the philosophical architect

Windows 7 and Cancer Research: A Very Cool Combination!

CurtD1 — Wed, 30 Jun 2010 18:58:31 GMT

At a recent Microsoft event, a solution for the computer-aided diagnosis (CAD) of colon cancer was demonstrated on Windows 7, using a hi-resolution multi-touch display. This demonstration makes it possible to navigate 3D, electronically cleansed images in a very natural and highly efficient way. No keyboard or mouse is necessary. CAD on W7 is part of a complete solution under development that will construct these 3D images from CT scan slices and then execute a very high performance screening for pre-cancerous growths called polyps. How cool is that? Very cool indeed!

Patrick Samona from Vectorform demonstrates 3D multi-touch navigation on Windows 7 at the Healthcare Solutions Showcase Event on June 15 in Boston.

Without question, the coolest part of this demonstration is that it provides an invaluable tool in the fight against the second leading cause of death from cancer. This disease is 100% preventable, but on average, about 6 people die from it every hour. Better and faster software can make a difference. Maybe it’s just me, but I think helping to save as much as 52,000 lives a year (in the U.S. alone) is a very cool development.

Windows 7 and .NET 4.0 provide some key elements of this solution. First, very clear, hi-res images are essential for accurate diagnosis—even for a highly trained doctor or radiologist. Diagnostic images must be crystal clear and very precise. Secondly, being able to manipulate and navigate this type of image with multi-touch interaction is extremely valuable. If you doubt it, try exploring a 3D image using your mouse instead. This is painfully awkward for even the most well thought-out set of controls. But with multi-touch, on the other hand, rotating a 3D volume, zooming into its depths or flying around areas of interest can all be accomplished with ease. Not even a perfect physical replica could provide the diagnostic ease-of-use, the ability to adjust lighting and shading, angle, distance, transparency or color enhancement the way that you can with a very high-quality 3D digital image and touch navigation. Until the Star Trek holodeck becomes a reality, this is about as cool as it gets.

Another very cool aspect of this solution is that it incorporates the combined expertise and contributions from a truly remarkable array of partners in close cooperation with one another. These contributions include the medical research, algorithms and expertise of the 3D Image Analysis team at Mass. General Hospital (MGH). It includes help and expertise with high performance computing from Intel (yep, this project has Intel Inside). It includes an ultra-fast, highly-scalable volume rendering engine built by Microsoft Research. And, of course, the UX expertise of the Health and Life Sciences practice at Vectorform, who put the multi-touch interface together. Tell me this is not cool!

If that’s not enough, last week this solution was demonstrated at the Summer Project Week at the National Alliance for Medical Image Computing by the MGH team to considerable interest and excitement. You know that this audience is taking the solution seriously when someone asks if you can do multi-touch with surgical gloves on. Is that cool enough for you?

Yin Wu, Ph.D. and Computer Scientist at the 3D Image Analysis Lab at MGH presents on Volume Rendering for Virtual Colonoscopy using Windows 7 and multi-touch at the NAMIC Summer Project.

As you can probably guess, many elements of this solution may prove valuable in many other medical solutions. So, in case you are wondering if there is a really cool application with astounding 3D rendering capabilities and multi-touch interaction that could actually help to save thousands of lives each year, I can tell you there IS an application for that—and it runs on Windows 7. It’s your PC (and a whole lot more) simplified.

S+S and Connected Health

CurtD1 — Sun, 28 Mar 2010 20:41:47 GMT

Maybe no one will be astonished if I claim that computer hardware and software are becoming first class citizens in the arsenal of medical research, disease control or patient care. This proposition becomes a little more interesting if I point out that, increasingly, some of this software and hardware will take the form of a Windows PC in the patient’s home, along with some commodity hardware devices that plug into a USB port, along with the device drivers needed to connect to them. This technology makes uploading reliable, objective healthcare data just as easy as uploading pictures from a digital camera to Facebook. In fact, Microsoft provides some software to upload these statistics to a place in the cloud where doctors can collect and monitor them. It’s called HealthVault—hmmm…maybe we should have called it Healthbook instead.

Thanks to the Center for Connected Health (CCH) at Partners Healthcare, this technology may become part of one of the most important healthcare innovations of the 21^st century—connected health. The CCH has developed its own a solution called Connected Health Care Suite (CHCS) that uses HealthVault but takes it to the next level. By moving patient health data out of HealthVault and into the hands of doctors, CHCS puts this data where it can do some real good. It seems that for the aging baby-boomers connecting doctors and patients in this way addresses one of the biggest healthcare challenges we face in the near future. Despite the current political hoopla about the cost of healthcare; capacity will be a very big problem too—one which can have a huge impact on cost and patient outcomes alike.

To see what I mean, take a look at type-2 diabetes—sometimes referred to as adult-onset diabetes. Most people who have diabetes have the type-2 kind. As the name suggests, this form of diabetes tends to have an onset as a people get older. In 2002 the National Diabetes Clearinghouse (NDIC) estimated that about 16M in the US have diabetes and it cost in excess of $107B. By 2007, these estimates were revised to 23.5M and more than $174B in cost. Can you spot the trend here?

