The Five A’s of Security

September 7th, 2009
No comments

Personal and online security is a desirable state and a complex idea. This guide offers a general overview of the main idea that, when used together, help us establish a level of security that makes us comfortable using our computer in an online world.

A is for Awareness

Awareness

The first subject in talking about security is awareness. We need to be aware, for example, that we are not always safe in the world (online and offline). When we are online, most people are aware that there are certain dangers such as viruses, phishing, and spam that threaten our safety (personal, financial, or data). Once we know that problems exist, we are more likely to learn about and take steps to avoid danger and keep ourselves safe and secure.

A is for Authentication

Authentication

Authentication is the process of verifying that you are the real you. Your friend may authenticate you to other friends by saying something like “this is my friend Chris” (or whatever your name is). You may prove that you’re who you are to a business entity by answering questions that only you would know the answer to. You are usually being authentic when you speak honestly, from your perspective, to someone you love.

A is for Authorization

Authorization

When you are authorized, you have access to a computer system. Verifying users of your computer, or your work’s computer, or any storage systems or online accounts, can help you track the activity in files and resources. An unauthorized user can be prevented from gaining access to your information. Authorization is the process of assigning permission to use certain files and resources.

A is for Access Control

Access Control

Setting permissions on files, directories, accounts, or computers can establish limits to these resources. You may wish to be the only person that read and update your personal finances, for example. This is referred to as individual read-write access (only the owner of the file can read or update). At work, your group may have access to read and maybe edit a collaborative document. Most of the web pages offer global read-only access. Individual, group, or global access can be set to allow reading, editing, and/or other permissions.

A is for Auditing

Auditing

As individual computer users, we don’t often think about the clues that we can use to track where we’ve been and what we’ve been doing. However, whenever we visit a web site, the site’s server automatically keeps a record of things like our domain name or IP #, the time and date of our request, the page or file requested, a code indicating success or error, the number of bytes transferred, and more. As the visitor, we don’t have such tracking tools (and in many cases, don’t need them). However, as our habits and travels on the Internet are increasingly scrutinized by the sites we visit, we have a stronger case for understanding what is being compiled about us.

Coaching moment: In reality, these five A’s are somewhat intertwined. For example, it doesn’t make sense to have Authentication without Authorization. Access control doesn’t happen without Authentication and Authorization, and none of these make sense without Awareness.

What does this have to do with digital identity? These are the pieces that make up our digital records, including who we are and what we’re allowed to do. Sometimes we have control over these decisions, and sometimes control is in the hands of others. It depends on the context of where we are and what we need.

[del.icio.us] [Facebook] [LinkedIn] [Ma.gnolia] [Technorati] [Twitter] [Email] More »
VN:F [1.5.7_846]
Rating: 1.0/5 (1 vote cast)
VN:F [1.5.7_846]
Rating: 0 (from 0 votes)

history, records, tools

What Data Can Show

September 4th, 2009
No comments

This video is an interesting romp through time, illustrating special effects and what can be shown visually. What does this have to do with digital identity? Several things:

  • The world is not always as it appears
  • Some people want you to see the world in a particular (non-real) way
  • You can show the world who you are in a particular (real or non-real) way
  • A personal identity is an interpretive dance between the person offering and the person accepting or using some information
  • Not all information (like details of how the effects were created) needs to be revealed

Coaching moment: You are, at some points in time and in certain circumstances, the director, designer, and special effects creator of your own life. You can choose what to show, what to withhold, and what parts of you become the picture that others see. For example, you may not choose to talk about last night’s bar crawl when you’re at work, being a model employee. You may choose to reveal more information about your activities to your doctor, in order to assist an appropriate diagnosis. You may choose to portray indifference and anonymity to an annoying panhandler on the street.

