Category Archives: Poetry

Energy, Poetry, Security

Cloud Security Different, Says Okta

Leave a comment

Okta has announced their series B financing today. It includes a recap of security in the cloud that reveals how they pitched it for money, and why it’s different:

The concepts of security, single sign on, user management and auditing are not new. They’ve existed since the first user logged into the first mainframe. Why is the problem different or the potential solutions better in the cloud?

  • There are more services and applications available to users within an enterprise than ever before.
  • The cost to build, deliver and sell the services is dramatically lower leading to more services available in the market. Literally, thousands of new SaaS start ups have spawned in the last 10 years.
  • Companies aren’t limited by their ability to build infrastructure to deploy and maintain as many applications as they want.
  • In addition to more services, there are more users. Each generation of technology, from mainframe to mini computers to client server to cloud has seen a 10X increase in the number of users. And each of these users is accessing the services in a variety of ways. Gone are the days of one desktop per employee. There are desktops, laptops, virtual desktops, tables and smart phones
  • Finally, companies need to support a mobile workforce. They can no longer rely on securing the physical network perimeter with a firewall and selectively permitting VPN access. They need to have the same kind of rich authentication, authorization, auditing and logging for all their critical services.

Call me anal, or haiku-obsessed, but it looks like that lists boils down into the following:

  • More services are available
  • It costs less to build services
  • Infrastructure costs are lower
  • There are more users
  • Users are mobile

Wait, let me try that again.

  • More services now
  • Can’t stop the mobile access
  • Deployed for less dough

Coming up with definitions and finding differences is fun. Who doesn’t love isomorphism? When is a muscle-car a muscle-car? I mean if a Toyota Camry races a Pontiac GTO and wins, do we still get to call the GTO a muscle-car or does the Camry get the title? More to the point, if we accept the Okta explanation, clouds do not seem far ahead of traditional IT departments. What really stops on-premise IT from providing more services at less cost to more users who are mobile?

But there’s more to a muscle-car than just measuring horsepower (the 268 horsepower Camry LE is still a second slower than a goat BTW. Efficiency is another story). Okta could have highlighted the new cloud use-cases and security issues from cloud behavior.

Many more roles/identities with far more relationships and yet less permanence are cloud specific. Tracking identities and meta-directory data when it’s not clear who exactly should be the one to track identities, now that’s a different problem than on premise where accounts are doled out more carefully by a clear authority.

They also could have highlighted the tall and wide shadows of data created and then “destroyed” when accounts and services are spun up and down on short cycles because “owners” come and go. You thought keeping track of hires and terminations was hard before, try managing it for systems you can’t see or touch and only get a utilization report from. That’s another difference, a sort of opaqueness to their hidden services with their secretive SRE (service reliability engineers), which all may be completely untrustworthy.

Maybe it’s all coming in their next installment and I’m just jumping the gun.

For now, congrats go to them for round B. Perhaps it’s best to end by saying they are in a great market space — cloud providers clearly need identity management solutions like a GTO needs seat belts, air bags and a catalytic converter to control behavior-induced risk.

Poetry

Microphone Fiend

Leave a comment

by Eric B. and Rakim, Follow the Leader

I was a fiend before I became a teen
I melted microphones instead of cones of ice cream
Music orientated so when hip-hop was originated
Fitted like pieces of puzzles, complicated

’cause I grabbed the mic and try to say, yes y’all
They tried to take it, and say that I’m too small
Cool, ’cause I don’t get upset
I kick a hole in the speaker, pull the plug, then I jet

Back to the lab without a mic to grab
So then I add all the rhymes I had
One after the other one, then I make another one
To dis the opposite then ask if the brother’s done

Food, Poetry, Security

National Cloud BBQ on a Train Nightmare

Leave a comment

A TechTarget writer has written an emotional rant against regulation of cloud computing. It’s thick with prose and allegory, perhaps to hide the fact that it has little to offer the reader in terms of logic and reason. Here’s a fine example:

The cloud train is rolling, and locomotives (and their engineers) do not appreciate it when morons in suits barge in and start pulling levers for no earthly good reason. I’m all for consumer privacy and commercial accountability; pass laws that simply forbid bad actions, not make technologists and enterprises jump through crazy hoops.

Simply forbid bad actions? What makes it so simple? No explanation of these simple laws is offered and they seem to contradict with his earlier argument.

