This is an interesting wrinkle in an ever-changing market.  CA now possesses a preventive-controls engine with the ability [...]]]> Yesterday CA announced its acquisition of IDFocus,  a small Israeli company.  Among other abilities, IDFocus provides a finer-grained segregation of duty (SoD) analysis engine.  CA has previously integrated this engine into Identity Manager, their user provisioning tool.

This is an interesting wrinkle in an ever-changing market.  CA now possesses a preventive-controls engine with the ability to look further into the security stack of an application.  This engine allows customers to make SoD decisions below the role or group level, at the lower ACL/security object levels.  Provisioning vendors have until now done this by calling external services provided by Enterprise Application Controls Management (EACM) vendors.

On one hand, CA has partially obviated the need to integrate with an SAP, Oracle, or Approva by integrating the IDFocus capabilities into CA Identity Manager.  On the other hand, CA’s move may have made things more confusing for customers.  By increasing the number of controls repositories that a customer has to maintain, integration of IDFocus makes compliant provisioning deployments more challenging.  What would be really slick is if CA could find a way to work with the EACM vendors to synchronize SOD tests so that a customer could use the same test for both detective and preventive applications.

I was speaking on this very topic in Europe last week.  I commented on the various architectures for integrating EACM into user provisioning to provide compliant provisioning services.  (For more on this subject, check out Lori’s report on the matter.)  CA has now introduced a fourth deployment model in which the provisioning engine owns the entire compliant provisioning event from the request through the SoD test to the provisioning event itself. An interesting alternative. I’ll be curious to see where CA takes this.

(Originally post on Burton Groups’ IdPS blog.)

After Shamshu (or Uncle as he is known in the [...]]]> [Some friends from Approva where in town from Pune, India.  They had read my trip report on our company trip to the beach in Dapoli and found it hilarious.  They implored me to post it up on tuesday night.]

Day 1 – A Good Start

After Shamshu (or Uncle as he is known in the office) picked me up at oh-dark-thirty, we headed to the office. There in watching everyone try and get organized, I introduced him to the expression “herding cats.” I knew I was in for a good time when I noticed dried vomit festooned on the side of the bus. Shortly after, Shamshu asked, with a slight malevolent grin, “Do you get the motion sickness?” I do, Shamshu, I do indeed, but I had prepared for such a situation by doping up appropriately.

So off we went, about 2 hours later than we were supposed to. And by off we went I mean to say, we started fighting through traffic in Pune. Both buses stopped a while later to pick up more people. (There were two buses. Hare Krishna, seen above, and The Short Bus, which will be taking a prominent role in a moment.) In the crew that we picked up at the second included Shishir, Kaustubh, and Aniruddha. After much back and forth, it was decided that the drinkers and smokers would take The Short Bus and everyone else would ride with Krishna. So off we went… again.

Queue Bollywood sound track at earsplitting decibels. After an hour of that I did make out the distinct sound of a beer being opened. Okay, I’m thinking, this is a good old fashion road trip. Kingfisher in hand I sat back and enjoyed the drive out of Pune and into the hills. Stopping at a Tata Power Generation control reservoir I got a good sense of the landscape reminded me of Southern California.

On the way back to the bus I saw something hanging from the open engine compartment. Shamshu called it lemon chili and it was, supposedly, for good luck. Keep that good luck charm in mind.

Day 1 – The Short Bus to Trouble

One more pee stop later and I was asked if I wanted to join the drinker bus. I was perfectly happy on the big bus… well cooled, plenty of people to talk to and a chance to sleep. But then the guys put the hard sell on. And the reality was that the deafening songs in combination with a lack of beer started to worry me. Joel, Shishir, and Amit demonstrated something from the Kama Sutra for me as part of the sale. Now if that didn’t get me, the wild eyed look of Joel (whom I later learned, doesn’t drink), Kaustubh and the others tripped off my, “This is going to be too much fun to pass up.” So of course I got on the Short Bus. And this is where it all goes wrong.

Getting onto the Short Bus, I knew, absolutely knew I had fallen in with an evil lot. Shishir and Aniruddha grinning as I made my way to the back of bus. There was a beer in my hand before I could sit down. Multiple cigarettes thrust at me and then a plastic bottle of vodka. We hadn’t even started moving yet. There are no photos from this part of the trip. I will not share these conversations for a variety of reasons.