When you consider that diabetes becomes more prevalent as the population ages and that the aging segment of the population is growing itself—due to the baby-boomers who are fast approaching retirement age—you begin to see why it will create very serious challenges for the capacity of our healthcare system. But there is more.

Due to the nature of diabetes, the amount of care and management also tends to increase dramatically because older people produce less insulin and tend to suffer more symptoms, side-effects, and complications from this disease. In short, they require more care and attention as they age. As scary as this sounds, make no mistake; there are other serious chronic health issues that follows this pattern. Hypertension, obesity, and heart disease follow a similar pattern.

Fortunately, the folks at the Partners CCH are onto this problem and they are pioneering a very promising approach to address it. CHCS is based on the simple but powerful idea of regular, accurate monitoring of key patient vital statistics right at home. In the case of diabetes, for instance, a patient can automatically and routinely upload their blood sugar level using glucometers that are already familiar to them. When this data arrives at CCH, it can be analyzed for trending, rules can be applied, and a timely phone call to a patient can be made if necessary. This is truly “a stitch in time” approach that is already showing great promise, substantially reducing the need for costly home visits and hospital readmissions, as well as improving outcomes for patients with chronic conditions like diabetes.

In addition, CHCS provides patients with access to a reliable source of information tailored for educating and empowering them to participate in the management of their own health. This remote collaboration between doctors and patients means fewer patient health crises; and most importantly, better overall patient outcomes in these long term care scenarios.

HealthVault and the HealthVault Connection Center provide an important supporting technology for the CHCS solution. Together they provide the hub-and-spoke architecture, a central repository for collecting patient data safely and privately. Without these technologies, the CHCS development team would have had to worry about device drivers needed to ensure device compatibility. They would also have had to worry about the deployment and support of data collection software, as well as the infrastructure for data collection, storage, and transport safety. With HealthVault in the picture, they were able to focus their energy and attention on delivering data to both new and existing systems within Partners Healthcare, where it could be used immediately to deliver real care, based on measured information supplied by patients. You could say that CHCS promises to help conserve our capacity for in-patient care encounters that are truly necessary or unavoidable—a very good thing for everyone.

Although HealthVault played a key role in this story, the software-plus-services (S+S) approach also figured prominently. The Partners Healthcare organization is a large and complex collection of hospitals, out-patient clinics, research centers and more. You cannot simply “re-wire” the existing systems in such an organization to accommodate a connected health solution like CHCS; nor is it easy to build the infrastructure that will eventually support thousands or perhaps million of users. The only way to make this work is to develop information conduits between the patient’s desktop and the doctor’s desktop that utilize all the existing systems in between. That’s where S+S makes all the difference.

Each time a diabetes patient pricks a finger, and takes a blood sugar reading from a glucometer, that reading has to find its way from device to PC to cloud to Partners systems and finally to a health professionals desktop. And remember, many of the patients who most need remote monitoring may also suffer from diminished motor skills or they may be less computer-savvy. This means that the process of uploading a reading must be as simple as possible. As you know, software that is easy to use often hides considerable complexity under the hood. That’s why both software and services are indispensable elements of the complete solution. The fact that the CHCS team could use web services to collect data from HealthVault means they could rely on industry standard service interfaces as well as secure and private data transports for gathering patient information and integrating into the existing healthcare systems for further processing and analysis.

It is a prevalent misconception that cloud computing will somehow auto-magically help to address interoperability issues, but it simply is not true. You have to design and build services and service-enabled software to address interoperability. Think of S+S architecture as a strategy for cloud-enabling you applications. It is interesting to know, for example, that the designers of the CHCS solution began with an S+S approach well before HealthVault was even available to them. As a result, when it did become available, these two pieces built by separate companies fit together like hand in glove. Maybe that’s why the people I work with tell me more and more that the S+S approach is not only the best approach for solutions like this, but often it’s the only approach that will work at all.

Some thoughts about art, architecture and those stinkin’ architects

CurtD1 — Sat, 06 Mar 2010 19:12:17 GMT

Michael Stiefel has done a brilliant, thoughtful and thought-provoking piece of work in his talk about art and architecture which I enjoyed very much for a number of reasons. I highly recommend it. At one point, for example, Michael highlights the false antithesis between waterfall process and cowboy coding. As Michael points out, nobody seriously advocates either of these extremes these days. Agile process does not eliminate the need for solid architecture.

However, I wanted to mention one small nit about his comments on Jackson Pollock. Michael used Pollock as an example of painting that is totally removed from reality but I’m guessing that Pollock himself might take exception to that claim. In part, Pollock’s style of painting was influenced by the Navajo shaman who did sand paintings by “pouring” naturally colored sand on the ground to form “mandalas” which were invested with great spiritual powers such as healing. Perhaps this was spiritual architecture with the intended experience lost on all but the initiated—though their beauty still abides. What is sometimes forgotten is that Pollock often painted works like #6 on the ground in the style of sand painting.

Ironically, Pollock thought of his paintings as very concrete expressions of the experience of painting in this way. I think Michael’s comments about the spontaneity of experience are much closer to Pollock’s actual artistic intention for this reason. This point is directly related to Michael’s definition of architecture as responsibility for the coherence of the user experience.

