Here is the password policy of one very large financial institution… seriously?  I have and use a hand full of passwords for various online accounts which I have used since the beginning of time.  Most people will run out of variations on the common pass*word* that they will begin to form really bad habits, making their online accounts less secure.  Like say, writing passwords down on paper or saving them in a insecure file on my computer (which I do from time to time) undermines the very security that was meant to be in the first place. 

Then there’s my wife’s headaches of working with the online account tools of a local bank in a suburb of Seattle, that forced her to have password reset codes sent to her cell phone repeatedly because the bank’s website no longer recognized the browser or PC that she used to login.  That’s typically a problem when your identity is tightly embedded into the PC or browser via cookies or registry values that is supposed to help prevent unauthorized access.  Over course of several days, using one of several different PCs in our house, she managed to re-verify herself and lock out her account 3 times.  What s dreadful password policy that other smart people undoubtedly have endured….  As if we don’t have enough phone calls to make or things to do in one day. *sigh*

 So what’s the answer?

Listen to your customers!   Balance end-user compassion with account security and privacy mechanisms.  Password policy need not be so complex.  Some solutions, such as Oracle Adaptive Access Manager, work on the back end monitoring login attempts based on signature files and patterns of hacking activity, which in turn can result in a huge boost of compassion for your end-users.

So what are your experiences with insane password policies?  How many passwords do you have?

Oracle IdM by Marlin Pohlman

Oracle Identity Management by Marlin Pohlman. This is IdM & GRC 101 as far as Oracle is concerned, folks. It’s comprehensive in scope and decidedly biased towards the incredible technology from the largest software company in the world. After giving a nice overview of each technology in Oracle’s IdM suite, it gives a comprehensive and accessible reference on governance and compliance for multi-national businesses. A must read for any IdM engineer looking to rise above his or her reputation as IdM Admin, and also for managers looking to get a better grasp of the wide ranging technology in the IdM Suite.

A Subscription to Dr. K’s blog Talking Identity – The Dr. is in and he will see you now. Here’s another wish that shows my Oracle bias. The blog contains architectural gems in the world of IdM, and is blazing trails in security and identity issues for cloud computing. Best of all, it’s free!

LDAP Browser/Editor v2.81 – Here it is. The lightest weight LDAP browser/editor on the planet (that I’m aware of) and it’s yours for free, assuming you can still find it. The internet went silent in early 2009 and the publisher’s original download URL disappeared. Where did our friend Mr. Gawor go, anyone? Any ways, the first and last thing I’d ever need to do in IdM is browse, search and edit basic information like user profile attributes, and the occassional import or export of an ldif file. There are no schema editing capabilities, but how often does one really need that? I’ve been doing this job for 10 years and of all the tools I have used, this is at the top of my list.

Oracle Unified Method – Another one of Dr. Pohlman’s brain children, OUM is the next best thing to working with Oracle Consulting, although you may need to work with OCS to get your hands on a copy. This is a wealth of resources to ensure smooth delivery of your IdM projects. From Detailed Design, to QA, Support and Training, it’s all in there. A more or less Oracle flavor of RUP.

Microsoft OneNote – Every now and then Microsoft works out something very cool. Think Windows 7 and Zune HD for example. Love em or hate em, Microsoft is a part of (most) all our daily lives. OneNote is one tool that helps me take names and kick butt every single day. You want a business justification on the mertis of OAM vs. ESSO? Meeting minutes with in-line commentary? Technical analysis and post mortem of the latest production outage? OneNote is an extension of my brain, a place to capture and share all of that unstructured data that is all around. When it’s time to compare notes, present ideas or persuade others quickly without writing a book, just Send > Email Page As PDF and go on with the rest of your day. It’s easy to use, efficient and just amazing tool! My colleagues rarely (if ever) see anything but PDFs from me, and all by design. It’s a game of knowledge management, sharing, presenting and persuading, and for that Office in General and OneNote in particular is your new best friend.