Day 1 – Home sweet home

Somewhere along the way, I fell asleep. It was a blast furnace inside that Short Bus and the alternating vodka/beer mix didn’t help much. I awoke and we were there. Not really sure where there was but we were there. Oozing out of the bus, groggy and confused, I was shown to my cottage: a pleasant space with an indoor bathroom. See photos:

For those of you renovating bathrooms, might I suggest this little number? It is convenient for both sitters and squatters alike. A real marvel of looks and design.

So the bathroom left a little to be desired and the bed was essentially a rope mattress. It was quaint and had a fan which was about all I could hope for.

Day 1 – Party Time

After the very late lunch, I crashed pretty hard. I won’t go into extraordinary details on the bed, but needless to say I decided to do something I have never done, outside of camping, which is sleep in my clothes. Meals were served in an open area in front of the stage. Did I mention the stage? With lights? And a sound system? Yeah, they take dancing and performing very seriously here and I had no idea what I was in for.

After dinner, the music was cranked up and it was time to dance. Almost everyone flocked the dance floor. Ambarish is one crazy little dancer. Not dancing was simply not an option. So as Ambraish dragged me up on the stage, he said, “Elisabet told me to get pictures of you.” Nice, E, send your spies after me.

I took a walk on the beach. The beach, by the way, was great. Really wide. You could walk out into the water a long way. Pretty good sand too.

I fell into bed around midnight or so…

Day 2 – Morning on the Beach

I was up around 7, which was not what I wanted to do but frankly spending another moment in that bed was just not appealing. So, off to the beach I went. As I mentioned before it is a great beach. Here are a few shots from it:

The amount of pollution in the air did have one good upside, it made for nice early morning light.

I earned big points to eating anything and everything set before me. Maybe it had to do with the dining room?

After breakfast was a rousing volleyball match. Now before you get images in your head of Val Kilmer and company from the volleyball scene in Top Gun, you have to keep in mind that we are talking about members of a technology company playing volleyball. Imagine if scene from Top Gun was recast with members of Animal House and Revenge of the Nerds and you’d be in the right neighborhood. So as to maintain the dignity of the players, myself included, I will not share photos from the game.

Day 2 – Afternoon Fun

After a healthy dose of body surfing and playing in the sea, the guys set up a cricket match while others went parasailing.

Day 2 – Dinner and Six Movies

Kudos to the Culture Club for coming up with this event. The group was broken into six teams and each was given a list of lines from famous Bollywood movies to include a skit the team had to design. I was, clearly, the anchor dragging down my team. To offset my lack of Hindi, Shishir was put on our team. Now for those of you who don’t know, Shishir actually won awards for his acting; I kid you not. Apparently, in college as well as after he acted, including on a soap, but I don’t have details about that. To include me, we did get one line in English. I’m not really sure how it fit or what was going on, but I did get to deliver the line, “Show your mettle, man!” Yes, I got to play PV in a Bollywood skit. Truly a high point in my career.

We didn’t win. There was great debate as to whether the voting was rigged. Shishir lodged a protest; booze may have been involved.

And then there was dancing, again. I have a video from that which pretty much sums up what happened.

Campfire singing and off to bed. Day 3 awaited us and no one knew what lay in store for us…

Day 3 – And away we go (kinda)

The campfire has burnt out. Songs over. Hangovers well in place. It was time to go. The Silver Sands resort had us check out by 9. Knowing that this group doesn’t move too fast, we had to be up and out by 7:30… we barely made it.

Before taking off, Shamshu asked Aniruddha to make sure that both buses were fully inspected. Tires, engine, etc. This inspection, or whatever little was done for it, did not pay off, at all, as we were to learn.

All the Short Bus warriors, now fully broken by their own doing, were on Krishna. The ladies took over the Short Bus and would likely have a far less rowdy ride out as I had in.

As we pulled out of the parking area, the group recited some sort of prayer or war cry. Shamshu explain it was for good luck. I should have learned Hindi just to help out on that one. And so we left Silver Sands and headed home.

We took a different route out and it was extremely beautiful. And death defying. The road was about a lane and a half wide. With a shear, and I mean really fucking shearing, drop on one side. At every bend, images of us tumbling down the side of the road came to mind. Guardrails, you say. Ha – this in India folks; to quote Warren Zevon here, “Life is cheap and death is free.” No guardrails except for the well placed tree or short brick wall.

