In the context of a very productive discussion with NHS England colleagues, I keep looking for good references and ideas to support Enterprise Architecture governance. The basic framework is clear, considering we have great materials to guide us like the TOGAF standard; but as we progress in the conversation, it becomes increasingly clear that some … Continue reading Enterprise Architecture and Identity Management

Information Technologies are fundamentally empirical, and Information Technology **Management** is even more so. In our professions it is challenging to speak of Principles, because of the ever-present drift towards immediate and reactive solutions. How many times have we heard a comparison of Enterprise Architecture with the "nice to have" or some remote "aspiration"? Sadly this … Continue reading Principles in Enterprise Architecture

Too frequently  technology assumes either Identity is not a problem or Identity data issues won't be ever addressed by organisations. The #identity technology market is small, innovation is very limited too, and speaking of data control few companies really "get it." Very few vendors understand the difference between managing and auditing Identity data and controlling … Continue reading The Techno-Centric "blind spot" and the Next Level of Intermediation

In the past few years an interesting exchange of opinions has been taking place between Larry Ellison and Marc Benioff, respectively CEOs of Oracle Corporation and Salesforce.com. This debate was summarised by Bob Evans writing in Forbes Magazine. (1) Computerworld and InformationWeek carried at the time good descriptions of the discussion. (2)& (3) I had … Continue reading After The Clouds

The simplest way to appear “on top of your subject” is to avoid contradictions when you speak. It does not matter if you know your subject, for in a generalised Services Economy there are hardly any standards. When presenting something, just be consistent and utter tautological implications. For example: “We need a consistent plan to … Continue reading The Cloud is (not) what I say it is (not)

In May 2003, Nicholas Carr predicted the end of Corporate Computing: "Something happened in the first years of the 20th century that would have seemed unthinkable just a few decades earlier: Manufacturers began to shut down and dismantle their waterwheels, steam engines and electric generators. They no longer had to run their own dynamos; they could … Continue reading What IT does not do (never did, and never will)

The Identity and Access Management Architecture defines three layers of I&AM processes. These are essentially business processes engineered to provide centralised user management, access control, account lifecycle management and security policy compliance. The three layers are: 1.IDENTITY INTEGRATION: Identity Data Governance, Identity Validation, Role Engineering, Directory Integration and Directory Rationalisation 2.ACCOUNT LIFE-CYCLE MANAGEMENT: Authorisation Workflows, … Continue reading I&AM Programme Layers

The Circle of Trust for Information Systems Security The philosophy behind these pages and the I&AM Reference Architecture is based on the idea of the “Circle of Trust”. In this context, “security” is interpreted as the definition, the establishment, the enforcement and the verification of trust. (Reference: John Arnold, Information Security Bulletin, 2006). The I&AM … Continue reading Security Perspectives