Oracle launches identity governance project

Oracle on Wednesday announced a new project to tackle one of the thorniest problems facing enterprises: the proliferation of sensitive identity information across enterprise networks.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

The Identity Governance Framework is an initiative to develop specifications for sharing identity data across heterogeneous applications. The project has the support of identity and access management (IAM) vendors Ping Identity, Sun Microsystems and Securent, as well as CA and Novell. The framework and will eventually be turned over to a standards-setting body, according to Amit Jasuja, vice president of product development for Oracle's security and identity management products.

The Identity Governance Framework (IGF) grew out of Oracle's efforts to integrate identity and access management technology it acquired from Thor Technologies, OctetString and other companies, Jasuja said.

"We realized that a solution that just works with the Oracle stack is not what customers need," he said.

Instead, problems such as lost data on laptops and identity theft point to the need for overarching standards that govern all the sensitive data squirreled away in data repositories across an enterprise, such as human resources, customer relationship management and custom-built internal applications. Oracle estimates that between 60 and 80 percent of sensitive data reside in these kinds of repositories, rather than in better protected enterprise databases, he said.

"Finding out where all that information is turns out to be a huge forensic exercise," Jasuja said. "You have to root through every application repository and application logic and code to figure out how the [sensitive data] is being used."

IGF addresses that problem by establishing a governance model that allows organizations to create "contracts" between applications and repositories of identity data. The model would cover how data flows within an enterprise and outside the enterprise to supply chain or business partners, he said.