Day 3 – Break Down Number 1

I must have fallen asleep somewhere along the line as I woke up when the bus stopped. In a bad way. The driver was furiously wrestling with the stick. Clearly something was wrong with the bus. So off we went as it was blazing hot and sitting on Tandoor oven that our bus was to become did not sound like fun. We piled out in the town of Poladpur, or at least I think that was the name. Shamshu told Kaustubh and Amit to make sure that I didn’t get kidnapped. Since he told them first in Hindi, I have to imagine he was vaguely serious. Ah well. In hearing the translation, I told Kaustubh, if asked, that he should say I was he mute little brother.

Standing by the side of the road we ate watermelon. Yes, by this point in the trip I started doing everything they say not to do when traveling to India, including eating raw vegetables. Damn good watermelon, by the way.

I have yet to comment on the driver and his assistant. Kamikaze and Cabin Boy. So picture if you will, a grown man and his prepubescent boy under the bus arguing and fiddling with tools, and there you have the picture that presented us. These guys did not instill the confidence I was hoping to find. Yes, Kamikaze kept the bus from falling off the side, but beyond that, little was confidence building. It was 40kms to the top of the hill over what was promised as very difficult driving. Walking was out of the question. The auto rickshaws were trying to rip us off by charging $3 instead of the more appropriate $1, and that was greatly offensive to everyone. So we waited.

Eventually, Kamikaze got things working. Well, at least he could disengage the clutch and shift. So back on Krishna we went and off we went.

Day 3 – Strawberries

We reached the top of the hill after an hour or two. Upon cresting the hill Krishna came to a stop in the way that a fighter jet landing on an aircraft carrier stops. We had reached strawberry country.

They grow them there and they are damn good. Along with the boiled peanuts and mulberries, we had a great light meal. I was told that the carrots were awesome as well, but warned not to eat them. Apparently, it was thought, that my delicate Western stomach would simply not handle whatever bacterial fun lay in store.

Meanwhile, Kamikaze was furiously pounding on the transmission. It became clear that if we wanted to get going again, we had to push start Krishna. And we did. And Krishna started.

And fifty yards later Krishna stopped dead. So the second shift of pushers got out and got to work. They got Krishna moving again. And Krishna did not stop, not to pick them up, not for any reason. So we blast off down the road with six or so guys left behind. This did not seem to phase anyone. Not sure what to make of that.

Day 3 – Pratapgad and more strawberries

Pratapgad is a fort that was never conquered. It sits atop a ridge with shear cliffs on three sides. The road we took goes near it and let me tell you, it is obvious why this place was never conquered. The road got improbably worse. Twisty. Narrow. And everyone is trying to pass you left, right and center. When I mentioned we went there today to Samir, he responded with, “The road there is very hard to drive.” No shit. The picture I have included here gives you a sense of the height of the climb as well as the twisty nature of the road.

Having come to the area where we were to have lunch, it was revealed that the driver could no longer shift gear and couldn’t really stop either. We avoided numerous near collisions to come to a bumpy stop in front of the restaurant were here were headed. Sending the Short Bus back to get the guys we left behind, we sat and ate. The food was fine. The strawberry milkshake, which was mandatory and considered a delicacy, afterwards, was damn good.

The combination of milkshake and curry became a biological hand grenade in my stomach. One trip to a very scary squat toilet later and things were okay. I was mentally shaken but okay.

Short Bus, in the meantime, had been deployed to get a mechanic, in hopes that he could fix Krishna. Two plus hours later, the mechanic arrived and, in fact, fixed Krishna. Well, fixed in that we still had to push start it. And we pushed it backwards to start it, which seemed a bit odd, but par for the course.

And off we went again.

Day 3 – You can never go home

We drove on through Panchgani which was absolutely beautiful. No wonder why the British built their summer homes there. The view were amazing and definitely worth the trip. We were now headed down the other side of the hills and on to Pune. Victory was in sight.

As the sun was setting, we got on the highway and were just and hour from Pune. And then the bus shook like it was going to fall apart. It came to a stop by the side of highway next to a little temple. We expected that one of the tires had blown. Did I mention that the tires on the right side of the bus were totally bald? But guess what, the tires didn’t blow. The transmission did. Kamikazi and Cabin Boy were back under the bus, but this time we knew we were screwed. A new bus had been summoned. Short Bus was heading back to Pune. They offered to put me on. This was one of those moments where looking back I can say with confidence that I did the right thing. I declined a seat on the bus. As I told Aniruddha and Shamshu, I was the last person to get on Shortie as I no one waiting for me, nothing to do, and nowhere to go.