OpenID – The value proposition for OpenID is teriffic! If you tire of filling out registration forms or challenged by remembering your password for the nth time, then it’s time for you to get your OpenID. Not that this hasn’t been tried before (Passport, anyone?) I can’t seem to think of any other way than this time it’s going to be different. It’s not owned by Microsoft or any one vendor, is already being used by some very big hitters like Google, Yahoo, Flickr, etc… and I’m sure there will be lots more in 2010 that come on board. This nifty tool will not only save you time and headaches, as someone more career minded in the Identity and Security industry, it will help you stay engaged with and supportive of the issues that the industry faces right now.

VMware Workstation 7 – And last but not least, VMware Workstation 7 (and not because I’m an employee either *grin* ) – I can step into nearly any business regardless of size, OS, DB or App version and build a slightly replicated environment to test anything from bug fixes, interoperability issues, enhancements or upgrades. It’s an invaluable tool for anything from development to QA, and can save an insane amount of time and money on your IdM projects. I admire any company who bakes this (or VM ESX or Infrastructure) into their development lifecycle. It’s an amazing technology!

Merry Christmas, everyone!

So thanks for visiting! Please pardon me while I clean things up a bit. I expect to have things in order and ready to rock and roll around the first of the year. If you are interested in following this blog, click on the RSS link to the right and add it to your favorite blog reader.

Cheers!

Another item of interest that the editors missed (My notes, which were supposed to be printed but weren’t) is the fact that my colleague Gabriel Paez was a key contribute to this month’s articles, providing the technical reviews of the websites showcased in the article.  I owe much of the credit to Gabe.  He was the Flash developer for Coffeehouse Photography website, and is a truly talented professional in this area.  Thanks, Gabe!

So here’s the link if you are interested in reading it.  Post your comments on my Facebook Wall, or shoot me an email.

Happy Thanksgiving, everyone!

http://www.stevetout.com/articles/high-performance-websites-reviews.php

However this morning (Sunday), horror struck as my wife informed me her latest Win7 build (Release 7201) stopped working (7:40 AM).  She couldn’t login to her desktop.  Being the tech guy that I am, her hard drive is has 2 partitions, one for the OS (40GB) and the rest for “Data” ~ 120GB and every user/app setting is backed up to the Data drive.  I tried loging in to her desktop 3 times (8:40, second cup of coffee and Molly by my side) to realize it was time to boot in Safe Mode.  Logging in with Safe Mode I found 1.) Windows Media Player netowrking service consumes a lot of network and CPU bandwidth once enabled and 2.) Network share of a nearby (Win7, of course) PC in Sleep mode caused boot delays.  Still after disabling Startup programs in the boot menu, I was unable to boot up properly. (9:30 AM)

Windows 7:  Fools game or Mastermind of time management?

Today was a tricky one to have troubles with a PC. I had a flight to catch (which I missed) at 4:24, had to leave home by 2:00 in order to catch the flight, although post July 4th traffic would kill off any such aspirations.  Also I was informed of a honey-do list that included A.) Fix the back door from opening so Molly could not escape, B.) Fix the teeter swing in back yard C.) Get milk, and D.) Pick up prescriptions, and most important E.) Fix my PC, even if it requires installing “With Windows 2.0… I don’t care what version of Windows!!!” I could have hyperventilated with all that was to be accomplished by 2:00.  Windows 2.0 honey?  C’mon, I don’t have a copy of that anymore, that would require a tript to my friend Doug Dayton’s house (Microsoft’s 169th employee and Windows OEM Sales Guru) and there’s just not enough time for that (10:30).

Kicked off file system restore.  Took a shower and finished packing.   Attempted “Repair PC” option from Boot menu.  Started new Windows 7 Install (10:45) which finishes in near record time thanks to streamlined install process.  Reviewed USB ports (drivers) and installed programs post install before heading to Fred Meyer (11:30).  Installed MS Money and Office 2010 Tech Preview.  Started Windows Backup (11:45) and went to Fred Meyer.  Returned (12:15) backup complete, yay!  Next time this restore process will only take an hour or less.  Stopped for awhile and to have lunch with Molly and Cami. Chicken sandwich.