Pollock’s paintings were often displayed on the wall in the conventional fashion, creating a fundamental disconnection between the painting and the audience. Viewing them in conventional ways may have contributed to some of the misunderstanding of his work. In architectural terms we might say these works, and the intended user experience of them, became misaligned. This had the effect of removing or distancing the painting from the true context in which they were created. Viewed in this way, for instance, it is virtually impossible to enjoy the painting from the “top”.

Here’s a quotation from Pollock in Wikipedia:

“My painting does not come from the easel. I prefer to tack the unstretched canvas to the hard wall or the floor. I need the resistance of a hard surface. On the floor I am more at ease. I feel nearer, more part of the painting, since this way I can walk around it, work from the four sides and literally be in the painting”

My interpretation of this remark is that he saw his work as the expression of his concrete experience at a given moment in a given context—a fusion of the artist and his art captured in mood, depth, movement, energy, rhythm, line and color.

Now an argument can be made (and Hegel did) that the attempt to express the total immediacy of individual experience in the here and now, inevitably turns into its complete opposite i.e. sheer abstraction. Hence, the oxymoron used to label Pollock’s work as Abstract Expressionism. This is an opposition that stands in desperate need of what Hegel called aufgehoben—a mediation between concrete experience and abstraction.

This brings us back to Michael’s fundamental contention that architecture is mediation between the fundamental abstractions used to create software and the concrete experience of the user. In my experience, this is absolutely what successful architecture must do. Otherwise, the software becomes unintelligible to the user. So, while Michael and I may differ slightly about Pollock, I think we are in deep agreement about architecture. Once an architectural mistake allows the design abstractions to become misaligned with the intended purpose and experience of the user; there is simply no way to fix the problem with code. In all but the most trivial of applications, it seems we must have those stinkin’ architects after all—or forgo them at our own peril.

An Evening with Identity in the Clouds and the Boston Azure User Group

CurtD1 — Wed, 24 Feb 2010 00:40:35 GMT

Don Box once said that developers hate security because nobody wants to stay up all night trying to get things NOT to work. That’s why, when I’m talking to developers, I prefer to talk about identity instead of security. But either way, if you are interested in Azure you are going to want to know more about Windows Identity Foundation and claims-enabling you Azure applications.

If you are interested in learning a little more about Geneva and identity in Azure, yours truly is giving a talk on Identity in the Cloud on Thursday night (2/25) at the Boston Azure User Group. You can find out the details and RSVP or send email to “events” at bostonAzure.org. (you know how to build an address so the alias doesn’t get spammed.)

So far, my experience has been that this is a lively group and a fun way to stay informed about Azure. Please join us. Hope to see you there.

Job Hunting? Monster.com and Microsoft Office Online Make It Easier.

CurtD1 — Fri, 12 Feb 2010 18:20:32 GMT

Sure I’m employed at the moment but I’ve been around long enough to know what it feels like to be out of work in a down economy—and it’s no fun—I remember that very well. When you haven’t put together a resume in awhile it can be tough sledding.

Even if you have a job at the moment, the current economic climate can make looking for that next big opportunity a little like swimming in wet cement. In the job hunting world, you’re what is known as a passive seeker.

Whether you’re an active or passive seeker, I have one little piece of good news for you. Monster.com, a leader in career advice and job placement, has teamed up with Microsoft Office Online to make looking for a new job a little easier. You can build that killer resume from a Word document template and then quickly publish it on Monster—where it can do you some real good.

There are lots of Word resume templates types and formats to choose from. All you need to do is download the one that makes sense for your situation and start entering your information. The templates are all very clean and professionally formatted. They look great, so you don’t have to spend time remembering all the little tricks in Word for polishing you resume’s visual appeal. Even better, you can download a Word 2007 Add-in to go along with your templates. It’s called EasySubmit. Monster provides you with an extra tab on the Ribbon that allows you directly upload your finished resume directly from Word to Monster. How easy is that?

Here’s a link to a great little video blog from the Office Online folks that walks you through the process:

If you follow the directions carefully, everything is pretty much automatic. When you get through and pick a resume template it will look something like this:

To submit your resume to Monster, all you have to do is click the “Upload Resume to Monster.com” button on the Monster tab.

Here’s a couple of quick gotchas you should know about. Don’t use the 64bit version of Internet Explorer to download your templates. (I know, only a geek like me would try that anyway.) Also, if you don’t have the Visual Studio Tools for Office (VSTO) already downloaded, you might have some extra steps; but no worries, the tools are free and the download process will walk you through this part too.

By the way, if you’re not certain which type of resume is right for you, Monster makes that a little easier as well. You can submit up to five resumes with different slants and formats, and then see which one works best for you. Good hunting.

Something about Federated Search on Windows 7

CurtD1 — Wed, 10 Feb 2010 19:42:29 GMT

W7 gets raves for a great user experience features and improvements. Many of the consumers I’ve spoken to love the W7 Task Bar and some of the new desktop arrangement features like Snap and Shake, but some of the really important enterprise capabilities like Federated Search and DirectAccess have been somewhat overlooked. I want to focus on Federated Search here so I’ll save DirectAccess for another day.

