Agile has the potential of becoming an IT worst practice...

The Agile Manifesto is filled with wisdom that is not understood by many who claim agility...



Another architect I know, recently commented that in 1999, if he presented a suboptimal (aka half-assed) architecture, he would have gotten it handed to him. In 2009, he can present suboptimal architectures with relative ease but if he violates the "process" he will get it handed to him. Is this true in your shop?

Seeing things through the lens of process encourages folks to focus on things such as CMMi and Scrum while ignoring practices such as extreme programming which has the potential of increasing quality.

My theory on it is that there's an increasing lack of architectural competency, which leads to the inability of an architectural governance group to form an educated opinion regarding the technical quality of any particular architecture.

When you factor in the political power that many architectural governance boards have, you end up with power brokering just to be in the group. All of that leads to a lack of technical knowledge. So, how does a non-technical group make evaluations of technical solutions? They rely on something they can understand and measure, like whether the solution follows the process.

It doesn't take long for the governance group, often driven by politics and power brokering, to start claiming success based their metrics for "process following". Reported success leads to more power, ad infinitum.

On the other hand, there's more than one way to skin this cat. You could argue that there's a "minimum" technical solution which meets the business case at hand, and some range of solutions from there up to the "optimal" technical solution. It would then be a matter of cost/benefit analysis in determining the best solution overall for the business. Of course, in this model, you would still need the technical expertise in order to identify whether the solution at hand is "minimum" or better; a process, by itself, will not suffice.

Random Thoughts for 2009-01-13

Gartner analysts are doing a disservice to many end customers! How much guidance have they been providing on clickjacking? Is it about the same as the SEC providing analysis on hedge funds? Seriously, if you are in an enterprise and you actually get jacked, the only answer may be to figure out how to rewrite applications from scratch within days. An enterprise can't just turn off iframes and use the noscript approach for the vast majority of their work unless this was thought about in the conceptualization of the application.

Bet you didn't know that Massachusetts allows for mixed martial arts (MMA) competition for kids as young as seven? My oldest son is eligible for the lowest weight/age class and has started his training. We hope to capitalize on the crowd that "reads into" vs just "reading" as a tactic for success. For example, way too many folks when I say he is a student of Jujutsu, will make the wrong mental shift to Brazillian Jiu-Jitsu which is all about grappling. He is good with takedowns, locks, throws and grappling but his strategy will be to simply come out of the gate Mike Tyson style but punching others in the face.

I finally splurged and purchased an MP3 Player. My $1 radio from Walmart will be retired. I got a good deal on a generic model on ebay which I hope to load up with podcasts of folks who are known and respected within OWASP circles. Of course, I also need to think about doing more podcasts in 2009 as last year I exercised my right to remain silent in this regard

With the imminent failure of Satyam, do you think that CIOs will get a clue and realize that they shouldn't be outsourcing strictly to India? Maybe they will wise up and choose nearshore destinations such as Trinidad, Jamaica, etc.

Did you know that many federated identity deployments are insecure?

Jackson Shaw, Mark Diodati Ian Glazer, Jeff Bohren and others talked about and acknowledged how the Liberty Alliance along with Sun and Oracle has made mistakes in idM provisioning. Today, we will talk about the insecurity that exists within federated identity...



I apologize in advance to Pat Patterson, Nishant Kaushik, Gerry Gebel, Johannes Ernst, Bob Blakely, Kim Cameron, Mike Jones, Ashish Jain, Patrick Harding and others for bringing up the issues I will discuss. Hopefully, they will appreciate the notion that from incite comes insight.

First, let's dig into OpenID. An OpenID XRI can look like anything, including a SQL injection attack. Shouldn't this mean that folks over in this community should noodle at least some type of regular expression of permissible identifiers vs leaving it as yet another weakness?

Second, many of the federation products when serving in the role of relying party can potentially create several new exposures. Many of the products will perform a lookup of the subject within a SAML assertion against an LDAP store. Imagine in a world of SaaS should salesforce.com choose to use one of the off the shelf products, would this be sufficient? Of course not as there is a gap in logic.

So, if salesforce.com is a SP and supports multiple customers of which Credit Suisse is one and the other is say Goldman Sachs. Salesforce.com would have a trust relationship with both of them but what would prevent a rogue Goldman Sachs employee from putting into their directory the subject (say email address) of a Credit Suisse employee and allowing it to be passed along? More importantly, the SP should do more than trust as we all believe in the security principle of trust but verify and therefore would need to have entitlements capability built into the proxy in order to defend against this type of attack.

Have you ever looked at how this would be discovered after the fact from a forensic perspective? Hopefully, they are logging all federation activities to a separate tier and leveraging products such as loglogic, splunk, logarithm, etc but are the log records created detailed enough to catch this type of scenario? Nope.

Cardspace is fascinating and a solution to many problems but there are some risks that I don't know the answer to. Many enterprises have embraced the notion of an XML firewall be it layer 7, vordel, datapower, etc as the importance of handling secure parsing is something many have gotten burnt by. Now, Cardspace as an approach says lets ignore some of the best practice of XML firewalls and instead put a generic .NET parser on the front lines of our security model. Can Microsoft say that its parsing approach is as secure as Vordel? Would Mark ONeill of Vordel agree?

One way to make Cardspace more secure would be to at least guarantee it isn't subject to the OWASP Top Ten. Imagine being able to perform injection attacks on self-issued cards? Should Microsoft at least consider embedding the OWASP Enterprise Security API as a way to make it better?

Going back to the federation scenario for a moment, we would also need to consider the fact that federation products tend to be separate and distinct from web access management products. So, in this scenario the application wouldn't even have an opportunity to protect itself as the federation product would simply create a cookie and not pass context as to how this user was authenticated.

More interesting is the fact that even if the federation products wanted to pass it along to applications, there is no standard way of doing this. So, how would Ping Identity pass along the fact to Netegrity Siteminder that I signed on via federation? Does this mean that standards need to exist in the web access management space? Should Oblix, OpenSSO and others address this?