IAM – Object management Part 6

Part the last.  It has been well over a month since part 5.  I wanted to finish this overview before I do ny talking about specific solutions.

I’ve read several papers lately that provide an overview similar to what I’ve attempted.  Better than this.  Most focus on planning an IAM project.  They generally identify three goals: cost reduction, security and compliance.  Hopefully there has been information on all three of those goals peppered into my blogs until now.

Today is specifically about auditing and compliance.  Through every part of this I’ve mentioned keeping a log, but mostly focused on a change log.  The full auditing that is required for your IAM solution will likely be greater than that.

When you look at this there are four areas of logging to consider:

1) User activity – both normal and abnormal.  User activity would be authenticating, authorizing, password changes and self-managed data changes.  Abnormal activity is attempts to access unauthorized data or resources, authentication attempts outside of allowed windows, multiple logon failures, logons from unauthorized terminals, etc.  Normal activity should have a policy for retention.  Additionally you will want to give some thought to how the data will be used.  If you want to use the data to form a trail of the users activity it will need to be mined from the complete logs.  This might require additional tools or functionality in you IAM solution.  Normal data can also be used for capacity management for the system or for the systems that the IAM solution is protecting.  Abnormal data will need to be actively monitored with threshholds for investigation and alerting.  You might need different policies on alerting and investigation for normal accounts vs. privileged accounts.   Or normal accounts attempting access on privileged data or resources.

2) Object Administration – This will fall into two pieces.  Change logs from the change management system and audit logs of changes within the IAM solution itself.  In general this is simply another form of normal activity for the product so all the guidelines I just mentioned apply.  Think about what reports will be needed and what will need active alerting.

3) Configuration Changes – Once again there will be two pieces.  The change logs and audit logs for the product.  Some configuration might be done outside the product as well – OS, database, configuration files, etc.  Another item to consider for both this and object administration is whether you want to have configuration management controls.  That is controls within the product or integrated into the product that prevent changes without approval.  A basic form of this exists in Windows – an object can be marked to prevent deletion.  The prevent deletion box needs to be unchecked explicitly.  The concept can be expanded to any change within the tool.  The main reason for such a change is to prevent accidents.  Mass deletions or adding ‘Everyone’ to a priviliged access group.

4) Access tracking – none of the activity logs will be able to produce some of the basic reports you will need.  Can Suzy access resource X?  Who can access resource X?  What are all the resources Suzy has access to?  These questions range from simple to difficult.  For instance in Windows the first can be answered by looking at the ACL and seeing if Suzy is explicitly there or a member of any listed groups.  With group nesting this might take a few minutes, but can be done by hand petty quickly.  The second question is much trickier and will take a while to do by hand, but is pretty easy to script.  The third is nearly impossible in Windows.  Either a 3rd party product is needed or a script that can walk all the acls looking for anywhere Suzy or her groups SIDs are located – this is both hugely time and resource intensive.  In other systems the questions might be much easier to answer or harder.

When answered what is needed it is important to also determine what isn’t.  The volume of auditing data can potentially be huge.  Turning on all auditing could be a resource hog and produce so much data as to be practically useless.   If there are legislative or other compliance regulations or security policies look to them.  Determine what will be needed to troubleshoot normal problems.  Determine what will be needed to demonstrate ongoing efficient and secure operation of the system.  Resist the urge to turn on logging in addition to this.

If additional logging will be needed during change implementation or troubleshooting determine what the impact of enabling it will be.

Also remember that the auditing data is also part of a person’s personal information and will need to comply with the privacy regulations you are under.  In particular that means don’t collect what you don’t need, don’t disclose and delete when it is no longer required.

That is all I have to say about that.  If I do any additional IAM blogs they will be about specific issues and/or products.



Weekly Recap

It is cheating to make the weekly recap my blog for the day.  This will be very short.  Short and a day late again.

I did nothing last week.  It was very nice.  My biggest accomplishment was to make a list of things that needed to be done this week.  15 things left to do on that list.

My days were full of television and reading a new RPG.  The television is Doctor Who and I have either one or two blogs in me about that specifically.  The game is Diaspora and it is pretty brilliant.  Sorry.  Brilliant is a Doctor Who word.  It is more Todd like to say groovy.