Searching is a key component of daily activity in most enterprises. Although we tend to take it for granted, information workers need to have a lot more savvy to find what they are looking for than they are given credit for. Here’s why. Information is all over the place. It lives in documents in a dozen different repositories—if you’re lucky—if not, a dozen different file shares. Sometimes the information sought lives on the local desktop file system or any one of half a dozen different company databases. Sometimes it’s in email and, of course, sometimes it can only be found in some remote reach of the internet. But, hey, that’s only part of the story. In addition to knowing where to look, they have to know how to look? Each location may require knowing a different search dialect. In each place they search, they have to know whether two search terms get and-ed or or-ed. They half to know whether stem searching is automatic or whether wildcards are needed—and which ones!

Anything that makes searching easier for these information warriors typically translates into direct cost saving and better productivity. That’s where Federated Search can make a positive impact on the bottom line. If you take a look at the user experience of this built-in Windows 7 capability, it’s very natural, immediately accessible and easy to use. Just click start and type in your search. If you live near Boston (like I do) or you are a conspiracy buff and you type in ‘JFK’ the results might look like this:

So far, this is just an ordinary desktop search but there are a couple of things worth noting about this. First, if I haven’t found what I’m looking for, I can extend the scope of my search using any of the federated search connectors that W7 knows about. For example, I could extend my search to the Internet by clicking on the Bing Search connector. If I do that the results look something like this:

The search results are returned directly to the W7 Explorer window and the search context is preserved. At this point, you can do anything with the federated search results that you would do with an ordinary desktop search. For instance, you can save the exact search itself. You can also search other scopes with other connectors just by clicking. (You could also search with other browsers or internet search engines, but who would want to?) In my case, for example, I could search across the Microsoft intranet using the custom connector labeled MSW Intranet or narrow my search to internal IT information using the ITWeb provider. Both of these latter are custom federated search connectors created by MSIT to make it easier to wade thru intranet information which is—quite frankly—all over the place.

Secondly, no matter which search I decide to do next, all I have to do is click it. W7 saves my search terms and automatically forwards them to whatever connector I click on. Without this, I would have to first copy my search terms to the clipboard, load the browser and the appropriate web page, and then paste it into the search control before I finally clicked ‘Search’. Millions of people use this second approach all day long, wasting precious time and productivity. With a robust collection of search connectors, a single search can be fluidly diverted from one information source to another until you find what you are looking for.

Good News for Developers

Federated search in W7 is actually based upon an open standard called OpenSearch 1.1. So, in addition to being easily integrated with W7, custom search connectors are extremely easy to build and deploy. At their simplest, a custom search provider can be constructed with nothing more than a single XML file called an OpenSearch Description File (.osdx). In the simplest form, the connector points to an OpenSearch web service. At first this sounds like a big deal until you realize that the OpenSearch standard only requires that the web service results are in RSS or Atom format and have basic elements like title, link and description. OpenSearch providers may be more readily available than you think. Sharepoint can be used as a provider, making federated search is a great way to seamlessly integrate Sharepoint information and searching directly into the W7 desktop.

The OpenSearch standard is flexible enough to allow for custom elements in search results too. It’s also complete enough to put a little polish on large result sets with nicely formatted and reasonably sized pages. So if you already have web services that comply, all you need is the connector.

On the other hand, OpenSearch can also be leveraged to do some more sophisticated searching (with some assembly required on your part). Let’s say, for example, that your company has a database that contains valuable profile information for employees and you want to make this information more easily accessible for everyone. In .NET, you could build a WCF service and a LINQ query that execute the search and convert to Atom or RSS format in about 15 lines of code. Then all you need is your Connector and you’ve integrated this search provider directly to the W7 desktop. Connectors can be deployed from a web page link, a file share or an email attachment, so there’s not much muss or fuss there either.

If you want to know more about the details and basic guidelines, a great place to start is the Windows 7 Federated Search Provider Implementer’s Guide. Despite the title, it covers connectors as well as providers.

Security Qualms?

While we are on the subject, some have implied or expressed vague security concerns about Federated Search, which are probably a bit overblown. In general I take security very seriously but before queasiness sends you running for the air-sickness bag or your network security officer starts to freak out, here are a few things to consider.

There isn’t anything about a search connector that subverts standard network security measures. Even if the provider is on the Internet, results will still arrive at the firewall over http/s—we’re talking standard port 80/443 stuff here. In that respect, a federated search is comparable to standard browsing or an RSS feed.

The connector itself is not an executable; it’s a standard XML file so now worries there. In fact, there are no provisions in OpenSearch for any type “add-ons” so in this respect it is arguably safer than browsing.

Having a custom connector on the W7 desktop doesn’t mean you have to forgo standard authentication mechanisms either. W7 federated search providers can support NTLM, Kerberos, and Basic (over https) authentication machinery, plus any custom (SSPI compliant) Security Support Providers.

So relax, have fun, and make searching a little easier for the information warriors in your organization. They might even thank you for it.

