2015 Identity Summit - Stepping Up to New Data Protection Challenges

Editor's Notes

• #2: Abstract: Existing notice-and-consent paradigms of privacy have begun to fail dramatically – and the EU Data Protection regulatory regime is shifting in response. Providing genuine and free choice in consented personal data sharing will no longer be optional – but fortunately, enabling consumer-controlled data sharing from cloud, mobile, and IoT sources is also good for your digitally transformed business. In this session, learn about how ForgeRock’s new solution based on the User-Managed Access (UMA) standard builds trust and strengthens privacy in the digital world.
• #3: Great, your organization is ready for digital transformation so you can achieve breakthrough growth or other key metrics. Even if you manufacture outdoor clothing, it’s not a world solely of atoms anymore. Bits matter. Your customers want to know how you can enable smart tracking of fitness and location through your products. Your supply chain partners increasingly connect through APIs. Your IT processes shifted off paper long ago. So: Are you ready for all of the implications of digital transformation on your handling of personal data and how this affects both your customer relationships and your mitigation of risk? ---- Image source: https://www.flickr.com/photos/48746111@N04/4466093934 | CC BY-SA 2.0
• #4: Great, your organization is ready for digital transformation so you can achieve breakthrough growth or other key metrics. Even if you manufacture outdoor clothing, it’s not a world solely of atoms anymore. Bits matter. Your customers want to know how you can enable smart tracking of fitness and location through your products. Your supply chain partners increasingly connect through APIs. Your IT processes shifted off paper long ago. So: Are you ready for all of the implications of digital transformation on your handling of personal data and how this affects both your customer relationships and your mitigation of risk? The Safe Harbor provision just died, demonstrating that… Surveillance – which we can no longer deny exists – overrides traditional permitted bases for data transfer, leaving us to conclude that… Individual consent, in the sense signaled by the forthcoming EU GDPR, will become the only bulletproof basis for international data transfer ---- Image source: https://www.flickr.com/photos/48746111@N04/4466093934 | CC BY-SA 2.0
• #7: In fact, UMA is built on top of OAuth. But typical profiles of OAuth solve a somewhat simpler problem. Here are some features UMA adds to the picture.OAuth in its typical deployment models solves for person-to-self sharing (that is, Alice is the person using both the client app and the resource server app).  Grants access by consenting to terms at run time You grant access to apps operated by you The authorization function is effectively local to resources
• #8: In fact, UMA is built on top of OAuth. But typical profiles of OAuth solve a somewhat simpler problem. Here are some features UMA adds to the picture.OAuth in its typical deployment models solves for person-to-self sharing (that is, Alice is the person using both the client app and the resource server app).  Grants access by consenting to terms at run time You grant access to apps operated by you The authorization function is effectively local to resources
• #9: UMA, in addition, solves for secure person-to-person sharing and person-to-organization sharing. You can grant access to apps operated by anyone You can control access to any type of web resource
• #10: You can grant access by setting policies and terms ahead of time - OAuth authorizes sharing connections mostly based on simple authentication by the requesting side (client). UMA allows a user to craft policies that drive fine-grained claims-based authorization decisions, including getting the requesting party to make promises or have a third party make attestations on its behalf.
• #11: You can delegate scope-constrained access
• #12: The authorization function is standard and centralized Sharing connections can be managed, controlled or revoked Think: http://www.applehealthkit.com/ ***
• #14: Show recorded video (can be downloaded from here: https://drive.google.com/open?id=0B5Q4evmm_OOCN050RWtGSFhnV3c&authuser=0 )
• #15: The UMA architecture has these three pieces. ForgeRock will deliver the two key pieces on the top in order to help you protect your API/application (policy enforcement points) and let your users set up sharing preferences (policy decision point).
• #16: Show recorded video (can be downloaded from here: https://drive.google.com/open?id=0B5Q4evmm_OOCN050RWtGSFhnV3c&authuser=0 )
• #17: The UMA architecture has these three pieces. ForgeRock will deliver the two key pieces on the top in order to help you protect your API/application (policy enforcement points) and let your users set up sharing preferences (policy decision point).
• #18: The UMA architecture has these three pieces. ForgeRock will deliver the two key pieces on the top in order to help you protect your API/application (policy enforcement points) and let your users set up sharing preferences (policy decision point).
• #19: The UMA architecture has these three pieces. ForgeRock will deliver the two key pieces on the top in order to help you protect your API/application (policy enforcement points) and let your users set up sharing preferences (policy decision point).
• #20: If you’re trying to deliver online financial services, to support small businesses or tax reporting, these scenarios are filled with requirements and opportunities for delegating access to others. An employee wants to give her accountant access to her last year’s earnings statement, or a sole proprietor wants to give his contract bookkeeper selective access to some accounts. Recently we saw a story in the news about Audi enabling package delivery to parked unattended cars. Any car with an API could have that, if car owners could selectively enable access by others. Citizens traveling across borders and those trying to access government services often have reason to authorize access by others to attributes about them, such as their financial status, to enable access to government services. This shouldn’t just be a matter of passive consent; it could be a matter of a long-running relationship. Why is the AirBnB logo here? Imagine that you have a house chock-full of smart light bulbs and kitchen appliances made by different manufacturers. You’ve set them all up to work the way you want. Now you leave for a week, and you rent your place out through AirBnB. You want to give partial access to a partially trusted stranger, but only for a week! And then you want all the entitlements to expire. You’d better be able to do this conveniently from a single console. Patient-centric, RESTful health data sharing is the focus of the demonstration we’ll show next.
• #21: ForgeRock leads the industry in identity research, development, and solutions that put the customer at the center of your business. We have been moving aggressively to build innovative consumer-focused access management and privacy solutions based on the newly completed User-Managed Access (UMA) Version 1.0 standard, an effort led by our own Eve Maler, VP of Innovation and Emerging Technology in the ForgeRock office of the CTO. UMA was designed to give an individual a unified control point for authorizing who and what can get access to his or her personal data (such as contact information), content (such as health records), and services (such as access to a fitness API), no matter where the data lives online.