Also, I am thinking of building a new version of Privacy Mirror to use the graph API. Any one have feature requests?

• Personal and workplace tools
• Privacy
• New behavioral norms
• Using analogies to convey ideas

They say that necessity is the mother of invention, but I think that the “oh crap” moments are far more inspiring and lead to better, more useful innovations.

• Oh crap! There’s more information about everything available in ways I cannot even begin to count.  How do I get to the good stuff?
• Oh crap! To compete, I’ve got to get more out of the bright people working for me.  How do can I take their creative efforts and merge them into our core business?
• Oh crap! I thought I knew how to start a company but between all of this web 2.0 mumbo-jumbo, VC scare tactics, and the financial crisis, I’m just not sure anymore.  What can I do?

It is a real “ah ha” moment that can break you out of the paralysis that an “oh crap” world so easily create.  These moments come from seemingly unrelated conversations and random thoughts.  These moments come from things like Defrag.

Eric describes Defrag as:

Defrag is the first conference focused solely on the tools and technologies that are leveraging the “social” aspect of software to accelerate the “aha” moment. Defrag is not a version number. Rather it’s a gathering place for the growing community of implementers, users, builders and thinkers that are working on the next wave of software innovation.

What Eric is really doing at Defrag is to build a crucible into which is poured a combination of very smart people, innovative vendors, and curious attendees.  Turn up the intellectual heat through meaningful keynotes, panels, and Q&A and “ah ha” moments are forged.  These are moments not to be missed.

Having seen what Dick is cooking up at Sxipper and having just built my chi.mp site, bethu.mp, I am really excited to see what other fascinating stuff is waiting for all of us at Defrag 2008.  Come join the fun and have an “ah ha” moment or two in the midst of this “oh crap” world.

Among others, Matt Pollicove wrote about this and the need for trust.  Matt asserts that trust is a must and I completely agree. That being said, the last two points in his post are mistaken.

First he says:

This means, making sure there’s no orphan or rogue accounts in the systems.

While this is a generally accepted good practice, it would not have necessarily helped San Francisco keep from losing their network. Privileged account management would have been far more useful.  Discipline and control around how sysadmins gain access to and use root-like accounts, the bread and butter of privileged account management, would have helped avert some of San Francisco’s problems.

Second Matt says:

GRC tools will be a must in this verification.

This first thing that springs to my mind is a question: what aspect of governance, risk management, and compliance would have helped the city of San Francisco in this case? A good governance and risk identification and management process would have helped a great deal.  But we have to keep in mind there is no such thing as a GRC tool; there is no such animal.  In fact, GRC is starting to sound like the wonderful magical bacon animal that Homer Simpson dreams of. If pork chops, ham and bacon all come from the magical animal in the Simpsons, then privileged account management, orphan account management and provisioning all come from the magical GRC animal. Where does it end?  The reality is that the industry has confused the benefits of good governance processes and risk management capabilities with automation tools that aid, but never replaces, those processes and capabilities.

Privileged account management is not and should not be considered part of the marketing fog of GRC. Does the controlled management of root-like accounts constitute good operating procedure and help reduce risk?  Absolutely. But that doesn’t make privileged account management a GRC technology.  Is orphan account removal a critical process from a security and risk mitigation perspective?  Of course. However, that doesn’t mean the technologies to do that are GRC technologies.

Specificity of language is crucial. Telling the city of San Francisco that the solution to their problems lay within “GRC” would have done little except lengthen the time to finding what their real problems were.  Our industry cannot take the easy route and lump every possible technology and procedure under the sun onto the GRC heap or else we’ll find ourselves chasing Homer’s magical bacon animal.

(Helps if I actually link correctly… doh!)

After a few years in the making, I have joined Burton Group as a senior analyst on the Identity and Privacy Strategies team.  The first day at a new job is always a little gut churning.  When that first day is the first day of the Catalyst conference it gets even more interesting.

Today I found myself on stage with the rest of the team during the Identity Management market overview presentation.  Stoically silent, I scanned the room for friends in the industry.  Needless to say there were more than a few very surprised people.

As my first real act as an analyst I recorded an introductory podcast – Not bad as an intro.  Obviously, there will be more to come as I take on my research projects.  Stay tuned!