Windows 7 + Surface + Interknowlogy == Healthcare Innovation

CurtD1 — Tue, 03 Nov 2009 17:23:01 GMT

Here’s a Zen question: When does data become information? Is it when data is collected in some normalized form? Is it when some data can be related or correlated to other data in a well defined way? Or, is it only when it finally gets consumed by an application, crunched by business logic and finally presented to the end user in some structured context? I would argue some or all of these are necessary, but not sufficient. Data only truly becomes information when it informs. Digital data has to make that inductive leap from a digital device to the human perceptual apparatus, traverse the neural pathways and get synthesized by the brain. It’s only when someone experiences that cognitive “aha!” moment that we commonly refer to as knowledge or understanding.

And if so, collaboration only becomes possible when we can share context and information with each other. It’s not just about data. This is why user experience and presentation is a profoundly important aspect of information architecture. (If you’re not convinced on this point, treat yourself to some of Edward Tufte’s work. I find him far more convincing than I on this subject.) Even when information is available, however, distance in space and time remains as an obvious obstacles to human collaboration. Computers and networks can help overcome this obstacle—but only if the platform and application are up to the task. Just moving data from one place to another is not a solution. Let’s take health information as a concrete example.

One of the most important and fastest growing forms of electronic medical records (EMR) today is image data created from a growing variety of radiology devices. X-Rays, CT Scans, MRI, PET Scans, Ultrasound and others are producing an explosion of digital imagery in 2D, 3D and yes, recently even 4D. For example, if you have never heard of fMRI think of 3D time lapse photography for the brain; one that can show the flow of blood in the brain over time. Such images can be incredibly powerful medical tools--not only for diagnosis, but non-invasive screening, groundbreaking discovery, research, and especially collaboration.

Of course, the sheer size and complexity of such data create challenges up and down the technology stack including storage, searching, network transport, processing, and presentation. All of these challenges are relevant for collaboration over these images. But has this explosion in image data set off an explosion of information?

Recently, however, Interknowlogy has demonstrated what can happen if we address these challenges. Using both Microsoft Surface and Windows 7 multi-touch, this team has shown that completely interactive remote collaboration in real time with medical imagery is possible now. To see for yourself what is possible in this space you should check out this demo by Interknowlogy. [The video is large so it takes a few minutes to download but trust me—it’s worth the wait.]

The Interknowlogy team has demonstrated that natural user interface (NUI) technology like multi-touch can support and enhance collaboration between users who are local or remote to one another. The ability to make annotations (telestration) on the fly is almost gratuitous. Wow! They have also demonstrated that this can be achieved across different form factors, using Surface devices and Windows 7 on a HP TouchSmart device. Given that Silverlight 3 supports multi-touch today, it is just a matter of time before some of this collaboration is possible in the browser.

To see something truly wondrous in all this, look beyond the wow factor for a moment. Anyone who has had the experience of helping a friend or relative manage a very serious illness may have had the frustrating experience of having to pick up a DVD with one of these images from one medical specialist and drive miles to deliver it to another medical specialist over the proverbial sneaker-net. Now, just imagine a world where your primary care physician, radiologists and other medical specialists could consult and collaborate with one another immediately, and form a plan of action from anywhere in the world. This marvelous vision is much closer than you think!

From S+S Architecture to Azure

CurtD1 — Wed, 28 Oct 2009 18:04:58 GMT

One of the obvious attractions of the Software-plus-Services approach is that it can provide a best-of-both-worlds way to deliver great software value. On the client-side, you can offer a rich user experience, the right balance between ease-of-deployment and use of desktop capabilities, and a comfortable level of trust and security for each application. At the same time, you can delegate complexity or intense computational workloads, or stringent scalability and availability requirements to powerful services in the cloud. These benefits seem pretty compelling, but where will those powerful services actually live?

This question is especially pressing for small- and medium-sized organizations who must work within budgetary constraints and/or more limited IT capabilities. The question may also be urgently important for anyone who wants to provide powerful and complex services and make them easily accessible to less savvy users or users with diminished capacities. In these situations, S+S can be a very potent model if there is a manageable and affordable place to house those services. Perhaps the unspoken promise of those who have already embraced this model is that it will be possible, and hopefully a little easier, to exploit the Windows Azure platform.

If S+S helps you to be Azure-ready, there should be concrete evidence of that—and there is! Over the last year of so, I have had the opportunity to work with ITNAmerica who is in the process of furnishing just such evidence. ITNAmerica is a non-profit organization with a very important and truly unique social mission. It provides dignified transportation options for seniors. As the baby boomers approach retirement age, the social need for these services is growing rapidly and ITNAmerica must keep pace. Workloads grow in a stair step fashion as each new affiliate is brought onboard.

As you can imagine, this growth pattern creates some fairly extreme technical challenges; challenges which are vital to supporting this important social mission. Software must be available to each local affiliate that is easy-to-use and that does not require sophisticated IT capabilities. ITNAmerica also has to provide core services to each local affiliate, such as scheduling rides, on-boarding seniors who need rides, and the volunteers who can provide them, tracking special needs of seniors who may have diminished capacities; not to mention a sophisticated scheduling engine for coordinating all this. These challenges are compounded by truly mission critical architectural requirements. If these services aren’t reliable 7 x 24, the consequences may be life threatening. Moreover, the growth of the local affiliate network creates capacity and scaling requirements that would give the most seasoned CIO some new gray hairs.

