New look and name for the blog

This won't affect those of you reading this via an RSS feed. For those that usually get to my posts directly on the site, you'll notice a different look. No reason behind the change in look and feel other than to keep it fresh. It's just a standard template that is available via Blogger so it's not as if I spent any time or money to do it. I also started to notice that lots of people were using the same template (as my old one) so that was yet another reason for the change.

The most observant among you may also have noticed that I've renamed the blog. I hope the new name reflects what this is all about more clearly. The old name was a bit open ended. There's been nothing random about my posts for awhile so that didn't really make sense. This blog is really about IT security with a strong bias around Identity related issues (and probably data security in the months to come).

I'm not sure what that does to my blog's entry in Google's index. Hopefully nothing too painful (like getting thrown into supplemental result oblivion for example).

P.S. Could you please let me know (via comments or the "Email Me" form on the right hand side of the page) if you find any peculiarities with the blog (apart from anything stupid I may say in a blog post...even then write a comment to tell me what you think). Who knows what didn't get migrated over properly.

In good company

The guys over at Securent have started a blog dedicated to discussion around entitlement management (EM). It'll be interesting to see what type of content gets posted on there and exactly how much discussion it will facilitate. They're off to a decent start I suppose, getting Gerry Gebel from the Burton Group to contribute. There's no real meaty content yet however. Securent CEO Rajiv Gupta's entry is the stock standard spiel about EM.

The only reason I found out about this site was through referrals to my blog. I'm starting to see traffic from www.entitlementblog.com and was wondering how in the world this was happening. So I checked it out and was surprised to see my name on the blogroll amongst some illustrious company.


I thought I should take a screen shot before they realise I'm not worthy of being amongst the names on that list :)

No more Identity?

I've finally relented and have finally gotten myself a job. Living in London is expensive, so I had to eventually :)

While the role I've taken is still in information security, it doesn't focus directly on Identity and Access Management. The focus of my new role will be more data centric. Namely focusing on data usage, monitoring, and leakage prevention. The technology essentially lets you have an enterprise view of what data is being used for which purposes and by whom. It can also enforce operating system level controls to prevent people from performing certain actions on critical or sensitive data. At the very least, everything is being monitored, if not enforced. When I say context, I mean everything from the type of file, what's being done to it and what the contents of the file are. I'm over-simplifying. It does more than that, but I don't want to write an essay. Seeing it in action reinforced my belief in the need for this type of solution in the market. It's actually very cool...and I'm not just saying that.

I won't continue on with the sell job. In fact, I've purposely not mentioned who I work for...at least not yet (if you REALLY want to know, it's not hard to find out if you're web-savvy enough). I don't want to turn the blog into a selling tool. It's MY blog after all...not the company's. I'll just keep writing exactly what I think on here and call things like I see them.

All that being said, I maintain my interest in the Identity area, so I won't stop talking about that. I may just deviate from it now and then...which is not really that different from what I've been doing anyway.

Incidentally, my coverage region is EMEA (Europe, Middle East and Africa). So for those of you in the region, I may be seeing you around :)

Oracle Identity Architect sets the record straight himself

I made a post yesterday about Oracle's Identity Management product architect Nishant Kaushik's blog post relating to IBM Tivoli Identity Manager (ITIM) and its reconciliation behaviour, specifically around pattern matching during automatic adoption of accounts.

My point was that ITIM does indeed support pattern matching. Nishant had come to the incorrect conclusion based on a presentation given by IBM's Stuart McIrvine at this year's RSA Conference and mentioned in his post that ITIM does not support this while Oracle Identity Manager (OIM) does.

I went on to say that I posted a comment on Nishant's blog attempting to correct the misconception, but could not for the life of me find the comment until I searched for it using Google.

Today I have to give credit to Nishant for setting the record straight publically in his latest post. He even quotes straight from my comments, including my not so subtle dig at IBM for sending someone without the deep product knowledge required to respond adequately to technical questions.

Good on you Nishant. There's one problem though...I still can't find those comments very easily!

UPDATE: Nishant's just updated his blog with this post where he mentions that he knows there are a few gremlins in the system. This includes my observation about comments not appearing against the relevant posts. In other words, he didn't do it on purpose. The software is just acting up. I assume he'll try to figure out what's going on and get it fixed eventually.

Setting the record straight on Oracle Identity Architect's blog

Those of you that read Oracle's Identity Management product architect Nishant Kaushik's blog may have recently read this post where he comments on the behaviour or IBM Tivoli Identity Manager's (ITIM) reconciliation function and contrasts it with Oracle Identity Manager (OIM).

Nishant had attended the RSA conference and sat in on a session titled "Delivering Security Integration with Compliance" by IBM's Stuart McIrvine. The following question was asked by an attendee:

"How do you figure out and correlate the account [say account 'jsmith2345'] with the identity [John Smith] it belongs to".

Apparently Stuart's answer was:

"It is based on matching of a common attribute tracked on both the account and the identity. This could be an employee id, a social security number or some other attribute that makes sense."

Nishant's critique on ITIM was that it should really support pattern recognition based matching like OIM does. I have news for readers...ITIM does. I'm not here to defend ITIM. Remember, I no longer work for IBM. I just happen to be in a position where I know ITIM inside out and felt the need to set the record straight.

I actually did attempt to do this by commenting on Nishant's blog in response to his post about a month ago. I waited and wondered why it didn't appear. I was about to rant about how Oracle suppresses information that does not aid OIM's case until our good friend Google found my response here.

While this isn't exactly suppressing information, it is still not good enough in my opinion because it's almost impossible to find unless you're specifically looking for it like I was. My observation of Nishant's blog is that he seems to route all comments relating to his posts into his discussion forum. If you look at his posts, it looks like no one's commenting (the footers all say "comment[0]"). Not exactly useful because there's no easy way to track the comment thread from the original post. Heck, I can't even find a link to the discussion forum itself. Maybe I'm not looking hard enough.

I seriously doubt Nishant reads my blog so if anyone knows him please pass this message on. I'd email him, but I have a feeling it'll be ignored.

UPDATE: I received an email from Nishant shortly after publishing this post. The email was sent in reply to my comment on his blog which I mentioned above (looks like he gets an email everytime someone posts a comment). So maybe he doesn't ignore emails...he just takes a very long time to answer them...or maybe you need to make a blog post which provides him with a compelling reason to act :-)

Blog URL change

You may have noticed this blog now points to http://blog.ianyip.com. It's all part of my ongoing efforts to "brand myself" online.

http://ianyip.blogspot.com still works so those with feeds and bookmarks need not worry (or so the Google help pages tell me).