GenericIAM - time for a re-boot

Dear colleagues it has become quiet in the GenericIAM forums (Google, LinkedIn) & BLOGs (BLOG). The Web-site (GenericIAM) is not up-to-date and the off-line activities have stalled.There are several reasons for that. But none of them should prevent us from overcoming it.

Surely we are in the financial crisis and everyone just tries to survive. Well, not everyone. The labor market is split into the haves and the not-haves. But even those who still have their jobs and are still well paid feel some pressure to contribute to the corporations’ income generation. Yes and my personal financial crisis started even earlier.

So I had to look for a serious and income oriented challenging assignment. It took me far away to the Ukraine and kept me busy for 24 hours a day.

But there is more about it. Let’s look back. There were some things we did right – and some we did completely wrong.

Shocked by the fact, that u to 80% of all effort in IAM implementation projects has to be buried in process definitions we had the honorable idea to collect all those experiences and assemble a generic process model. Based on this generic IAM model (hence our brand became GenericIAM) most future modeling attempts should turn out to be much easier and hence cheaper.

This idea is still valid. Also the pressure of the modeling burden is still felt.
But on the way from an idea to innovation some lessons had to be learnt:

1. Timing: Let me 1st hint at the general problematic of innovation. As the brilliant Gunter Dueck, IBM distinguished engineer and frequent column writer once had uniquely put it to the point: If you come up with an innovation you will never be encouraged to move on with it. There are two choices. Either you are to early. In this case the commentators will say: “No, this never works. Forget about it.” Or, you are too late already. Now you will hear the ‘experts’ say ”Save your efforts, it already exits.” So, when is the time right? When you receive more or less the same number of answers out of each category. To my observation of the ‘market’ (if there is one) the window of opportunity has not yet closed. There are still prophets around issuing warnings. On the other hand some proprietary & well shielded process collections exist.
2. Costs: Let’s start from our most stupid idea at the very beginning in 2005. To cover our expenses for travelling, meetings and the like, we thought of a fee for our intended publications, so to sell them. Well, for tax reasons alone we would have had to set-up an administrative overhead that quickly convinced us to drop this idea. In the age of free open source software (FOSS) we should better contribute to some kind of free open org. Everyone has to cover his own costs.
3. Modeling approach: Modeling bottom-up seemed to us to be the natural approach. Collecting specific implemented models, anonymizing, harmonizing and normalizing them could let us derive truly generic models out of customer specific fragments. It only did not work. After a couple of volunteers had invested a huge amount of work and proudly presented their model the comment ‘well, but it still is not truly generic!’ during one of our meetings instantaneously destroyed their enthusiasm. In fact it turned out, that especially the most experienced practitioners faced difficulties in getting to the next layer of abstraction. The 2nd attempt was a top-down modeling approach deriving the basic processes from the interaction of corporations’ fundamental objects using the notion of Petri nets for the top-most layer. Here we at least achieved to jointly write, review & sign-off a paper) on this approach – and forgot to publish it properly. But the wider audience refused to understand Petri nets. So again dead end. In the 3rd attempt, our modeling group gave the top-down way another try. This time they got stuck after agreeing – more or less – on the fundamental objects. Well, and then the crisis came (see above).
4. Meetings: Most puzzling for me was, that, our quarterly meeting, which we held in different German cities, were always well accepted and attended by 10 to 20 participants. This was great. But at the same time the modeling progress slowed down. Even some of the frequent visitors of our meetings were reluctant to submit their at least half-baked models to out raw material collection. One of the frequent participants hit the nail on its head: “We IAM experts in our corporations otherwise don’t find anyone to talk to.” Hmmm, he was right. But it was not our intention to set up a German circle for the professional IAM dispute.
5. Collaboration: to my opinion IAM suffers heavily form the domination of IS-security aficionados. They usually try to provide for a maximum security for their companies - regardless of the adverse effects. After all perfect security can only be achieved in total isolation. A risk based ‘good-enough-security’ would fit most corporations better – but would be considered as a failure by them. Those people have problems to email & chat, write BLOGs or collaborate electronically with colleagues they have never seen. Web 2.0 is evil to them. They tend to keep everything secret. But we needed to work in the public space. Each one on this globe should see our progress and set-backs, participate real-time and online in it and of course contribute to it. So, BLOGs & Forums instead of Intranets & private mailboxes.
6. Language: There is only one language to be used for such activities: international English. No German, French or other tribal languages should be allowed in professional documents. They are great for art & literature but should be kept out of the professional arena. Well, for the small talk, we have a bit more relaxed opinion.
To sum it up: We learned that …

1. there is still a demand for generic IAM processes as open org,
2. we should deliver our results for free to the global community under a creative commons license model,
3. we have to follow an top-down approach,
4. we need to collaborate publicly via the Web,
5. in case we feel the need to meet personally we should be sensitive for 2nd order effects,
6. we must document all our artifacts in international English.

So, it is time to reboot GenericIAM.

The good news is, that there are some volunteers who like to take the lead and push the activities relentlessly forward.

If you like to join please contact …

• Andreas Netzer (andreas.netzer@ic-compas.de>, skype: andreasnetzer),
• Marc A. Dierichsweiler" (m.dierichsweiler@impulsit.de) or
• Martin Kuppinger (mk@kuppingercole.de, skype: martinkuppinger).
We should not miss the 2nd chance to create the 1st IAM standard process model.


Horst Walther, 2009-06-10, Kiev, Ukraine