ITNAmerica saw fairly early in the game, that an S+S approach could help meet some of these challenges. They are currently rolling out a new version of the ITNRides system based on an S+S model—even while on-boarding their newest local affiliate in Cincinnati-- and this has helped enormously, but big challenges still exist. Take a look:

ITNAmerica must build and host some very complex technology and they have to do this all within the constraints of a non-profit IT budget. An S+S architecture alone does not ensure that these core services can be hosted, managed, and monitored in an efficient and affordable way. Traditional hosting services do not provide the platform and underlying services that will make this possible. Initially, ITNAmerica has had to create its own private little cloud to host its core services. But this can quickly become prohibitively expensive to manage regardless of whether services are hosted on-premise or off.

This is where Windows Azure can help. By embracing an S+S architecture ITNAmerica is in a good position to begin to migrating some of their core services into the Azure cloud environment where it will be easier to meet some of these challenges. Since the ITNAmerica services are already implemented on .NET, SQL Server 2008 and Windows Server 2008, the transition to an Azure infrastructure will not require radical redesign. Instead, it will make their transition into Azure smoother, reduce much of the cost of maintaining a private cloud, and leverage the efficiencies of Azure.

My take away from this story is that S+S and Windows Azure are proving to be a potent combination because, together, they are enabling innovative new business models. These models have proven technically difficult or impossible with more traditional, Web 1.0 approaches—at any price. As in the case of ITNAmerica, some of this innovation is being pioneered by small, nimble, forward thinking organizations. To the extent that this innovation is empowered by S+S and Azure, and it addresses a pervasive and pressing social issue that we all face sooner or later; I think it gives everyone something to stand up and cheer about. Go ITNAmerica!

CardSpace De-Mystified at OWASP in Hartford

CurtD1 — Tue, 10 Jun 2008 18:27:51 GMT

If you are interested in security, identity management, and web standards; you won't want to miss the next meeting of the local chapter of the Open Web Application Security Project (OWASP) in Hartford tomorrow night. The local chapter holds bi-monthly meetings on topics of interest in this space. OWASP is a community dedicated to promoting the development of secure code and supports the education of not only security architects, but developers.

At tomorrow night's meeting, Chris Winn, a Strategic Security Advisor at Microsoft, will be talking about CardSpace and de-mystifying it a bit. Chris will be touching on several fundamental concepts in the CardSpace..well.space and how it can help exert control of digital identity management in the enterprise and on the web. He'll be touching on:

. Using Infocards instead of usernames and passwords

. Identity Providers

. How CardSpace users can help users gain control over their own digital identity

.CardSpace and open, interoperable standards.

If this sounds interesting, you should consider becoming a member of OWASP and joining us tomorrow night. I'll be there, so please come and take a moment to introduce yourself. Here's home page for OWASP and the logistics for the meeting:

Agenda: Wednesday, June 11th 2008

. FOOD & NETWORKING: 5:30 - 5:45 PM

. OPENING REMARKS: 5:45 - 6:00 PM James McGovern, Chapter Lead

. CARDSPACE AND USER CENTRIC IDENTITY: 6:00 - 6:45 PM Chris Winn, Security Evangelist, Microsoft

. IDENTITY GOVERNANCE FRAMEWORK: 6:45 - 7:30 PM Prateek Mishra, Product Manager, Oracle

. Q&A and Raffles: 7:30 - 7:45 PM We will be raffling a Microsoft Zune Player, Apparel and Books

For more Information: http://www.owasp.org/index.php/Hartford

CardSpace and ADFS2-Industrial Strength Digital Identity Management

CurtD1 — Fri, 14 Mar 2008 21:14:52 GMT

Hey! CardSpace is not just a consumer technology. If you think it is, you're missing the point. It is a bit frustrating to hear even some of my Microsoft colleagues refer to CardSpace as though it belongs on the shelf somewhere between Zune and Halo3. So if you're one of those people running around spouting the idea that CardSpace is only important for Joe and Mary Dinnerpail; knock it off! You're simply incorrect at the top of your lungs. On the other hand, if you are interested in finding out why this technology is so important for non-consumer scenarios, you may want to keep reading.

Yes, CardSpace is incredibly valuable to consumers because it can help protect online privacy, putting the control of digital identity back where it belongs-in the hands of the web user. It will help prevent less savvy users from inadvertently revealing passwords and other sensitive personal information to phishing scams. It is a powerful preventative for identity theft and helps eliminate many of the worst aspects of password-based authentication on the Internet. True, all of this is pure goodness for consumers, but if you stop and think about it for a moment, these benefits are just as important to businesses, institutions and government organizations of the small, medium or large variety.