What happens when someone else follows you around, blowing your cover? That’s what many companies are doing now when they collect and trade your data. These companies are saying, in effect, “we know who you are, you can not hide from us.” However, what they “know” may not be true or accurate. See, for example, What the Internet Knows About You – a site that says you’ve “visited” URLs that may have only shown up on your visited pages as advertising or invisible pixels. Or take a look at your annual credit card summary to see that your favorite local hardware store is categorized as a “specialty foods” (or some other clearly erroneous) category.

Why might you care about this? Many of these companies and related trading partners are making decisions about you based on this information. They are not asking you to verify–nor are you given the opportunity to refute–inaccurate or incorrect information. Is this the kind of decision making that you want to be steering your life? (I don’t.) This is a version of making decisions about your finances based on identity theft, or about your insurability based on someone else’s records.

What can you do about it? First: be aware of this practice. Choose to work with businesses that are collaborative and will help you verify your data. There aren’t many of them yet. As they show up in the marketplace, they will need your support. Second: order a credit report from any (each) of the big three data companies. Correct what’s wrong. Know what they say. Third: Talk with your friends about this. You may be interested to learn who cares and who does not. Ultimately this is your priority, not someone else’s.

[del.icio.us] [Facebook] [LinkedIn] [Ma.gnolia] [Technorati] [Twitter] [Email] More »
VN:F [1.5.7_846]
Rating: 0.0/5 (0 votes cast)
VN:F [1.5.7_846]
Rating: 0 (from 0 votes)

history, records, tools

Getting to know you

August 20th, 2009
1 comment

National ID cards and programs are problematic at best, and an ongoing nightmare for citizens and visitors alike when the programs are poorly designed. The U.S. government has made earlier attempts at developing such a program, which have failed. However, the dream lives on in the minds of certain government officials and representatives.

The Electronic Frontier Foundation (EFF) has been following these efforts for years. EFF’s Richard Esguerra has a post, PASS ID: REAL ID Reanimated that offers an informed look at the latest effort to create the next version of a national identity card.

The PASS ID Act (S. 1261) seeks to make many of the same ineffectual, dangerous changes the REAL ID Act attempted to impose. Fundamentally, PASS ID operates on the same flawed premise of REAL ID — that requiring various “identity documents” (and storing that information in databases for later access) will magically make state drivers’ licenses more legitimate, which will in turn improve national security.

An ID card is only a small part of the picture. The government program that supports the card is where the devils live. I recommend to you Bruce Schneier’s testimony to the Senate on why this whole idea is seriously flawed.

Coaching moment: Have you ever filled out a form for a new service, at a web site or store, where the form asked for information that they might not have needed for the transaction you were seeking? Long forms that ask a lot of questions about you, your preferences, your income, and other personal information, are unnecessary. If you’re just buying something, why might the vendor need your income, your birthdate, or any information about other family members?

The fact is that they often don’t need it. They’re collecting information about you because they can, and because you might volunteer it. Even when certain information is marked as “required,” it might be in your best interest to think twice about doing business with companies that would be so invasive and demanding.

Treat your personal information on a “need to know” basis. What that means is don’t give out more information about yourself than you think the companies need to know in order to carry out the transaction. If the company or form require more information than you’re comfortable giving, think hard about your future well-being as a trade-off for today’s discount. Your mindfulness is a low-cost insurance on your future.

[del.icio.us] [Facebook] [LinkedIn] [Ma.gnolia] [Technorati] [Twitter] [Email] More »
VN:F [1.5.7_846]
Rating: 0.0/5 (0 votes cast)
VN:F [1.5.7_846]
Rating: 0 (from 0 votes)

friends/family, future, history, records

Getting Tested

August 14th, 2009
1 comment

CNN has an article about families in China whose children are “participating in a new program that uses DNA testing to identify genetic gifts and predict the future.” The article, In China, DNA tests on kids ID genetic gifts, careers, states that the reason for these tests is to help give children an advantage by determining what the children’s genetic profile reveals.

