Simplifying/Consolidating versus Managing - a crazy example

Situation

• Customer has >1,000 Unix servers
• Adding or deleting users takes weeks because the /etc/passwd file on each host must be edited
• Reporting for SOX and other regulatory concerns is nearly impossible
• Lots of security concerns - was the person deleted? When?

Solution

• Customer pays $5 million for an identity management suite/framework from one of the big vendors
• After connecting 10 - yes, you are reading that right - 10 Unix hosts to their metadirectory the suite becomes so bogged down that it is no longer viable

Customer is now interested in simplifying their identity management architecture by consolidating those Unix hosts and identities into Active Directory.

What a surprise. And, to tell the truth, this isn't the first time I have seen this.

I guess it is too late to send them my Tenets of Identity Management white paper because there are at least a few of them that they "broke"...

Technorati Tags:
identity management

Quest Software named Microsoft Global ISV Partner of the Year!

Wow, we did it again - Microsoft's 2007 Global ISV Partner of the Year!!

Congrats to Quest and all the staff of Steve Dickson's Microsoft business unit.

Technorati Tags:
Quest Software, Microsoft

Securing Passwords

I saw this in ComputerWorld (6/4/2007 in the "Security Log")

Most companies mismanage administrative passwords by keeping them in unsecured locations and not controlling access to them. 57% of companies store their administrative passwords manually, and 18% store them in an Excel spreadsheet; 82% of IT professionals store them mentally.

In my opinion you can equate "store them mentally" as the administrator uses the same password for multiple systems.

I really think that managing administrative, root or "power" passwords (a.k.a. identities) is truly lacking. Who is using one? For what? How is it audited? What did they actually type while they were a superuser? Who authorized that person to have that access?

I bet many companies can't answer those questions...

Technorati Tags:
identity management

Quest and ScriptLogic

I caught up with Dave Kearns' article on Quest's acquisition of ScriptLogic and wanted to point out that Quest did state that ScriptLogic would operate as an independent subsidiary. I think ScriptLogic has done an excellent job building their products, channel and customer base. So excellent that I wouldn't want to see us diddle with it.

Diddle =

• start telling them what to do or how to do it
• "meeting" them to death
• integrating them to death
• distracting them from their day job

I haven't even had a call with them yet...and if I can keep it that way I will...

You guys keep up the good work.

Technorati Tags:
Quest Software, Microsoft