Security in Politics

Caption says 'Security upgrades are now in place for all Bush press conferences'

Intro to Bruce Schneier

Back in 2000, Microsoft was getting hammered for it's lack of security. At the time I was working for the Exchange team focused on Key Management Server (or KMS). This was functionality used by Exchange to offer signed and encrypted emails to users in the system. Because of all the bad publicity at Microsoft, there was a push from upper management (I mean way up high) to get better at security. Some of you may remember when Microsoft stopped coding for a while to better their security. This wasn't just PR, but it was something they believed in. So because I worked on signed and encrypted email, that meant I knew something about security (which I didn't). I got drafted to the newly formed Exchange Security team. Actually it was a lot of fun. I got to learn new concepts and think in ways I wasn't use to.

I attended a seminar on security from some outside guy. This was Bruce, he was definitely a geek, he knew what he was talking about. The best thing about him was that he dogged Microsoft - in their own house. I thought that was ballsy. I immediately became a fan, read his books and joined his monthly newsletter. I like how he explained security in his books. He took abstract security concepts and brought them down to every day tangible examples. The tell tale sign that someone really knows what their talking about is when they can break it down in terms that even a child can understand. Not that techno-babble speak we all hear from time to time.

So in the end, Microsoft can out a bit more secure. Some may debate to what extent though. I came out of this a bit wiser when it came to software testing. Identity management is a small slice of the security pie, and I would argue that not to understand the overall security implications undermine any IdM system.

Bruce has a monthly newsletter that I would recommend to everyone. http://www.schneier.com/crypto-gram.html. In this latest issue he talks about impersonation - very relevant to IdM. It can also be found here. There's been some talk lately about OpenID, I think the ability to validate one's ID will decide how viable OpenID will be.

Finally, more on the musings topic than IdM there's a great article on the NSA can be found here

Virtual Directories and Meta Directories

I just got done reading Jeff's post (http://idlogger.wordpress.com/2008/03/22/which-is-better-phillips-or-flat-head/ ) on the topic at hand, entitled well enough "Which is better Phillips or Flat-head?"



I not only agree with Jeff, but let's take it to another level. Sometimes you can use a phillips or a flat-head interchangeably, which is the case sometimes with Virtual vs Meta. But many a time you can't interchange them. I've been learning a bit about virtual directories lately thanks to Mike Brengs and his team from Optimal IDM. Here are a few differences to share right now.

When to use a virtual directory:
1- Use it as a proxy. What if you aren't allowed (or can't) query directly against AD. Meta directories shouldn't do this.

2- Extend the schema. Yea like ADAM, but it won't take weeks to set up.

3- Creating single views that update immediately. Similar to meta directories, data can be brought together in many different way. Unlike meta directories that poll connected sources in intervals, virtual directories can meet client requirements that need immediate results.



Here's something that meta directories must be used for and not virtual directories: provisioning and de-provisiong user accounts. This is one of the main pushes for meta directory technology and it still holds true, especially de-provisioning. Now some vendors have added a sync engine to their virtual directory product so it can do both. Which is fine, but then call it what it is.



As I continue to understand more about virtual directory technology I'll include it here.

Does anyone agree / disagree or can add more to this?

Hello all

My name is Peter Jalaff and this is my first blog. I've heard / read so much about them, thinking how cool is that - you can write down your thoughts so others can read them. Then I vacillated between how cool, and do others really care about my thoughts??? time will tell...

My background includes working in the IT field for over 10 years, most recently in the Identity Management field for the past 2 years. Back in 1996 I realized how bored I was while working for a copier company. The company was good to me and I sold enough copiers for a decent living, at the time. I kept picturing myself as a gorilla in a suit and tie, slinging copier machines around. I wanted something more. So I decided to study and get certified in Visual Basic. I already knew BASIC way back from high school days - How much harder could it be? After studying for over a year, I finally got certified. Living in Pensacola I couldn't find a job without experience. So I started searching nationally and finally I got a job with Microsoft as a contractor. I had one year to prove myself as a tester on the Exchange team. So I rented a U-Haul packed what few things my wife, daughter and myself had and drove cross country. I felt like the Beverly Hillbillies, but it was a fun yet tiring trip.

Once on the job, I learned all about Active Directory and Exchange 5.5 and 2000. All about software testing and drinking micro-brewed beers. I even used my VB training to create some cool testing software. I was really proud of myself that I created something that others on the team were using. I guess they liked me enough that they asked me to stay full time. It was the best job I ever had. The Exchange team really treated it's people well. We had parties and they would buy beer on Friday's, they would take us all to the movies. I remember seeing Austin Powers - Man of Mystery with everyone. This lasted for 3 years.

That's enough for right now. I'll continue my story at a later time.