So we stood by the side of the highway. Santosh and others harvested some veggies from a nearby garden. Kaustubh and I grabbed beers from Krishna. We watched the sun go down over another temple. It was oddly peaceful.

And then it was not so oddly dark. Really dark. An endless sound of truck horns, under-powered motors, and air brakes filled the air.

So standing there in the dark, we drank as much warm beer as we could stomach. Shishir told dirty jokes in Hindi. And we all, slowly, lost our minds together. Waiting for this damn bus. Then we learned that it had overshot us on the highway and was lost. And then we really lost our minds.

Finally, after nearly an hour and half it arrived. Mind you it started only 45 minutes away. We unloaded Krishna and got on this new bus, which was by no means news to the world but new to us.

I’ll sum over the details, but we got back to the office around 11pm, 14 hours after we started. Shamshu dropped off at Gordon House. I tried to shower and sleep off the day. It barely worked.

Conclusions

“It’s all confused and beautiful,” wrote Mike Ladd and I think that that is an accurate description of what I have seen of India so far. I truly did enjoy the trip. The scenery was worth the journey alone and there’s nothing like bonding like be stranded in the middle of nowhere.

Besides the great opportunity I had to break down some of the barriers with the Pune office, here are a few things that I learned:

• Dirty jokes sound the same, roughly, in every language.
• There is no better way to win the trust and respect of another person than by sitting next to them and eating their food.
• If the food thing doesn’t work, try bringing a bottle of Johnnie Walker Green Label. That seems to do just fine.

The new frontier is CaaS – Compliance as [...]]]> My friend Mark MacAuley can always be counted on to stir things up. He’s seen plenty of enterprise deployments and architectures and comes at problems with a combination of Yankee ingenuity and healthy cynicism. Over on Identitystuff, Mark writes about offering Compliance as a service:

The new frontier is CaaS – Compliance as a Service. Fixed cost, consistent automated reporting, a defensible model for implementing and showing transparency.

Although the intent of Compliance is good, in Mark’s estimation Compliance is 100% cost with no positive yield to the bottom line.

The trouble is that Mark refers to Compliance as if it is an IT service that can be delivered like outsourced help desk or security management. Compliance, the Big “C,” cannot be delivered as a service. The Big “C” is the interplay between people, processes, and IT systems to achieve the mission of the business in the context of regulatory and market pressures. It isn’t binary; it isn’t something you have one day and not the next. This dynamic interplay requires continuous measurement and feedback loops to ensure that deviations are corrected and, ideally, prevented.

Compliance is a matter of controls – instituting a variety of controls and then charting the business’ distance in relation to those controls at all times. Let’s take a simple common non-business example. When a cop pulls you over for speeding, you often get asked two questions:

1. Did you see that speed limit sign?
2. Do you know how fast you were going?

This is a simple example of controls in daily life. To track towards Compliance, first, you have to know about the control – awareness of the speed limit. Second, you have to be aware of your relationship to the control – how fast you are going. Finally, you, as a safe driver and responsible citizen, have to continually measure your relation to the control – keep your eye on the speedometer, unless you want a visit from auditors or enforcement agencies.

Expressing, understanding, monitoring, and enforcing controls CAN be delivered as a service. These services, including controls documentation and controls management, address automated and manual controls for IT and non-IT systems and processes. And it is the delivery of these capabilities as a service that can reduce the cost of compliance.

Matt Flynn get’s in on the action and provides a crucial point, if indirectly:

I think there are definitely organizations out there that would love to have a third party who is willing to be an expert and own compliance for them.

It’s people! Compliance is People! This is the other piece of the puzzle and as Matt says, it can be delivered by a third party. Service providers, with deep domain expertise, armed with controls documentation and management tools, can provide holistic compliance services, and with a little creative thinking, a bit of indemnity insurance, they can truly own compliance for an enterprise.

The Big “C” Compliance cannot be delivered as a service, nor by Santa Claus, not for all the tea in China. But that being said, compliance experts and expertise bolstered by controls management and documentation services can help organizations track towards Compliance and be able to adapt as any of the variables in the Compliance equation shift.

