Clear is dead. What about my retinal scans?

I signed up to Clear about 18 months ago. Theoretically, I would get through airport security lanes faster. It involved a registration, fingerprinting and retinal scans. I pretty quickly realized that it was a waste of my money when the people in the "normal" security lines were getting through faster than me. In addition, why was their first question when I showed up to their line "Can I see your drivers license please?"

I let the card expire and for the last two months Clear has been hounding me multiple times a week to renew. Yesterday, I finally told them to stop sending me e-mails and this was their response (above). I guess I got my wish.

Now my question is: What happens to those digital fingerprints and retinal scans they took? Checking their privacy policy reveals this interesting tidbit:

...a copy of your biometric information (but not your name) is retained by the Transportation Security Clearinghouse to prevent fraudulent enrollments under alternate identities.

So, the TSA has my biometric information but not my name in order to prevent fraudulent enrollments under alternate identities? Hmmm, does that mean that the TSA has my biometric information but not my name but does have my social security number? Otherwise, how would they prevent fraudulent enrollments?

Generally speaking I care about this. Specifically, for me, I don't because I've been fingerprinted many, many times by the US government already. (No, I'm not a criminal - I'm an immigrant!)

How much biometric detritus is floating around about me out there? About you?

Follow-up: See Kevin Kampman's (Burton Group) post on this topic here.

Technorati Tags:
Clear, security, identity management, biometrics, privacy

All Defender, all the time

Mr. Stuart Harrison has started to blog! As the product manager behind Defender you can imagine what he'll be discussing most of the time. Check out his latest post on our GrIDsure integration...

GrIDsure’s solution is based on its groundbreaking yet simple invention that allows users to authenticate themselves by remembering a minimum of a four block sequential pattern on a five by five grid. By integrating GrIDsure’s software-based solution, Quest will be able to offer its customers an enhanced level of scalable security at a very competitive price point, whilst enhancing the user experience.

Technorati Tags:
Active Directory, Defender, two-factor authentication, GridSure, strong authentication, passwords

Don't get caught in your identity underwear!

Brian Green's experience with not-so-secret questions began when he logged on to his World of Warcraft account in March of this year and found all of his characters in their underwear. Someone had stolen the account and sold off all of his virtual equipment.

This article made me burst out laughing but behind the humor of someone have all of their "virtual equipment" being sold off there's a serious point to be made: Secret questions used to secure password-reset functions can be woefully insecure.

In a study involving 130 people, the researchers found that 28 percent of the people who knew and were trusted by the study's participants could guess the correct answers to the participant's secret questions. Even people not trusted by the participant still had a 17 percent chance of guessing the correct answer to a secret question.

If it isn't obvious to all you really must ensure that your secret answers are, in fact, secret and secret means not easily guessed or easily subjected to social engineering attacks. I highly recommend that an out-of-band technique be used to send you your new password. For example, an SMS message with your temporary password to your mobile phone or the use of a one-time password (OTP) as part of your Q&A response profile. Both of these rely on something you know and something you have - much harder for the hacker to defeat.

Don't rely on "shoe size" and "pet's name" or you'll end up being caught in your identity underwear, too.

Technorati Tags:
identity management, passwords, strong authentication

Application Performance Monitoring

Last week I attended a conference here in Europe and a Gartner analyst by the name of Will Cappelli gave a talk on “Application Performance Monitoring: Technology Trends and Market Dynamics”. Normally, it's not the kind of talk that I would sit through but I decided to this time because I am not very familiar with this part of the market. I'm glad I did because Will gave me a perspective that I would have never seen myself:

• Monitoring applications have been performed differently than monitoring the infrastructure
• Application-centric monitoring is where things are moving – how to make the application successful in its environment
• From the businesses perspective the value that IT delivers is embodied in the application portfolio - not the infrastructure. (How often do you say "Wow, the network is fast" versus "Why is PeopleSoft slow?"
• This shift makes the IT operations management group even more important as time goes on
• APM = Application Performance Monitoring
• There is no Business Service Management without a matrix of APM
• We are almost at the point that the application can dictate the underlying infrastructure that it needs to perform appropriately (e.g., re-configure a VM)
• The boundary between application and infrastructure is going away
• You won’t be able to distinguish between virtual and physical applications soon
• You need holistic monitoring of your application stack – there is more than one way to this: 4 perspectives:

1. End-user experience monitoring (#1 thing to do – most fundamental task)
2. Discovering and Modeling the Application
3. Deep dive monitoring (middleware, database, network, off-the-shelf application stacks)
4. Ebb and flow of transactions (hard work, embryonic)
   

How do you tie these 4 data streams together? With a Performance Management Database (PMDB).

The market is moving towards vendors who can provide all of these things (the 4 functionalities + performance management). An integrated, suite approach provides the built-in integration that must be provided via significant integration across “best-of-breed” tools in order to weave together the performance management information together.

This was an interesting session. Especially how there is enough value of putting the 4 items together in a suite coupled with a PMDB to enable a "suite" vendor to succeed. Maybe this is why the identity management "suite" vendors have not succeeded? They haven't figured out the "PMDB" side of things that ties everything together and provides additional added value.

Know what I mean?