Samba 4.0 released - The First Free Software Active Directory Compatible Server is now available! …So what?

I’ve just read two articles over at ZDNet about the Samba 4.0 release:

Samba 4 released, brings Free alternative to Active Directory

Samba 4 is now slated for release on November 27

…and my reaction was literally: So what?

Samba has been around for years and they’ve been integrating with Windows from the beginning. So now they’ve just announced that they’ve landed on the moon but of our eyes are pretty much focused on Mars at the moment. It’s truly an amazing engineering feat ladies and gentlemen.

What do I mean? Well, having an Active Directory, plug compatible, non-Windows server might have been interesting 5-7 years ago but today it’s not. I’m not sure if anyone’s heard but many companies are extending to the cloud and that includes to Office 365. The reliance and need for Samba’s 4 “free alternative to Active Directory” is way too late to the party.

And, while I am on free I can just imagine the laughter coming from Microsoft’s support centers when some customer calls in with a problem they have with Samba 4’s Active Directory behavior. You get what you pay for ladies and gentlemen.

Oh, a small business might be interested in it? You’re kidding, right? A small business would be far more interested in using Office 365 or using Google than having the expertise to stand up a Samba 4 server.

Who cares?

Is seven USC’s lucky number or will they crap out?

USC just had their sixth data breach since 2006 according to this report. This one exposed confidential information of 34,000 people in the College of Education.

No evidence has been found that the hackers have accessed or used any information on the server, but USC has sent notifications to everyone in the database to place fraud alerts on their credit files, school officials said.

One would have thought that after perhaps the second or third breach at USC they’d figure out they needed some serious help and serious introspection. Will their be a seventh? If there’s a seventh and heads don’t roll you can be assured that someone came up lucky.

There’s not enough detail to even guess at what the security issue or problem may have been. During the same month there was another security breach related to credit card data at USC cafeterias and dining halls. I’m not sure why both weren’t reported at the same time since they both happened the same month.

This kind of reminds me of all the scams that people fall for and they’d say that they’d get calls from all kinds of scammers after they fell for one or two scams. I wonder if USC has become a target of Internet scammers because they aren’t doing enough to secure their systems and now appear like an easy target?

Let’s hope there isn’t a seventh report in the making. Remember, seven is only lucky on your first roll in craps – every other roll and a seven craps you out…

Quest One & Data Governance

Today we released Quest One Identity Manager – Data Governance Edition. I’m particularly excited about this release because it is built on Quest One Identity Manager and is based on a very scalable and capable identity infrastructure.

By being based on Q1IM we get to leverage all of the capabilities of our underlying identity management platform like data synchronization, provisioning, workflow, segregation of duties, reporting and, most importantly, a common user interface for users of either product.

Some of the other key features include:

• Restricted Access – Define access policies for your organization to ensure that sensitive unstructured data is only accessible to approved users. Quest One locks down sensitive data such as files, folders and shares across NTFS, NAS devices and SharePoint.
• Data Owner Assignment – Determine and assign the appropriate owner of data for all future access requests by evaluating usage patterns and read and write access.
• Simplified Auditing – Identify user access to enterprise resources such as files, folders and shares across NTFS, NAS devices and SharePoint to provide key information during audit preparations. 
• Automated Access Requests – Use built-in workflows to automatically direct access requests from the request portal to the appropriate data owner. Approved requests are automatically and correctly fulfilled, with no burden on IT.
• Access Verification – Ensure that only approved users have access to specific resources, including those who have left the organization or department or whose roles have changed. Quest One enables you to monitor user and resource activity, and configure and schedule a recertification process for data owners to verify and attest to employee access.
• Personalized Dashboard – View trends, historic and current data access activity, and attestation status on a personalized dashboard with reports that can be used to prove compliance to auditors.

More information about Quest One Identity Manager – Data Governance Edition can be found here.

The Answer to Verification and Authentication?

I tweeted a very interesting article by Dan Raywood titled “A question of verification and authentication.” It’s a good article and I certainly recommend reading it. There’s a comment in the article from Richard Law, CEO of GB Group that reminded me of something. His firm’s verification technology is used as a third-party solution to verify users by retailers, banks and gambling websites.

The system it built in 2004 verifies 13 million people a year and its vision is to verify anyone anywhere in the world at any time and to be a true enabler of online business.

Law said that if an instance were to arise where GB Group became the trusted issuer, it would have to convince everyone to give them their data and it would issue a token that would be verifiable to them.

For some reason my memory bank spit out that what we might need has already been predicted in the movie “The Forbin Project.” A supercomputer that controls our identity data and can positively verify us. But, I’m positive that would never come to happen. Would it?

Law’s technology would take 536 years to verify the world’s population at 13M per year. It just goes to show you that we have a Colossus of a project on our hands and we haven’t really even started to or tried to verify identities that our outside of the developed world.

This problem will never go away. Just because we have fire insurance doesn’t mean there will never be a fire. The same goes for identity verification. We have to accept the fact that no matter how much insurance we put around identity we’ll never prevent 100% of identity theft or misuse of identity.

In the United States most banks still issue credit cards without chips. Why don’t they move to a more verifiable, more secure platform for transactions? The cost of doing nothing hasn’t exceeded the cost of the fraudulent transactions. Who needs fire insurance if you have enough money to re-build and you don’t care about the damage you incur due to the fire?