First, he is asking for a blacklist, or a list of things that are disallowed. A whitelist would be a list of things allowed. There are flaws in both lists (and blacklists are especially hard to write well) so it’s best to have a balance of each.

Driving a car, for example, you will see signs that say “No right turn” as well as signs that say “Speed 55”. A car that makes a right turn is violating the blacklist, a car that drives more than 55 is violating the whitelist. Actually, to be more accurate, anyone who is driving a speed that is “safe and prudent for current conditions” is on the whitelist. Imagine an intersection that has a sign posted for every conceivable “bad action” with a vehicle and you will see why blacklists are not so simple.

Second, let’s say we go along with the author’s suggestion and only write blacklists, we still need cloud environments to accept them. The common way to audit a company for adoption of a rule is to review their written/documented policies. So it’s probably safe to say that the author intends for his “forbid bad actions” laws to be turned into company policy, which then needs to be audited. That turns out to be what is being proposed and yet what he is trying to complain about — a contradiction.

The DATA legislation, for example, would call for IT shops to “require each person engaged in interstate commerce that owns or possesses data containing personal information, or contracts to have any third-party entity maintain such data for such person, to establish and implement policies and procedures regarding information security practices for the treatment and protection of personal information.”

No matter where you or your data resides, it is subject to audits on demand. Your data management tools can handle that in a snap, right? On no wait, they can’t. Those tools don’t exist. Looks like you’ll be on your knees begging sales, HR, your payment processors, your vendors, your partners and your customers for all that crap — and legal will still find a way to blame IT.

His interpretation is clearly off the mark (another reason why blacklists are not simple). The legislation he quotes asks an auditor to confirm that polices and procedures for security practices are in place. This is not a request for “data management tools”. Note the contempt the author has for “legal”. Perhaps it’s the same contempt he has for the “morons in suits”?

The author is basically expressing frustration with regulation at a very visceral but unqualified level. We’ve all been there. Then we calm down and do the research. Some laws are just written poorly and need to be improved, while some laws are based on real harm. Thus, without quantifying a negative example, his argument boils away entirely. The one and only case he gives us is that some people” he knows use multiple systems.

“The move to the cloud is one of the defining information technology trends of the early 21st century,” says John Villasenor of the Brookings Institution. Therefore, he writes in part, the feds should probably clarify what it means to read regulated email or electronic documents on your phone while overseas.

Please, dear god, no. Do not do that. I’ve seen federal data standards in action. I know people with two phones and three computers they have to use for different federal requirements. They have to fill out paperwork if they send an email from the wrong device. It’s like Kafka meets Cthulhu and the end result torments your soul in non-Euclidean email shape for the rest of eternity.

I’m missing the jump from using three different devices to Kafka and HP Lovecraft. And then to prayer? Seriously. I use dozens of devices for different requirements every day and if I make a mistake that involves risk to others’ data, then I’ll be filling out paperwork. It makes sense to me when regulations reflect appropriate ways to deal with risk. I see the 50% risk reduction from seatbelts and I take the time to put mine on, even without the fine.

Incidentally, religion and god…very regulatory.

I could tell all my clients to just trust me and keep their audits and regulations to themselves, but that’s not going to compete very well when there are others who agree to the common practices of transparency and disclosure in their work. In other words, and to turn it around, those who want to compete on a level playing field will appreciate rules that embody common practices to reduce risk. Restaurants who keep their kitchens clean to protect the health of their customers also do not want to be disadvantaged against their competition for doing the right thing (whitelist).

As much as I would like to say that I find the author’s playfulness with language amusing, instead I find his style has too much emphasis on apathy and impatience. Compliance is “extremely boring”?

Two items in the extremely boring but very important arena of federal regulations came up this week that touch on cloud computing…

[…]

If you think that reporting on, reading about or examining federal regulation of the IT sector is hot stuff and not boring, I do not want to come to your cookout. However, it is incredibly important right now, in the same way a truck is incredibly important when you are standing on the highway.

Oh no, risk mitigation is coming. Hide the kids before the risk reduction measures are here. The truck simile makes no sense.

I’m sure he would turn down my invitation to a cookout, since I would have put it the other way. If you think everything and everyone should get out of the way of a truck just because it’s barreling down the highway…then you either don’t believe in the market for brakes and suspension products or you under appreciate how exciting it can be to help save lives and create prosperity. The nightmare is a world that has no way to stop giant trucks from running us over.