Thinking about Matt's Simple Question: Correlating accounts and people

Matt Hamlin, over at Sun, mentioned a conversation we had last week about a topic in identity management which doesn’t usually get a lot of airtime: the correlation of accounts to people. The exercise is the first step in answering Matt’s simple question of “Who has access to what?” Matt writes:

This step is the foundation for Access Certification, Role Mining, Entitlements Management, Policy Evaluation, Identity Auditing, and numerous other custom services developed by our customers.

Trip report from the Privacy Symposium

This is a cross-post from Burton Group’s Identity Blog. BTW, I am moderating a panel at Defrag. If you use “ig1” as a registration code, you get $200 off the registration fee. Hope to see you there! – A few weeks ago I was up in Cambridge at the Privacy Summer Symposium. Gathered together on Harvard’s campus were a collection of lawyers, activists, government officials, and privacy officers discussing various aspects of privacy. It was certainly a bit of a change for me to be in a non-tech heavy conference. Besides hearing people like the chairman of the FTC, William Kovacic, speak, I got to witness the launch of EPIC’s Privacy ‘08 campaign. Further, I got to hear Jeffery Rosen share his thoughts on potential privacy “Chernobyls,” events and trends that will fundamentally alter our privacy in the next 3 to 10 years.

Privacy in Transition - No Kidding

I am headed up to Harvard this evening to attend the Privacy Symposium. I am very much looking forward to this industrial-strength dose of privacy discussions. This will also be a bit different for me as the majority of speakers are lawyers. Usually, I sit in conferences listening to techies and the occasional auditor. The Privacy Symposium speaker list is lawyer and professor heavy with a few representations from the tech world. It ought to be a nice change. The subtitle of this Privacy Symposium is “Privacy in Transition.” Well timed. I look around my neighborhood and my city and I can practically see those transitions in real time. I’ve talked about the security cameras in my neighborhood before. This weekend, the Washington Post reports that DC is planning on sing license plate readers to “fight terrorism.” Find stolen cars - sure. Find Osama bin laden - not so much. The District has got to release data retention plans for this data quickly. For now, the word is that this data will not be retained. The systems checks plates against “Federal databases” and looks for matches. (How long until we have a No-Fly list equivalent of license plates?) I have to imagine that the data retention policy will change very quickly. How long until third parties get access to this data? I can see the District using the revenue it makes from selling access to this data to divorce lawyers to pay for school repairs. At any rate, I’ll be in Cambridge this week mulling some of these ideas over hearing more on matters like these. See you there.

What happens in Dapoli stays in Dapoli: A Trip Report

[Some friends from Approva were in town from Pune, India. They had read my trip report on our company trip to the beach in Dapoli and found it hilarious. They implored me to post it up on tuesday night.]

Day 1 - A Good Start

Hare Krishna bus: hare, hare, krishna, krishna

Hare Krishna bus: hare, hare, krishna, krishna

After Shamshu (or Uncle as he is known in the office) picked me up at oh-dark-thirty, we headed to the office. There in watching everyone try and get organized, I introduced him to the expression “herding cats.” I knew I was in for a good time when I noticed dried vomit festooned on the side of the bus. Shortly after, Shamshu asked, with a slight malevolent grin, “Do you get the motion sickness?” I do, Shamshu, I do indeed, but I had prepared for such a situation by doping up appropriately. So off we went, about 2 hours later than we were supposed to. And by off we went I mean to say, we started fighting through traffic in Pune. Both buses stopped a while later to pick up more people. (There were two buses. Hare Krishna, seen above, and The Short Bus, which will be taking a prominent role in a moment.) In the crew that we picked up at the second included Shishir, Kaustubh, and Aniruddha. After much back and forth, it was decided that the drinkers and smokers would take The Short Bus and everyone else would ride with Krishna. So off we went… again.
Breaks to pee: A common trip activity

Breaks to pee: A common trip activity

McSweeney's 28 unboxing

I love McSweeney’s, both the quarterly collection of literature as well their other publications and books. Besides the care and crafting of the content, the quarterly collections have really interesting artwork and packaging. I just got issue 28 and this one takes the cake from the packaging perspective. And then I thought, “why is it that only Apple products get unboxing photos?” So, for your pleasure, I present to you the McSweeney’s Issue 28 unboxing. You’ll note that each little book is one story.

