« October 25, 2004 | Main | October 27, 2004 »
October 26, 2004
DIDW 2004: Identity for Us
The Identity for Us Panel
|
05:42 PM | Recommend This | Print This
DIDW 2004: Tony Scott on GM's Next Generation Outsourcing Model and its Affect on Identity
GM, through its first two generations of outsourcing, has achieved over $1 billion annual savings through consolidation and systems reduction. We are now crafting our third generation outsourcing model. $15 billion.
Tony Scott of GM discusses GM's outsourcing and digital identity strategies.
|
GM has a "legacy of many." We were the poster child for slow, inefficient, and costly. All that has changed. The evolution of IT in a company like GM is reminiscent of the Winchester Mystery House. The problem wasn't lack of architects and craftsmen, the problem was that Sarah Winchester lacked a plan. GM's identity infrastructure used to be the Winchester Mystery House of identity.
GM's first outsourcing effort happened when GM bought EDS. EDS essentially became GM's outsourced IT department. The was a very decentralized control of spending, no common identity system, no corporate governance. Cost was viewed by managers as "funny money." At the end of that period, GM had the highest IT costs as a percent of revenue of any car manufacturer.
In 1996, GM spun EDS out and a new IT management team was brought in. GM signed a 10 year master services agreement. GM spend about $4 billion/year with EDS in 1996, but now spends only $3 billion/year. Now GM is the lowest cost of it as a percentage of sales among car manufacturers. EDS doesn't have an exclusive contract enabling limited competitive sourcing. Governance was put in place.
In 2006, GM will open all their IT to the competitive market. GM's IT people currently manage 10,000 of contracts. The new model will reduce that number to a few dozens with hierarchical, prime contractor- subcontractor relationships. GM will have a global enterprise architecture and governance for identity allowing decentralized deployment and operation.
GM is so large that a system that is not federatable is unmanageable. It would be impossible to manage a centralized scheme for identity in this company. In the new model, GM will control access on an application by application basis and even a function by function basis rather than through a firewall.
An interesting addition in the new model: GM will require intellectual property indemnification from its contractors. This will flow through to subcontractors and suppliers. The industry is not set up to do this today.
Customs and traditions that people have in a particular country are an issue for a global company like GM. What identity means and how people feel about it affect relations with employees and customers alike.
GM does product development in dozens of countries. GM can now rollout an update to their iMan platform (digital product design suite) over a weekend due to common infrastructures. GM's product development used to take 5 years from concept to manufacturing. Now it takes 18 months. GM's new J-200 vehicle is engineered in 1 country, manufactured in 9 countries under 5 different nameplates and sold in 124.
Digital identity is the key. Required features: individual identity, permissions by application and by program, collaboration vs. protection tradeoffs, and common interoperable schemes for joint ventures, suppliers, and dealers. Identity is more than just people, its things as well. Parts of a car have identities.
Shifting focus to products. In 1970 a car had about 100,000 lines of code. In 1990, cars had 1,000,000 lines of code. In 2010, a typical vehicle will have 100,000,000 lines of code. Software and electronics now represent one-third of the cost of the vehicle. That's the largest single item.
OnStar is on its sixth generation in about seven years. That's unheard of in the automobile business. The software changes much faster than the vehicle its on. Cars hang around for tens of years. Software put into vehicles has to be supported for that period.
More than ever, people are clamoring for a seamless experience and that includes their vehicles. They want to integrate cell phones, MP3 players, and video devices with their cars.
02:01 PM | Recommend This | Print This
DIDW 2004: Enterprise Identity Management 101
I was asked to speak by Phil Becker and Eric Nolin in the first session after the keynotes and to give a tutorial on digital identity management. I promised the attendees that I'd post my identity management slides and a link to a tutorial I wrote on digital identity standards.
01:31 PM | Recommend This | Print This
DIDW 2004: Phil Becker on Management by Identity
Phil Becker opens Digital ID World 2004
|
You don't have to manage things until they're spread out. You don't have to worry about security until things are connected. Traditionally, we've been defensive about security, but defense can't win. Only offense can win. Digital identity is the common organizing paradigm for integrating, managing, and securing IT.
Why is the loss of lack of identity so disruptive? Because without identity, we have no ability to organize or control activity. Rumplestiltzskin taught us that identity is power. Identity allows relatively autonomous agents to identity each other, organizing interactions, apportions authority an d responsibility, and be held accountable. Identity is the framework for organizing.
Before the net, location was a proxy for identity. Access control was physical. There are no longer any proxies for the identity of the user. In a network, bastion perimeters are an illusion. You can't have a perimeter and be on the net. The perimeter must dynamically expand and contract to include mobile users. The perimeter must be porous and be opened up for more and more activities. Eventually, there are so many holes in the wall, that its no longer a wall.
Digital identity is more than
- Authentication
- Provisioning
- Access control
- Rights management
Digital identity is an organizing paradigm for distributed service oriented computing that allows it to dynamically adjust to the needs of each user. Identity management has been the first success story in digital identity. Identity management is about managing identity data and promulgating it properly. All about making sure identity data is reliable, current, properly synchronized, available, and easy to administer.
But identity management is just a step towards being able to manage by identity. This lets network computing become more dynamic while remaining accountable. Provision and web access control are early instances of management by identity.
The browser taught people the power of discovery and networking at the document level in real time. Web services and SOAs replicate this ability for applications and data. Grid computing, autonomous computing, and the like will have to be managed by identity.
Management by identity will allow computing to dynamically adjust to business and human processes, releasing new capabilities, productivity, and real-time application and data integration.
Identity management started out as a centralized identity store, then LDAP and x.500 moved identity management into a distributed architecture. This still wasn't good enough. We're moving to a decentralized architecture with delegated administration. That move is typified by the move to identity federation.
Identity federation is about loose coupling and scaled administration. Federation creates a framework for understanding the true nature of networked identity. Its not possible to pre-define all the ways users will want data and applications to be integrated. Business will require the ability to integrate on demand.
The portal is an early place where dynamic integration and management by identity is used. Portals perform virtual integration. The user's identity and needs, coupled with the policies of the application owners are the only organizing factors. management by identity is the only mechanism that honors the incentives of all the parties involved.
Regulatory compliance is a forcing function that drives the need to manage by identity. They all ask "who did what with which data when?" or "prove that someone did or did not do something." Doing this manually is nearly impossible. Identity centric techniques are the only ones that can keep up with the increases demand for auditability.