Let’s see what else did i do.  I had a nice chat with Dave on Thursday night.  He seems OK.  Visited Dad before and after the procedure in the hospital.  He seems OK.  Tim came over on Wednesday.  He seems OK.

Had lunch with the crew on Friday.  Didn’t talk much with Paulo and Runtao.  Nuts.  The others seemed OK.

Gaming on Friday was cool.  We had seven people out.  We had a game of Nuns on the Run that was unsatisfying.  I was on a nigh perfect run I thought.  Ran full out every turn except two.  I was caught at the very end, but Robin was already back in his cell.  The unsatisfying bit was both that the nuns didn’t really seem to stand a chance plus Rob was just so far ahead of me.

Then I played a game of Mystery Express.  Again it was unsatisfying.  But this time it was because i played poorly.  Both Robin and Pauly just soundly outplayed me.  I never had a good plan and I was asleep at the wheel.  I want to play that one with 5 people.  How tough would that become?  The amount of unknown information would increase but the # of turns you get wouldn’t.  So the end game would less likely have anyone with a complete solution.  I also think the Orange special ability would become less useful too – or rather the other colour abilities more so since the likelihood of them being used every round would increase.

The other half played Defenders of the Realm.  Sigh.  I really want to play that too.  But it seemed a bit involved.  I wonder if Pandemic might be better just because it is simpler…  I dunno.  I need to play it first.

Finally played a couple rounds of Dominion.  I like Dominion.  Never goes wrong with me.

That would be about it.  There were also comics.  But there are almost always comics.  🙂  I’ll try something more substantial tomorrow.  I should be almost out of Doctor Who by then.

Origin Stories

I’m not a big fan of origin stories.  Seems odd since that is what often gets made into the movies, but I think stories are stronger once they move beyond the origins.  I’ll use Iron Man 2, Spidey 2, and The Dark Knight as recent examples.

I see three flaws in origins stories.

1. Many of them are repeats of one another.  What is the difference between the origin of the Punisher and Batman?  Only details and the reaction to the event.    The Punisher uses the skull to strike fear.  Batman uses bats.  The Punisher is motivated by revenge and Batman by justice or simply to prevent additional tragedies.  But the origins are the same.  Family is murdered and the hero uses training, equipment and knowledge to wage a war back on criminals.  How many are variations on science/magic gone bad?  Gifts from beyond (aliens, gods, etc.)?  Or the result of an accident?  Maybe all three in combination…  So I have a problem with them due to their lack of variety.

2. Many of them are quite bad.  You have Batman, Spidey and Supes as the cream of the crop.  An origin story that related directly to the type of hero that they become.  But many are simply explanations and lack explaining motivations and theme.  Mutants are the classic example of bad origin stories.  Literally Stan Lee was bored of inventing origins so he came up with a concept that didn’t require them.  Except Wolverine (whose Weapon X origin is quite good, but whose Origin origin is weak), the story is always, they develop powers spontaneously, they are feared and hated by the mob and Prof x comes and rescues them and inducts them into his school.  Or the Hulk.  It is a classic science gone bad story, but it lacks the poetry of the Jekyll and Hyde origin it steals from.  What does a gamma bomb and rescuing an innocent have to do with a man vs. monster story?  Or Dr. Strange is particularly bad.  He is a vain arrogant surgeon.  So he gets in a car accident (?) and injures his hands and can never operate again.  He searches for alternate remedies and discovers magic.  He never does heal his hands, but does become a kick butt magician.  Oh, and he is still pretty arrogant.   He is the Sorcerer Supreme for crying out loud.  The DC origins for the Flash., Green Lantern and Green Arrow aren’t quite as bad.  But they are close.  Generally they lack a thematic of character tie to the hero.

3. They show a weakness in the follow up tales.  Two of them actually.  First the character before the origin story is often completely different than after.  The change is so drastic they may as well be two different characters.  Second, they change very drastically in the origin, but never display that sort of character growth again.  I’ve talked about serialized storytelling before and part of that is maintaining interesting characters without changing them so much that they stop being the hero who is selling the story.  But the origin does just that and thereafter the brakes are put on stories like this.  At least changes so drastic are not present.