(Originally posted over on Audit Trail.)

There are obvious benefits to implementing Oracle [...]]]> Lori Rowland has posted an examination of the state of market given Oracle’s acquisition of LogicalApps. Her analysis of the impact of this acquisition to us independent controls management companies mirrors some of my thoughts on the matter. There was one thing that caught my eye. Lori writes:

There are obvious benefits to implementing Oracle and SAP’s controls management solutions to manage the respective environments. Who knows SAP SOD policies or sensitive transactions better than SAP, right?

Maybe not. I posit that the audit community (both internal and external auditors) have a better sense for what constitutes an SoD violation in their business context than ERP vendors do. Clearly, the ERP vendors know, from a functional stand-point, what each transaction and function does in their products. This enables them to build the “well, duh” SoD policies such as “flag everyone with SAP_ALL.” The “well, duh” SoD policies are the just the ante to play in the controls monitoring game. The meaningful, high value SoD policies come from the audit community and their years of lessons learned working across multiple industry verticals globally. It has yet to been if the ERP vendors will truly cater to this community’s needs. It is the greater audit community that Approva has sought to serve since day one and we’ll continue to do so. Viva independence!

The deal has been announced and will finally be done in November. Nobody is particularly surprised that Oracle is buying LogicalApps, least of all, us here at Approva. With this transaction Oracle will now have a controls automation tool needed to continue its fight with [...]]]> (The following is also available over at Approva’s Audit Trail.)

The deal has been announced and will finally be done in November. Nobody is particularly surprised that Oracle is buying LogicalApps, least of all, us here at Approva. With this transaction Oracle will now have a controls automation tool needed to continue its fight with SAP. Analysts, bloggers, and prospective customers have asked: where does this leave Approva and the answer is – exactly where we want to be: Approva remains the independent controls monitoring company – and the only one with the proven ability to work across applications, in multiple platforms and for any kind of control.

Oracle (and similarly SAP) are taking the approach of strongly tying and embedding their controls monitoring tools in their ERP packages. What’s wrong with this approach? It is fundamentally too limited in scope and vision. Yes, managing controls in ERP systems is critical, especially in a SOX world. But, a tool that scopes controls automation down to SoD analysis for a specific ERP package (and, for that matter, a specific version therein) can only provide a keyhole view and doesn’t truly serve the GRC needs of the enterprise. Since LogicalApps only addressed Oracle E-Business Suite, with this acquisition Oracle continues to neglect its red haired step children: PeopleSoft, JD Edwards, Hyperion, Siebel… where’s the controls love for them?

To say that governance, risk, and compliance (GRC) is an ill-defined piece of buzzword bingo may be the understatement of the last few years. If someone says they have a complete GRC platform to meet all enterprise needs, kindly escort them out of the building via the nearest window. The point is that we, vendors, service providers, and customers, are still feeling out what truly needs to be in a complete GRC solution set and over time “GRC” will continue to evolve before it solidifies into a commonly accepted set of capabilities. Accepting this limited definition of controls automation that ERP vendors are serving up will cost their customers and force them to reinvest over time. By definition, a constrained, embedded approach to controls automation is shortsighted. It cannot meet the future needs of GRC because it cannot adapt to other systems and other processes that will eventually fall under the controls monitoring umbrella.

Approva’s approach has been and will continue to be fundamentally different. By staying independent and ERP agnostic, while at the same time providing rich domain expertise in those ERP packages, we provide customers better controls monitoring capabilities than the ERP vendors. We do this not only in these ERP applications, but we also provide the ability to do so in any application. Furthermore, we do this for any kind of automate-able control, be it traditional authorization-related segregation of duty or any kind of business process that our customers and business partners dream up. And we do all of this without the premium or baggage associated with ERP vendors.

Freedom to monitor any kind of control. Freedom to leverage our deep domain expertise as well as that of our partners in the audit world. Yep, staying independent is all about freedom for Approva and it is this freedom we give to our customers – even Oracle’s red haired step kids. I may not know what the final definition of GRC will be, but I do know that Approva’s independent approach to controls monitoring will serve its customers better than any controls monitoring tool shackled to just a single ERP package.

For those of you headed to Digital ID World, let me know and we can catch up. (I’m looking at you members of the Mark MacAuley supper club.)