Monthly Archive for January, 2007

Diversity as a form of Defense in Depth

Published
by
Ian Glazer
on January 25, 2007
in Uncategorized
. 0 Comments

I was thinking about David Maynor’s post on Cisco’s latest security updates. His feelings are quite clear on the danger of a homogenous network:

Again let me state for the record how I feel about this: do not buy a single vendor solution for something as important as the very basis for how your network operates. I know you may get volume discounts or sales reps might take you to nice lunches but eventually something like this will happen.

A homogenous network is a weak network. Yes, all products from every vendor have bugs and vulnerabilities. In a homogenous network, all of those bugs and vulnerabilities are arranged like a row of billiard balls. One good smack on one end will travel clear to the end of the row. In a heterogenous network, the bugs and vulnerabilities don’t line up so neatly. In fact, the heterogenous network looks more like a set off balls randomly dispersed on the table. A bump on one side is far less likely to make it all the way across - that is a form of defense in depth.

Thoughts on Relational Continuity Sockets Layer

Published
by
Ian Glazer
on January 24, 2007
in Identity Management
. 0 Comments

Mike has clearly been doing some heavy thinking and his recent post on his Law of Relational Risk is evidence of that. Mike’s last idea in the piece caught my attention, the notion of Relational Continuity Sockets Layer. The idea is that:

It would allow multiple participants to interact on a channel that is secure for the duration of the relationship or at least one risk cycle (this means longer-lived sessions than SSL) and allows for relation IDs (similar to session IDs).

For such a connection to be created a myriad of problems have to be solved. Just a couple off the top of my head:

  • A method for describing a risk-based relationship in terms more meaningful to humans than what kind of authentication you prefer. Said another way, my selection in authentication type and method is not a good indicator of the level of risk I am prepared to accept.
  • A way to describe the longevity of the relational connection and context. I, as a participant, need a way to say, “This relationship is over.” I can do that in a variety of ways in the real world, and need an analogous way to do that in the virtual world. Further, if my SSL connection is closed, but I am still connected to the RCSL by a tendril of a relationship, what does that mean?

Privacy statements and data retention policies become even more “interesting” in this proposed environment. At the bottom of a relationship is an agreement, either explicit or implicit. In an on-line world, these agreements are usually the things that an end-user doesn’t read and checks the box saying, “Yup, I agree.” I wonder what all the terms and conditions would look like for businesses establishing an RCSL-based relationship.

As identity management systems become part of the core infrastructure of business, policy management becomes a harder and harder job. We’re going to have to tackle it someday…

Who wants to be a security actor

Published
by
Ian Glazer
on January 18, 2007
in Uncategorized
. 0 Comments

If we have security theater, then we must have security actors. Wouldn’t you love to be one? Now you can.

Identity Literature

Published
by
Ian Glazer
on January 18, 2007
in Identity Management
. 0 Comments

During his talk to day, Jim mentioned that as he began to write his book, his surveyed the existing identity literature and theory and found them extremely lacking. Fair enough. There really isn’t a lot out there on credentialing and identification.

This triggered a thought/memory/realization. I’ve never quite understood why I like working in the identity space. The people are interesting, sure. The concepts are approachable and visceral… after all, identity management is about me: my stuff, what am I allowed to do, who is allowed to know what about me, etc. At the bottom of it, the problems of identity are fascinating to me.

And in the instant I pondered Jim’s point that there was little identity literature, I realized that he might not have been looking in the right place. He probably didn’t expect that one of the greatest bodies of writing on identity lives in Scottish Literature.

Years ago, I spent my junior year abroad at the University of Edinburgh. Scottish lit was part of my course work. Ian Campbell, Cairns Craig, and Alieen Christianson were my guides through everything from Redgaunlet to Mary Queen of Scots Got Her Head Chopped Off. Scottish writers have a strong tradition of approaching identity and duality issues. Three that books I read and highly recommend:
• The Private Memoirs and Confessions of a Justified Sinner by James Hogg
• Strange Case of Dr. Jekyll and Mr. Hyde by Robert Louis Stevenson
• Lanark: A Life in Four Books by Alasdair Gray

Each one is packed with identity fun. Identity fraud, identity theft (the real, metaphysical kind… wait, can something be real and metaphysical?), self-asserted credentials, and more.

Ok, I grant you that none of those titles cover strong multi-factor identification, federation, URL-based identity and the like, but they do make for a great read. And if it ever gets cold around here again, I’ll definitely be picking one of them back up for some fireside reading.

Thoughts on Jim Harper’s talk

Published
by
Ian Glazer
on January 18, 2007
in Identity Management
. 0 Comments

While Washington, DC may not have a lot of companies working on identity technologies, it certainly has a lot of bright people working on identity policies. This afternoon I got to hear one them, Jim Harper, speak about his research into identity and identification and his subsequent book, Identity Crisis: How Identification Is Overused and Misunderstood. If you haven’t read it yet, do so. It is an approachable survey of identity management and identification issues facing the U.S., set in the context of the REAL ID Act. (The short blurb I gave my mother-in-law about the book was enough to get it into her reading stack.) This wasn’t the first time I had the opportunity to hear Jim; Phil roped him into giving a keynote at Digital ID World last year.

There were two items I took away from his talk. First, Jim has an excellent analogy on how we protect physical assets versus how we “protect” electronic financial data. How many keys do you have in your pocket or purse? I’d wager it’s probably more than three. I’m also confident that you have a bunch more keys at home in the drawer somewhere. Each key matches up to an important physical asset: an apartment, a bike, a car, a safe, etc. In fact, you may even use multiple different keys to secure the same physical asset. Although convenient, I don’t think anyone would use the same key for every asset they own; just the idea of it seems somehow unsettling. Jim makes the point, if people don’t use a single key for securing their physical assets, how come we have (or are coming dangerously close to) using a single key, social security number, for “securing” all of our financial data?

Second, the point that credentialing, or authorizing, is just as important as identifying. At a point-of-sale terminal, merchants are primarily interested in can you pay, not who you are. Knowing that you are allowed to travel, but hiding who is doing the traveling. This smacks of both Dick’s Identity 2.0 talk and Bob’s talk on the Identity Oracle from last year’s Catalyst.

The question was raised what are the real opportunities that people have to opt-out of large scale identification. In reality, it is hard to opt-out of being identified and continue to fully function in society. There is a glimmer of hope in stronger identification systems allowing citizens more choice as what is needed to identify them. This sits somewhere between Kim’s Law of Minimal Disclosure and the Identity Governance Framework.

All in all, it was great to hear Jim speak and heartening to find parallels between identity policy and identity technology. I am concerned that too many bright identity minds are wrapped up in “enterprise” projects and have lost a bit of the wider societal view of the implications and impact of their work