CardSpace is actually an extremely important first step for any person or organization with an interest in conducting secure transactions via the Internet. This includes business-to-business (B2B) and business-to-employee (B2E) every bit as much as business-to-consumer (B2C) scenarios. Notice that there is no 'C' in B2B or B2E? These scenarios were important design centers for CardSpace right from the beginning. Moreover, CardSpace is based upon the widely embraced family of open, industrial strength standards referred to as WS-*, meaning WS-Federation and WS-Trust, among others. Most importantly of all, there are intense forces at work in a wide range of industries scenarios driving the need for secure, federated transactions between separate organizations.

An Industry Scenario

To see why, take a look at the scenario I bumped into recently in the insurance industry. As anyone who has purchased insurance knows, many products are sold and sometimes managed by independent insurance agents. For these products, the industry is not simply a collection of large, competing carriers; it's an ecosystem of inter-dependent organizations. In order for the ecosystem to flourish and operate efficiently, independent agents need to access any number of electronic resources from carriers who offer these policies. Many other processes, such as first notice of loss, claims, and adjustment may require similar access to resources and applications at various carriers.

Like many other industries, important segments of insurance depend upon secure interactions with the independent agents, experts and professionals from other organizations. It's often highly impractical to manage the identities of these non-employees as though they were internal members of your own organization. Yet at the same time, providing direct access to internal resources or applications can really streamline core business processes-if this access is secure. But this many-to-many relationship creates vulnerabilities similar to those found in the online consumer world.

The Trouble with Passwords

Authentication mechanisms designed to facilitate access to internal resources are typically based on a simple username and password encrypted over an (SSL) channel. Like most people, agents that need to logon to multiple carrier sites will avoid password fatigue by using the same password for every site. This is where the many-to-many vulnerabilities quietly creep into the picture.

Imagine that the digital identity of one of these agents has been compromised by a clever phishing scam. Then ask yourself who is vulnerable. In many cases, every system the agent has access to, at every carrier the agent does business with, would then be vulnerable to fraud. There is no consumer in this picture, but the problem that the industry is facing is very much the same as the one consumers face. If fraud does occur, the credibility of the agent (and perhaps the agency) may be at risk as well, even though his or her only mistake was to be deceived by one of the increasingly slick, sophisticated, and highly targeted phishing scams proliferating on the web. To make matters worse, a conscientious agent who realizes her mistake will have an enormous uphill battle to notify all vulnerable parties and remedy the situation because so many different accounts are involved.

The trouble with passwords, no matter how strong they are, is that they are highly fungible from site to site. The same password can be used at many sites. Once compromised, every site where a particular password has been used is automatically compromised as well. CardSpace directly addresses this problem by using tokens that are not fungible at all. Instead of using an ordinary password, the user is actually sending a cryptographically sealed token that is only accessible to one party, the party that supplied the proper certificate (key) i.e the party it was intended for. This is incredibly important because it means a site can securely identify the user, and the user can strongly identify the site. When passwords are used instead of a CardSpace tokens, it is very difficult for users to be certain who they are actually dealing with. Phishing sites are counting on this to perpetrate their deception. My point about this is that many industries are just as vulnerable to these scans as consumers are, but they CardSpace provides a powerful weapon that is already available for combating this problem in industry as well as consumer settings.

Being Kim Cameron

If you want to see the big picture about identity on the Internet, you have to be Kim Cameron (because John Malkovich hasn't had much to say on this subject). If you haven't read his blog on THE LAWS OF IDENTITY, you should do yourself a favor. It's certainly the best thing I've read on this subject. The insurance industry scenario I described a moment ago is just one of many in what is referred to as the 'identity ecology'.

Kim Cameron makes a compelling case for the development of an identity metasystem for the Internet. The root problem is that the Internet was born without any identity system at all. As a result, the need to conduct secure transactions via the web has spawned a patchwork of different proprietary systems of very variable strength that users have no means to assess. Cameron points out that in absence of a standards-based identity metatsystem on the Internet, we are left with patchwork of password-based systems like the ones we have described a moment ago. Such systems make it difficult, if not possible, for users to exercise control over their own identities. Control over one's identity means the ability to control what personal information is given and to whom. In a word, the identity ecosystem is a very fragile one at the moment and it is becoming weaker as each new scheme for identity theft and fraud further erodes trust. This is a problem for consumers, but it is also a problem for specific industries as well. And, in the industry case, it will require a solution forged by industry consensus.

CardSpace is a major contribution to an open, standards-based identity metasystem, strengthening the identity ecosystem in a way that fully respects the laws of identity. I'll spare you a detailed mapping of laws to features, but I do want to call out the importance of CardSpace support for law number six: Pluralism of Operators and Technologies. With CardSpace, Microsoft has demonstrated its commitment to pluralism and open standards in several important ways, including the recently announced collaboration to support CardSpace/OpenID interoperation. In addition, Nigel Watling and the CardSpace team have demo-ed an open source implementations that uses CardSpace Infocards on other platforms. Check it out. This demonstrates the commitment to the pluralism that will be essential to a successfully address identity and security across many platform, technology and organizational boundaries.