Wow!  How could this happen to me on the day like this, little would I know it would only get worse in Tacoma Narros toll traffic *sigh* and so continued restoring Cami’s Laptop with all personal files by 1:30.  Forgets to install Pidgin, so she takes upon herself to install it herself (bless her) so we can chat on IM tonight from my hotel room.  It seems as though 98% of reinstall and restore tasks are complete (still need to fine tune network share, wake on lan, install Java and Business Accounting, and a few other small items…) so a sigh of relief.

It’s beautiful outside although clouds are flying high Cami and I go outside and lay on the grass and talk about the weekend, our rental in Oregon, and how nice it would be to have our own home here (in Washington).  I take mental notes about packing cell phone battery charger, medications, and throw on a quick deodorant before heading out the door.  Sends text to Cami (to her fresh Windows 7 PC) from my phone while driving.  Whew, everything is okay!!!

Did Windows 7 just save my day and avert a disaster of the most extraordinary kind? 
Someone is lucky that Windows 7 is so amazing, or that she has an engineer as a husband! 

Happy Monday!

P.S. What went wrong with Win7 in the first place?  I’m not convinced that it was Windows fault since it’s running fine on another laptop and a home built PC, and take more issues with the hack jobs that Sony did when coming up with Drivers for Vista, and of course there are no new drivers for this Windows 7, and Sony just expects you to run Vista Home for the rest of its life.  Anyways I’m suspicious of the Sony drivers, which I had uninistalled after installing them before.  So moral of the story is, Sony laptop owners beware.  I always seem to have most issues with drivers for Sony products whenever any configuration outside of the shipped OS is used.

http://www.maximumpc.com/article/features/25_most_popular_windows_tips

http://www.maximumpc.com/article/features/21_steps_make_your_pc_betterfasterstronger

Thanks for all the kind feedback about the latest Rangefinder article on securing your images for online portolios and online proofing. 

Frequently in interviews and computer science classes the rhetorical question gets asked, “Would Windows be so successful if it was more secure from the start?”  I think that’s a great question, one deserving more contemplation rather than declaring abolsutely whether it’s true or not.  If Windows was more secure, would it have been user friendly enough for adoption by the masses?  (UAC annoyances anyone?)  Of course now that Windows is on practically every desk and lap in the world, there is a bit more to worry about if we don’t address the security issues.

Now, I wonder if there are any parallels to the way photographers share their images online.  What is there to be afraid of?  Are you afraid of the embarassment that others will poke fun that your work isn’t relevant or compelling?  Are you afraid that someone might get away without paying for a couple hacked up 5×7 prints?  Are you afraid that your clients will get mad if their images are passed around online without their permission? 

Well then, start by addressing all your fears one by one instead of going the opposite extreme and locking them down tight.  Stop using gaudy borders and don’t watermark your images to death.  Take away all of the distracting elements and let a person focus on the quality and crafstmanship of your photography.  Go to a couple workshops to improve your digital imaging or photographic skills and get yourself inspired!  Make sure your clients know in advance that you own the copyright to your images (of them) and that you may at your own discretion use the work in a public forum for portfolio and publicity of your photography business.  Restrictions in usage rights due to model release and negotations for privacy should be an exception rather than the rule if you are to keep your business moving forward.  Because if you can’t show your work, you can’t sell your services as a photographer.

So lighten up on your heavy handed use of watermarks and JavaScript to lock down your images. Really spend the time to think about how you can turn your strategy upside down by creating business oportunities through the way your images are displayed and shared online. 

Here’s the link for ya.  (It links to the Rangefinder article, so you can trust where the PDF link comes from.)

http://www.stevetout.com/articles/web-security-for-photographers.php

Special thanks to contributing photographers who graciously allowed me to use beautiful images from their portfolio.  Kenny Kim, The Photographers, Cheryl Savan and Corey Hilz. 