In general, once they get beyond the origin story, creators can begin to tell the types of stories for which they invented the character whatever those may be.  But the origin story is basically a genre of its own with its own tropes that is different from what comes after.

I say, just get to the good stuff.  Leave some mystery in the backstory.  It is good for the character anyway.

Three things instead of a proper blog

I have two ideas percolating for a blog entry – a blog about the British Sense of Wonder and another about intelligent systems.  Neither has come to a boil yet.

So no blog today, but there are three things about which i wish to tell you (whomever you are).

  1. Dad’s surgery went well and he apparently spent the afternoon outside on the hospital grounds with the sunshine.
  2. There is a new grow game at On’s Eyezmaze site.  Yay!  Grow valley.  Finished it tonight.
  3. Had an interesting ethical dilemma today.  Meant to talk about it with Tim, but forgot due to him telling me about the Grow game.
  4. It is hot.  That is a bonus thing.  You might already be aware.

That is all.

Mother’s Day

Mother’s Day is the busiest day of the year at a Kentucky Fried Chicken.  I know because I worked three of them.

Three years is a long time to work at a Kentucky Fried Chicken.  Note this was in the days before it became simply KFC.  I was an old timer there by the end.  Funny since I was only 19.

The one day a year when Mom doesn’t cook.  Lots of families break out the BBQ for the first time in the year.  Some families probably cook a nice home meal.  Some might take Mom out to a nice restaurant.  But many, many, many descend on their local chicken emporium like locusts.

On a normal day behind the counter, you’d get a mix of orders.  Some folks wanted only coffee.    Some a 2 piece chicken (white meat only).  Some the full meal with gravy and salad and a pop.  We had burgers at my store so some people wanted a burger.  The families though wanted either the 15 piece bucket or the 20 piece barrel.  On Mother’s day you had nothing but families.

It started with the lunch crowd and continued steady through the whole afternoon.  It was the supper crowd – 3:30 (for those who want to avoid a rush) on to about 8 that brought in the big bucks. The line of Dads standing in the lobby stretched out the door.  Some were foolish enough to bring their kids.

When they reached the front of the line everyone would ask, “How long for a bucket?”  They’d be timorous having waited over 20 minutes to get to the front.  But this was Kentucky Fried at its best.  Extra staff were on hand on Mother’s days.  2 cooks, 2-3 in the prep area (the 3rd being  floater) and 2 up front in cash.  I was a cashier.  Provided they only wanted chicken, salad, fries and gravy we had them out the door in another 10 minutes.

Every once in a while a cook would look out over the swinging doors.  A cook on Mother’s day is a disgusting beastie.  An apron covered in flour and blood.  Flour coating the forearms in a layer that made them look almost deep fried themselves.  And they were weighed down by a layer of grease that coated all their clothes, skin and hair.  The heat from the cookers caused excess prespiration and as they stood looking out into the front you could watch the pimples beginning to form.

“Should I drop another 12 head?” they’d ask.  Chickens came by the head to Kentucky Fried.  Strange terminology since the head was a bit we never saw.  They came ready for the breading table.  9 pieces of chicken per head already cut into parts – a breast, two thighs, two ribs, 2 wings and 2 legs.  Dropping a head meant going into the freezer to get a chicken, dumping it into the breading vat, mushing it through the flour and then placing them onto circular racks.  Each rack held two head and was sized to fit exactly into the cooker.  We had six cookers so 12 head was the maximum that could be down at once.  108 individually breaded pieces of chicken.  But that goes pretty quickly at 20 pieces per barrel.

You didn’t want to drop chicken that would go unsold.  Leftover chicken was just tossed at the end of the night.  So the cooks didn’t like to get ahead of demand.  Not a problem on Mother’s Day though.  We could fall behind simply by having the cook take a breather to look into the front.

“What do you think?” we’d respond from the front.

We did cash – take orders, print the receipt and give the receipt to the back.  We did pop.  We did salads.  We handed out the orders.  We kept the dining in area clean.  Things would begin to slide during the big rush though.  We’d be wearing enough potato salad to fill a large container if we wiggled.  Out of the corner of my eye, I’d notice the dining room garbage was full when a customer couldn’t physically shove the detritus inside.   We’d yell at the floater to check out the washrooms when people left dragging TP on their heel.