Enter ADFS2-another Piece of the Puzzle

If CardSpace has so much to offer, you may be wondering why isn't more pervasive by now. It's a good question and there are a number of good reasons. First, there is a chicken and egg phenomenon happening here. Sites don't take the trouble to support it because it isn't widely used. Web users don't widely use it because very few sites support it at the moment. This problem will work itself out over time, but there other issues.

CardSpace is definitely an industrial strength solution, but it isn't really a complete solution for a full-blown identity metasystem. Perhaps the missing piece of the puzzle isn't obvious for those still laboring under the misconception that CardSpace is just for consumers-but it is actually a very important piece for all the B2X scenarios. Average consumers aren't members of an LDAP domain such as Active Directory. For them, the Windows Vista desktop acts as the identity provider and affords them many of the protections mentioned earlier. However, even for consumers, this can be inconvenient at times if someone wants to use an existing Infocard from a location where they don't have access to their own PC. But for many B2B scenarios, what is really needed is a highly scalable, widely trusted set of identity providers (IP) that can provide CardSpace tokens in the cloud. Among other things, this would make Infocard information available anywhere-without requiring users to relinquish control over what information they provide or to whom they provided it.

I use the phrase 'set of identity providers' to re-emphasize the notion of a pluralism of operators. This idea is intrinsic to the metasystem. Pluralism makes the idea of a metasystem very different than the Windows Live ID system today, though Live ID could certainly become one IP among others. Building a mega security token service (IP-STS) in the cloud is a major undertaking. Moreover, services such as Live ID will not suffice for a number of important industry scenarios. Highly capable, but specialized IPs.will also be needed to support industry specific scenarios. If we return to the independent insurance agent scenario for a moment, it is obvious that insurance carriers have a compelling mutual interest in securely authenticating (identifying) agents. But carriers also have a compelling interest in validating other information about agents such as whether an independent sales agent has the proper industry credentials required to broker certain types of policies.

In the language of security tokens, this information is referred to as "claims"( or sometimes assertions). It is unfortunate that this term has an overloaded meaning in the insurance business, but I prefer it nonetheless, because 'claim' carriers some of the same connotations for both meanings. A claim carries the connotation of something that must be verified or validated before it can be trusted as legitimate. So insurance, like many others, has a compelling interest in the ability t represent and validate information in the form of electronic claims about independent agents who conduct transactions with them. General identity providers like Live ID are unlikely to specialize in providing these types of industry-specific security claims .

In addition to this scenario, many organizations are seeking to federate with one another, so that employees from either company can access resource at the other. In insurance, perhaps subrogation is a good example, because employees may need to securely share documents with one another in order to reach a mutually acceptable settlement. Of course, similar patterns are evident in many other industries as well. For this type of B2B scenario, most companies will want to leverage their existing investments in identity management.

Within insurance, for example, Active Directory is fairly pervasive. Many companies will want to use this identity information when employees are conducting business on behalf of the company. To do this, a company will need their own STS that integrates Active Directory so that they can provide identity information in the form of security token claims. You can think of this as an electronic identity "badge" issued from one company and trusted by another. A Relying Party security token service (RP-STS) is needed; ideally, one that can also integrate transparently with industry IP-STS services. These requirements put us well beyond the general capabilities of desktop or generic IP-STS like Live ID.

For these situations, Microsoft is developing new technology that will be another very important step for conducting secure transactions via the Internet. The next generation of ADFS (let's call it ADFS2 for now) will be an industrial strength foundation for implementing a claims-based security token services (STS). ADFS2 will alleviate the need to build a standards-based token service from the ground up. Among others, it will provide two very important pieces of the digital identity metasystem puzzle. First, like ADFS today, it will directly integrate with Active Directory. This will allow employees of one organization to use an Infocard that contains their internal identity information. It will also allow members of the ecosystem to evaluate the trustworthiness of claims tokens issued by other members of the ecosystem. Secondly, ADFSv2 will integrate directly with CardSpace, eliminating many of the dangers of federation based upon passwords as we described above. ADFS2 will not only help to build a more complete metasystem, it will allow companies who already invested in Active Directory to leverage that investment of federated, B2B transactions.

The Industry Dilemma

In order for specialized, industry-specific IPs to emerge, demand for such services must be generated. In short, organizations must demonstrate their willingness to consume identity tokens from external identity providers. But they will hardly be willing to invest in the technology to consume tokens if there are no providers. The chicken and egg problem rears its ugly head once again. This, too, will work itself out in time because the drivers for an industry solution are strong. But there are still other issues.

A clear business model for trusted IPs must also be worked out. Different industries may require very different business models. Without one, highly robust IP-STS services may be slow to emerge. In addition, there are questions of legal liability. Who is at risk and who is legally liable if a false claim is issued? Will it be users, providers, or relying parties? None of these issues are insurmountable. Arguably, overall risk is considerably reduced by a more secure system. And finally, enterprise and industry architects must play an active part in helping to shape and refine standard protocols that are absolutely essential to realize a genuine identity metasystem.

I point out these issuesto highlight the need for interested parties within each industry to come together and work these problems out in concert with one another. If industry leaders do so, it can only help to accelerate a solution to the mutual satisfaction and benefit of all concerned parties.