email, blog. Post all of that, I can actually get things done.

In the course of that routine, I've become a *very* regular reader of two blogs - Mark Dixon (of Sun) and Know Identity (mostly, Ian Glazer over at Trusted Network Technologies). This morning, I'm reading about --

TNT's MacWorld announcement - which I think is significant because Ian is right -- ID Management should leave no one behind and Mac support does count.

and

Mark Dixon's great graphic - "the Identity Grid" - what a succinct way to understand enterprise identity management (enlarged version here).

Every now and then, I accidentally learn something new ;-)

I made a concerted effort to get smarter on what's going on over at YADIS -- more on that later -- and while I was there, I discovered "Yoke."

Yoke is an "identity broker for the masses" that's written on Ruby on Rails...

Momentum is kinda like pornography: i can't define it, but i know it when i see it....something's happening with URL-based identity in 2006. I can see it.

YAIC -- "yet another identity company (that you probably haven't heard of)":

IDFocus

Is it just me, or is this whole identity industry just taking off? ;-)

Just as we've been pounding the DRM drum for a while, we've also been consistently talking about the "identity of things." Essentially, the initial thesis of Digital ID World was that the "network" needed an infrastructural layer of identity. That identity covered not only people (attributes, authentication, access, etc), but also things.

This is, of course, seen in things like RFID, Network Access Control, Provisioning -- all of which are about managing things in the network - by Identity.

And then I read this.

Do you suppose that "environmental compliance" - namely, having an audit trail on things - will become a major driver for the identity of things?

This post by David Berlind makes me soooooo happy. Why, you ask? Simple. Since the beginning, we've included DRM in the Digital ID world conference schedule.....largely to blank stares. We've watched DRM shows come (and mostly go) - and they *never* saw the forest for the trees (and I'm going to say this loudly):

DRM will always be badly done to the extent that it is NOT based on identity.

Needless to say, seeing David write about DRM (though he takes a bit of a different stance than I do) makes me very very happy. Come to think of it, Dave Kearns was writing about it the other day too -- has it finally become the year for DRM??

Someone add DRM as a major topic in the Digital ID World conference schedule!

This is a really interesting article. In it, David Clark (one of the elders in the Internet protocol world) talks about what he believes is the Internet's fatal flaw -- the lack of built-in security.

Now what he actually means when he says security is "the user not authenticating to the network" -- ie, identity.

Some quotes:
At the same time, the Internet's shortcomings have resulted in plunging security and a decreased ability to accommodate new technologies. "We are at an inflection point, a revolution point," Clark now argues. And he delivers a strikingly pessimistic assessment of where the Internet will end up without dramatic intervention. "We might just be at the point where the utility of the Internet stalls -- and perhaps turns downward."

Just such an approach is now gaining momentum, spurred on by the National Science Foundation. NSF managers are working to forge a five-to-seven-year plan estimated to cost $200 million to $300 million in research funding to develop clean-slate architectures that provide security, accommodate new technologies, and are easier to manage....

Now, I'm of the opinion that we don't need to "start over" -- I think we can get there from here. It'll be messy, of course - but it can be done. Starting over sounds -- well -- like a opportunity for too many constituencies to screw up way too much about the Internet.

By committee, innovation rarely occurs. (end yoda voice)

All of the "identity gang" conversations started on the Gillmor Gang (a little over a year ago)....and Steve has posted "Identity Gang II"....Check it out.

In case you haven't heard (or seen), Digital ID World will be held September 11-13, 2006.

Bottom line: we spoke with our constituents, and they told us (flat out) that they wanted us to the return the show to our original fall timeframe.

They asked, we listened.

And, to get everyone planning ahead, we announced our 2007 dates as well -- October 8-10, 2007 in San Francisco.

Steve Ballmer gave an interview. Steve Ballmer's a very busy guy. I don't expect Steve Ballmer to understand the intricacies of digital identity.

However, I will use his language to illustrate something. He says (and I quote):

I think that what people are saying to us is, "What is the full complement of service capabilities that you'll make available to us as developers up on the Web? How does that let you integrate with important applications offerings that you have, Microsoft? How does it let us do our own service offerings, whether it's the stuff that we're doing with mapping or calendars or identity or mail or IM and presence?" There's a whole bunch of these services, and people are really saying to us, not how flexible, but how quickly are you going to let us add in, and what's that going to look like -- and we're moving as fast as we can.

Now does he mean that identity is a service? Or does he mean its an application? Either way, isn't he saying its a service or an application?

My nitpick: Microsoft (especially) should see identity as infrastructure. There are identity management applications. And I'm sure that someday we'll see identity-based services. But I really hope that Microsoft see identity as infrastructure -- seeing it that way means they understand the foundational importance. Not seeing it that way means they don't.

From what Ballmer said, it would appear they (as a collective organization) don't - though I know there are lots of people inside that do.

Looks like we have more work to do on this one...Steve Ballmer really needs to come to Digital ID World so he can get the full story ;-)

Diamelle Technologies - add them to the list of companies that isn't on a lot of normal radars that are doing interesting things and releasing products....

Johannes asks why we see URL-based identity stopping "just short of critical mass" -- for some explanation, as it were.

"Predictions" are part reason, part tea leave reading, part gut and part hedging.

With that in mind, while I think URL-based identity will make a lot of progress this year - I don't think it will be the "final" solution. I can see lots of ways that it solves problems in the social software world -- which is why I say its "just short" of critical mass.

Here's one you don't see every day: A midsize system integrator acquiring a regional SI - for their identity management capabilities.

Is it a sign that Identity deployments are filtering out of the Fortune 200 and beginning to leak into the Fortune 2000?

It seems the Liberty Alliance has elected some new officials....

H&R Block did a mailing of their software to customers - and put the individual's SSN in the mailing tracking code ON THE LABEL!

Yes, i'd call that a "marketing error" -- yikes.

I'm becoming increasingly convinced that companies should not store data that they do not absolutely need (they can use it, but not store it). Perhaps we need a piece of legislation banning the use of SSNs for identifiers in all cases except employer filings with the IRS....

Radovan has posted some really good predictions for 2006.

Go read it, folks...

First, I saw this article (which is your typical "spending priorities for 2006" article), but then it pointed me to this company -- and what do you know, another identity company!

Now, they speak about mutual authentication, securing network transmissions and key management (you know, *exciting* stuff ;-), but, trust me, they're an identity company --- everyone, say hello to 2factor.