But we turned around the chicken.  We kept out area clean and we smiled at the customers.  “Happy’s Mother’s Day!” I’d say as I pushed three bag filled with chicken and salad, fires and gravy, and a McCain’s Frozen Mother’s Day cake into a Dad’s hand.

Not everyone would leave happy.  We’d get return customers where something critical went missing.  Checking orders against the receipts before they went out became difficult.  Mistakes were made.  Oddly enough after waiting in the store for close to 30 minutes to order and get heir food again, the customers weren’t overly sympathetic.  The manager worked in the prep area or as a cook on Mother’s Day, but she provided us with the authority to send people home happy if possible (i.e. fix the order, throw in something free – no refunds, smile and apologize).  A customer irate enough to make her come out set the whole operation back.

But worse were the special orders.  A barrel plus 2 burgers.  Or worst of all – add some hot wings to that.  These days the hot wings go in the fry cookers, but in my time they were in the deep friers.  Dropping wings meant the cooks weren’t dropping chicken.  Special orders were to folks sitting at the back of the store waiting forever for their order.  Pool lost souls.

And the white meat crew.  For every 20 people that order all white meat there was one that ordered all dark.  But the chickens came with 3 pieces of white and 6 of dark.  We couldn’t do an order over three pieces all white on Mother’s day.  The customers would bargain with you.

“I’ll pay extra.  I’ll pay whatever it takes.”  A barrel of white meat was nearly all the white meat from 7 head of chicken.  Some people even liked to ask for all breasts.  Did they think we had mutant chicken?  It wasn’t a money issue, there just wasn’t that much white meat to go around.  “I got an all white beat barrel in High Prairie,” they’d argue.  It is a known fact that they do have mutant chickens in High Prairie.  “Sorry,” I’d apologize.  “Can’t do white meat for anything larger than the thre piece meal.”

“I’ll take 7 three piece meals then.”  Cost is apparently no object on Mother’s Day.  A logically loop hole in our policy.  I’d apologize and say that the loophole can’t be used.  Soon the manager would need to come out to provide the same information.  White meat advocates are die hards.  We’d get walkouts without an order.  Angrier than the people whose coleslaw we had forgotten.

Mother’s Day seemed endless.  But families don’t eat a late mother’s Day supper.  The peak would be reached before 7 and sometime between 7 and 8 it would slow down again.  The last two hours before closing had enough time for the cooks to finally pop outside and smoke a pack of cigarettes and for us at cash to clean the washrooms properly.  Normally by 10:30 we’d lock up and go home, but an extra 30 minutes could be needed.  The cashout would be 4times larger than normally for instance.

Eventually we’d all go home though.  We never saw some staff again after Mother’s Day.  Some folks just can’t hack the high pressure world of fast food.

Weekly Recap

Right, so.  A day late and 5 quid short I always say.  Or maybe I have just started saying that.

Bunches happening this past week.  I’ve mentioned most of it here.  Some is new though…  let’s see

  1. Uncle’s Lionel passed away.  I’ve spoke of that.
  2. Rob had a birthday.  He is older now and finally wiser than I.  Soon he may be wiser than a turnip.
  3. Plus Rob’s purchased Dominion.  That is nifty.  I like Dominion.  Good game.  We’ve played quite a lot of that lately.  At times I even win.
  4. I got a start date.  I was coy on FB, but the date is Sept. 7th.
  5. Comics were pretty awesome this week.  Plus I read a bunch of Dave’s from the last few weeks.  They were pretty awesome too.
  6. The new Dark Sun campaign setting came out.  I like the books.
  7. I broke a glass and replaced some lightbulbs.  I had help along the way.  Big adventure.
  8. Mark is quitting GoA.  Good luck Mark!
  9. Saw the Expendables.  Highly recommend – that is to say it is exactly what it looks like it is.  Avoid it if you think that looks stupid – it is plenty stupid.  But if you think it looks like fun – it is plenty fun.
  10. Finally Dad’s go into hospital today.  Minor surgery happens on Wednesday.   Nothing to worry about if you hadn’t heard.
  11. Bought a season of Doctor Who.  I am quite entranced.  I will now return to watching it.  (After a quick bio break.)

Stay in touch.

Movie Poll