I want to add just a bit more on orphan accounts and de-provisioning before we move on to the next round of conferences (Burton's Catalyst in two weeks, then next month's inaugural SSO Summit get together).

Courion’s Chris Sullivan responded to last week’s newsletter on de-provisioning ("Time to investigate orphaned accounts") with a note letting me know that the survey result stating, "Approximately 27% of respondents said that more than 20 orphaned accounts currently exist within their organization" was probably an understatement as his consultants typically find hundreds – even thousands – of orphaned accounts once they start checking. He suggests that you might have a lot more than you think!

Regular readers will remember that I mention, from time to time, that my wife and I like to take cruise vacations and I usually check out the security and identity issues involved in moving a couple of thousand people on and off a ship every week or 10 days. Typically, de-provisioning isn’t a problem as all passenger accounts are cleared at the end of a cruise and the new set are provisioned at the beginning of the next one. On the cruise we just finished (on Holland-America Line’s Zaandam) Internet access is self-provisioning, similar to the process in most hotels these days. But there was a new issue I hadn’t investigated as yet concerning provisioning and de-provisioning.

This cruise was from Seward, AK to Vancouver, BC – not the typical round-trip cruise. A number of folks (300 of the 1,400 passengers) had taken the previous Vancouver to Seward run, booking it as a 14-day round-trip from Vancouver. So when the ship docked in Seward not all accounts needed to be removed, just those of the 1,100 people who were debarking. So how to handle that efficiently and quickly would be the question on my mind.

The question was on the mind of the ship’s IT people also. Unfortunately, they had no new insight – all 1,400 accounts were de-provisioned and the 300 folks staying aboard were issued new accounts. It’s not the neatest solution, but – for now – it’s the cleanest. At least it ensures that there are no orphaned accounts even if it does force some people to re-initialize their setup. Still it’s a far cry from the days when the Internet cafe manager had to individually provision the account while you waited. Progress is slow, but it is progress. How’s your identity management shaping up? Has it improved over the past 6 years? Tell me about it.

Dave Kearns is a consultant and editor of IdM, the Journal of Identity Management.