Microsoft Identity & Network Access Division

After 15+ years at Google I have now taken a role at Microsoft in their Identity team. I have worked with Microsoft’s Identity team since 2000 when they invested in the first corporate e-mail SaaS provider I had founded in the early 90s and taken public. I have a passion for the mix of Identity, Cloud, & Enterprise. In particular I enjoy helping Enterprises engage with their customers, business partners, and other complex corporate structures. Microsoft is uniquely positioned in that area now that it has transformed itself into being cloud focused and customer focused. Their identity team is now standards-based and vendor neutral, instead of just Windows/Office focused. They are now increasingly driving the evolution of those standards based on the broader Microsoft ecosystem of Windows, Office365, Edge, XBox, LinkedIn, and Microsoft Accounts. I look forward to continuing to work with the industry to improve security, privacy, and usability through advancements in the “Identity backplane.”

Had the challenge of trying to figure out how to efficiently spend $10B a year to grow Google’s data centers while fighting the slowdown in Moore's Law.

Became the PM Director for an expanded Identity & Privacy team after shifting more of our user-facing privacy and cloud security efforts into that central org. One segment of the team worked with government regulators, primarily in Europe & the US, to establish a higher industry bar for privacy based transparency and control tools, including for ads personalization. To continue Google’s reputation as a leader for account security, another segment of the team drove the FIDO U2F standard and developed the first offering to enable account owners to protect themselves from spear-phishing by hijackers (spear-phishing includes social engineering tricks to overcome the protections of adaptive multi-factor authentication).Another segment of the team focused on helping developers improve their own login systems. A major shift was that Google began promoting the “leave it to the professionals” mantra with the support of other industry leaders to convince companies they should outsource the operation of their entire B2C/B2B login system to expert vendors, just as they might outsource their corporate email, employee SSO, or cloud hosting. Google promoted this approach for the security/privacy improvements for users, as well as the large usability and business-value increase coming from the availability of next-generation Android & browser based credential management APIs.

While Google’s core Search/Ads/Youtube products do not require personalization, the growth of mobile led to a large increase in signed in usage and personalization for these core products. The resulting increase in monetization then led Google to dramatically raise the bar for the privacy & security of Google’s Identity systems. A central user-facing privacy system was created to address that need, and in parallel a number of Identity standards such as OpenID & OAuth were updated for mobile platforms. Industry account hijacking rates also grew at that time, but Google was able to achieve the lowest hijacking rate of all major email providers through industry leading adaptive multi-factor account security.

Google’s initial cloud hosting efforts based on Google App Engine began at this time. I took on the Product Management efforts for the Security org and our CIO organization to define Identity & security standards needed to enable companies to shift IT apps to the cloud. A key output was the joint creation of the OAuth2 standard with Microsoft that has become the key Identity standard for the cloud.Also launched the industry’s first major consumer 2-step-verification offering after working with industry to establish that as a best practice.

2005-2007Google came under heavy external security and privacy attention at this time. I joined Google’s first central Privacy Committee and also began representing Google in industry standards efforts such as OpenID, OAuth, and OpenSocial where I took leadership roles. I also started Google Health to experiment with data portability efforts using those Identity standards and privacy best practices around OAuth.2003-2005Joined Google in 2003 and have been the key leader of their Identity efforts since that time. Launched the common Google Accounts login system to merge the Identity systems of all Google’s consumer and business focused services (Gmail, AdWords, etc.) Similar to my pre-Google work, I started Google’s corporate email hosting service, Google Apps for your Domain, and recruited the team that operated it. Also led product management for Google’s first social network service, orkut.com, that was heavily used to raise awareness of Google’s offerings in the BRICs (Brazil/Russia/India/China).

Joined the OpenIDFoundation board in 2008 to drive industry Identity standards. A key driver in the relatively small group of industry experts driving Identity standards including OpenIDConnect, OAuth, OAuth2, SAML, SCIM, U2F, and CredentialManagement across the OIDF, OIX, IETF, FIDO, & W3C. Expanded the OIDF’s role to become the one standards group to market and promote Identity best practices, including through industry events it operates around the world. Also co-founded the Open Identity Exchange to act as a coordination point between industry & governments on Identity issues, including defining certification frameworks.

Libritas merged the ISP and ASP models providing access to hosted applications over a redundant, secure, managed network connected directly to the customer’s LAN, removing the need for any servers on their premise. Different classes of services were integrated, including Linux servers, MS Exchange, Voice over IP, and Unified Messaging with a single easy to use web interface for self-provisioning by the customer.Company was sold to NextWeb in 2003

In 1992, started the first industry software as a service vendor in the corporate email hosting space by building a multi-tenant Identity and billing model around software products including Lotus Notes and Microsoft Exchange. Went public in 1999 after successfully competing with most of the major telcos around the world, but consistently was recognized as the leading firm in this field. Signed multi-million co-development deals independently with each of Microsoft, IBM/Lotus and Dell to design SaaS models for their email, collaboration and web hosting platforms.