The test is conducted by the Shanghai Biochip Corporation. Scientists claim a simple saliva swab collects as many as 10,000 cells that enable them to isolate eleven different genes. By taking a closer look at the genetic codes, they say they can extract information about a child’s IQ, emotional control, focus, memory, athletic ability and more. …

For about $880, Chinese parents can sign their kids up for the test and five days of summer camp in Chongqing, where the children will be evaluated in various settings from sports to art. The scientific results, combined with observations by experts throughout the week, will be used to make recommendations to parents about what their child should pursue.

Coaching moment: Your DNA is the instruction book to how your body develops and works. Scientists are studying the combinations and locations of various genes to try and figure out where our health problems begin or end. In this article, the scientists are using certain tests to “determine a child’s future.” The children’s DNA map becomes part of their digital health records.

Of more interest to me was this sentence: “Examining one child’s results, he told CNN: ‘This child is very thoughtful and focused, so I suggest she go into management.’” Being thoughtful and focused might also represent the creativity of an artist, the clarity of a physicist, or the drive of a programmer. However, the notion of casting a child’s future as a manager is much more problematic because it assumes that the Chinese scientists studying these children believe that they know what “management” as a line of work will be like in the future.

Will there be a great ongoing need for managers? Will “management” add value to the world in 20-30 years? We don’t know. We do know that technology will change the way we work and communicate, which is central to “management” today.

[del.icio.us] [Facebook] [LinkedIn] [Ma.gnolia] [Technorati] [Twitter] [Email] More »
VN:F [1.5.7_846]
Rating: 0.0/5 (0 votes cast)
VN:F [1.5.7_846]
Rating: 0 (from 0 votes)

future, records

Your Network, Your Reputation

August 3rd, 2009
No comments

With the rapid growth and use of social networks like MySpace, Facebook, Twitter, and many others, there’s a growing interest by service providers, marketers, and hosting companies in mapping this fertile ground. Your network (online and in person) is where your reputation resides. What does your network say about you?

What to Measure?

What to Measure?

IBM (a company with more than 38,000 patents) published a paper called Social Ties and Their Relevance to Churn in Mobile Telecom Networks in which the authors point out that it’s not the individuals that are important. It’s their relationships. From the abstract, “Exploring the nature and strength of these ties can help understand the structure and dynamics of social networks and explain real-world phenomena, ranging from organizational efficiency to the spread of information and disease.”

The bottom line here is that if enough of your friends don’t like something, there’s a tipping point where people start changing to something else. In the case of mobile phones, for instance, lots of people will get a new phone when their provider becomes a problem, and their friends agree about that problem.

There are two parts to this issue. First: whether you are a leader or a follower. Marketers and advertisers really care about leaders because they will influence their friends to do (or not do) something. Second: the mapping process can get rather personal. The IBM paper above looks at the “aggregate” or group behavior of a network. However, tools can be tuned or created to be very specific about your network: whom you see, how often, and who else they’re connected to.

In the case of politics where transparency is informative, you can see nice, detailed visualizations of networks at work around TARP (the government’s Troubled Asset Relief Program, or “bank bailout” money), federal funding earmarks, or health care. But what about when it gets personal?

Coaching moment: Records of your relationships and your network are everywhere: in your social networks, in your email, on your phone, records of bridge tolls, and more. The mapping technology doesn’t yet work in real-time, but it’ll happen. By itself, this isn’t the major concern for me. The really big problem lies in the fact that we don’t have rules for how this information can or should be used.

Our corporations do not have the same concerns, priorities, or moral compass that people do. Corporations are motivated by what the company can do that is profitable and makes their shareholders happy. There are no laws or other forms of guidance about what proper social behavior is, largely because as a society or a culture, we’ve never talked about it.

I suggest now is a good time to start talking. With your friends. What do you want in an Information Policy Platform?

[del.icio.us] [Facebook] [LinkedIn] [Ma.gnolia] [Technorati] [Twitter] [Email] More »
VN:F [1.5.7_846]
Rating: 0.0/5 (0 votes cast)
VN:F [1.5.7_846]
Rating: 0 (from 0 votes)

friends/family, history, records, tools