Who's really at fault?
There is a lot of discussion currently taking place regarding a recent report that was tabled in Australian Parliament. The report is entitled, "Hackers, Fraudsters and Botnets: Tackling the Problem of Cyber Crime".
Many people discussing this report refer to sections of the report that
indicate that individual home-users should be responsible for
protecting themselves, and should be disconnected by their ISP if they
fail to do so. As the report-authors are undoubtedly aware, this kind of recommendation leads to a slippery slope where users are effectively held responsible for situations and actions that are outside their ability to control.
DotSec has delivered presentations that describe how it users can be unfairly burdened in this way. Feel free to download the presso.
Bjorn's identity
Once again, DotSec were proud sponsors of the AusCERT information security conference.
The event was great, and provided a good
opportunity to catch up with past colleagues and discuss a range of
topics.
We
gave a presentation entitled, "Bjorn's identity" (very witty, I'm sure
you'll agree :-) but which also could have been entitled, "Identity
Management at Queensland
Health: A True Story!"
The presentation described a couple of
things:
First of all, it described how DotSec, QH and Australian and overseas publishers have successfully implemented SAML-based Identity Management (IdM) for a variety of resources that make up the Clinician's Knowledge Network (CKN).
This presentation presented an
overview of what CKN is and does, the goals for IdM with the CKN, and
the benefits
that have resulted from having implemented the CKN IdM
infrastructure.
The presentation also outlined some of the tricks and traps that were associated with the deployment, and some of the options for CKN and IdM in the future.
Of course, no presentation is much fun
without live, on-line demos, so we connected our laptop to the WLAN and
ran a couple of demos on the servers back in Brisbane. The demos
showed a couple of things including how Dr Bjorn could rely on the
underlying IdM infrastructure to take advantage of Web Single Sign-On
and Single Log Out.
That was neat enough but for the real
meat, we showed how Bjorn could share private information across
servers in different domains, in a controlled way. Our demo servers
utilised DotSec's SAML-based IdM infrastructure, and Google's Google
Apps authentication infrastructure. Demo applications were hosted on
servers within both environments, and both were able to securely
exchange Bjorn's calendar information in a controlled way using SAML
and Oauth.
Please feel free to download the presentation slides and to contact us if you have any questions or comments.