Also, stay tuned, as I am currently collaborating with an Sr. Flash Developer with guru status on the Top 5 performance grading criteria for Flash Websites for photographers, and with evaluations of some of the top vendors specializing in websites for photographers.  You’ll have to wait for further details.

I hope you enjoy.  Please feel free to leave your comments on the article here in my blog, or you can share your horror stories with me at HowSecureAmI@stevetout.com. 

Today is my last day at Oracle, and it’s a bit of a sad day.  I have had the pleasure of working with some of the smartest Oracle professionals on the planet (OCS Security Practice, A-Team, OID gurus and Support team you know who you are) but at the same time I really needed a break from life on the road.  At a time such as this in our country, I feel extremely fortunate and blessed to be leaving on my terms (more about this in a second), rather than being terminated due to downsizing.  I feel blessed in countless ways.

There is a little bit of background to my leaving Oracle.  I remember the excitement when I first got contacted by the recruiter like it was yesterday, although not too surprised since I had been using Oracle (Oblix) software for quite awhile, I did have to reckon with the fact I would have to travel 100%.  I accepted the job at Oracle and made a promise to my wife that I would spend the next 2 years at the job, and then find something that did not require so much travel.  While I wish I could attribute it all to great planning, I submitted my resignation on the week of my 2nd year anniversary.  Sometimes things happen just the way we want them to by pure luck, or is it?.  However you see it, I’m extremely greatful and looking forward to spending more time at home.

Now to the not so happy side of my departure.  Many of you may know that my daughter (Molly) was born with a rare children’s cancer called Wilms tumor.  She had a positive prognosis because it was caught early, and had her right kidney removed along with the tumor itself.  After months of chemo, we believed she was 100% cancer free.  Until 2 weeks ago.  On the same day that we were supposed to have 100% confidence that she was cured from Wilms, her scans showed two .6c spots near where her kidney was removed.  My wife and I were crushed.  The Sr. Oncologist thought it perhaps could be swollen lymph nodes, and to come back in 6 weeks for more scans to make sure.  We are hoping and praying that this is the case, and that there is no more cancer.  So with the cloud of uncertainty again visiting the Tout household, my departure from the Road Warrior life was necessary.  I could not very well be the husband and father I was meant to by from 838 miles away. 

What I have learned and need to remind myself of every day is that there are no guarantees and to take each day as it comes.  I have had a truly wonderful experience working at Oracle and with my many colleagues there.  Since my wife and I have had this vision of where we wanted to be on this day, I feel like the decisions have been made for me and I am encouraged that I’m doing the right thing.  Although the path is not as extremely well lit as it once was, there will be new challenges around the corner and I know that the friendships I have made and the life skills I developed at Oracle will be there when they are most needed.

Many thanks to all of you who have helped make mine, Cami’s and Molly’s life so positive and filled with joy the past two years.  We are looking forward to what comes next and hope you will share in our life’s victories and defeats together.

-steve
Bremerton, WA ~ 2009

Heads up…. Yet another article just appeared on the Rangefinder Website a couple days ago.  This time I share my thoughts on the Top 3 Priorities for website updates for 2009.  You may not get the print copy before WPPI so I wanted to make sure you had a chance to read it before this weekend.  If you are like me you are super busy and have a lot on your plate, so to simplify things I reduce your website management to 3 essential ingredients.  If you can do these three things well you will be ahead of the pack, and your results will speak for themselves. 

So here is a link to the article.  Please do me a favor and add this link to your favorite social bookmarks and let all your friends know about if (if you dig it)

http://www.stevetout.com/articles/update-your-website.php

Also just want to give props to Grant and Deb, their awesome website and allowing me to share their work with everyone who reads my column.  If you want to explore their site further, visit them at http://www.grantdeb.com 

It’s not too late to nominate your favorite photography website for one of my upcoming articles on Best Of Photography Websites, Spring 2009 Edition.  Send your nomination to bestof@stevetout.com or post your info here.

Have a great time at WPPI this year everyone!!!

Cheers!