Someone paid for this ad campaign?

What is Abigail saying?

What is Abigail saying?

I saw the attached poster today in Union Station. I stood and stared at it wondering whether I read it correctly. Then I took a picture of it and stared at that for a while. Using Adams bank gives Abigail Adams the vapors? And that’s supposed to be a good thing? Having the vapors was a medical term used roughly around the time of the Civil War, which was fifty years after Abby Adams was dead. It was used to refer to nervous disorders like depression or hysteria. There’s a misconception that it was also used to refer to flatulence, though I cannot find hard evidence of that. Either way an ATM that gives me gas with a bought of depression seems like a place I want to bank. I wonder if the bank gives away a combination of Gas-X and Zoloft with every checking account? Someone paid for this ad? I think Creative got a little too creative.

FullWrite for OS X?

I have a lot of old work still locked up in FullWrite format. What’s FullWrite you ask? Only the best word processor ever made. Ever. It was intuitive. It was as featured as was necessary. It was fast. It just worked. A classic Mac application if there ever was one. I can still run it today by using the Classic environment in OS X 10.4. The problem is that some day, in the not too distant future, I am going to go to 10.5 and that means no more Classic OS 9 and thus no more FullWrite. I have converted most of my documents but I still have a worry that I’ve miss something. Does anyone know if someone has ported FullWrite to OS X? Can any of the newer processor convert FullWrite docs? The only thing I have found so far is this post which most extols the virtues of FullWrite. Anyone out there have a good solution for document conversion?

Photography in DC

As you probably know, I live in Washington DC. I take photographs in DC as well. We’ve got a few quirky rules here about that. For example, if you are on National Park land, you cannot use any photographic equipment that touches the ground. As you can imagine using tripods becomes a bit tricky. But beyond that, I haven’t heard of many photographers getting harassed in the name of security, unlike Chicago and London. Then I read this piece in the Post today. Glad to see that Eleanor Holmes Norton getting involved. Her Open Society with Security Act bill is certainly intriguing.

I'm going to Defrag... help me figure out what to do when I get there

I am headed to this year’s Defrag conference and I pumped to do so. I didn’t get to go last year which I really regretted, and Eric hasn’t let me forget that either. I will be moderating a panel called: Can identity be a filter for information overload? Eric and I are in search of interesting people and points of view to include on this panel. On first blush, to me, this sounds like a discussion of the current state of personalization. Eric isn’t sold yet on that angle. I’d be interested to learn if/how personalization is moving from explicit declarations, “I like cake,” to something more implicit, “From examining your read RSS feeds, Computer thinks you like cake.” Putting on my enterprise identity hat, I start to wonder if my role and relationship to my employer has a hand in this. Again, this ought to be an interpretation of pattern and not an explicit assignment. I am a senior analyst at Burton Group focused on identity and privacy. I share interests with my team. Collectively this blob of information (feeds, groups, sites, etc) is likely to be of interest to us. Further, I am curious how my role and relationship combined with a Google Search Appliance or SharePoint can act as a filter. Finally, I can’t help but think of the privacy implications here. Traffic analysis can and will start to reveal my preferences, and there definitely are privacy implications to this. Add extra data to the mix, like location, and the privacy concerns grow quickly. (I swear there are moments that my iPhone seems eerily like HAL.) How does industry handle my contradicting desires to filter based on my identity (and here I am including preferences as part of my identity) while not revealing too much about me? What is too much anyway? Who gets to decide? At any rate, if you’ve got some ideas on the matter, please send them to Eric and me - operators are standing by.