Entitlements in a Multi-tenant World

We are in a super-shared, and super-scaled world where rights are no longer concentrated in one place. Your rights and permissions are living everywhere in the neighborhood. They have left home. These is the presentation I used for a basic talk on why it is important to understnad how entitlements work these day. It was meant for presenting but you may get somehting out of it. Entitlements in a Multi-tenant World(PDF) Entitlements in a Multi-tenant World(PPTx)

B-Sides Nashville 2016 Presentation

IAM Complicated: Why you need to know about Identity and Access Management B-Sides Nashville 2016 was a great event. Here are the links for the presentation. The IAM Complicated Recording thanks to Iron Geek. IAM Complicated Presentation(PPTX) IAM Complicated Presentation(PDF)

B-Sides Nashville 2016

I have been given the opportunity to speak at B-Sides Nashville 2016. This year’s topic will be all about identity access and management. IAM Complicated: Why you need to know about Identity and Access Management Do you know where identities are born? How can you tell what an identify can and can’t do? What do you do when you realize your refrigerator has an identity of its own? If your IPS blocks your refrigerator you may lose access to your pizza.

What is the secret of the Grail?

Grail Figure: What is the secret of the Grail? Who does it serve? Perceval: You, my lord. Grail Figure: Who am I? Perceval: You are my lord and king. You are Arthur. Grail Figure: Have you found the secret that I have lost? Perceval: Yes. You and the land are one. Doesn’t this sound like a conversation you overheard between several architects standing around the watercooler? Do you feel like we have long forgotten the secret of The Architecture?

OpenSDL Presentation

Here is the condensed version of how to mix security into agile development. Agile and Security. (PDF) Concept Platform A basic framework for the concept has been built around a Wiki and the OpenSAMM. This framework should be good enough to grow the idea and determine if it will add security value. The current version is here: Http://www.OpenSDL.com

B-Sides Nashville 2015

I got the opportunity to be at B-Sides in Nashville over the weekend. It was a great opportunity to mingle and meet people who had an interest in information security. One of the best parts was a great mix of old professionals and quite a few new people who were interesting in seeing what security is all about. It was a good time and I appreciate all the effort it took to make it happen.

Open Security Development Lifecycle

We need a no-frills and roughly-right life-cycle to raise our level of software Security Assurance. Right now there are several security life-cycles both in the wild and available through vendors. None of those attend to the full spectrum of security and risk needs. Most are heavily centered around software testing but the security umbrella is much larger than that. Maybe more importantly development and delivery methodologies have changed drastically over the last couple of years.

Why Go Hugo?

For years I have worked with WordPress along with its themes, plugins, and vulnerabilities. I even purchased a couple of themes. Yes, WP can make a pretty site but at the end of the day I spent a lot of time working on WP and not working on content. It was time to move on to a different way of publishing. There were a several reasons that I moved from a dynamic site to a static site.

Why Architect

ar chi tect: (v) design and make

Think about landscaping your front yard. It is a lot more than just the sod or a couple of bushes. The overall look of your front yard comes from the color of your house, the looks of your house, the sidewalk, the driveway, the trees, and the shrubbery. It matters all the way down to how your grass has been mowed. If you are going for a particular look you had better be thinking about these things a little bit up front and not just letting each and every service implement their part of the yard without some larger vision.

Control by Control

You don’t read the glossary because no one reads that but how often do you jump straight to the end of a document to read an appendix? Be truthful. Well maybe you don’t but sometimes you really should. Building the Tower Information Security controls have been a hot topic lately. Actually the discussion has been more around the lack of controls or how poorly the controls were implemented. In the InfoSec industry there are lots of definitions for these controls.