Last week, I was at the 7th Annual Smart Card in Government Conference and had the opportunity to join a panel on “Personal Identity Verification (PIV) – Technologies” and presented a session entitled “Managing PIV Lifecycle and Converging Physical and Logical Access Control” with emphasis on implementing HSPD-12/FIPS-201 mandates. I thoroughly enjoyed my participation in the conference, particularly the overwhelming … Read more »
Everything looked good till I encountered a weird bug that restricted adding media to the posts. Now I am waiting for the next stable release of WordPress ! Hopefully I get something real soon.
I received this question from one of our book readers …ofcourse XSS is becoming widely popular. I had my own first-hand experience of XSS by test driving in my lab – believe me – I don’t have malicious intentions or crazy motives. If you want to verify your J2EE Web applications for XSS ulnerability…here is my cooked response – for… Read more »
The CLOUD computing buzz.. always sounded to me like another hosting infrastructure services that builds on XEN Virtualization services. What it makes more compelling is…. it facilitates on-demand/out-sourced datacenter that scales up and allows us to pay-as-you-go for used services. Couple of months ago, I had a chance to try out my own Amazon EC2 Web services account playing with… Read more »
Couple of days ago, I received the above question from one of our readers. Although I briefly responded to him over email, I really wanted to explore the known traits for defending this vulnerability : HTTP response splitting is a Web application input validation vulnerability that allows to exploit the HTTP headers of a Web application for initiating attacks leading… Read more »
I always had a love and hate interest with using OpenSSL ! But I should agree that it did help me many times…whenever I wanted to quickly test-drive my craziest ideas with PKI certificates. Couple of things I like about OpenSSL is its tools/utilities for testing as equivalent to a commerecial-grade CA and its FIPS-140 compliance. Also, I always get… Read more »
Are you tired of the high-level SPML content floating around the web from couple of analysts with no practical guidance ! If you are a practical guy..who want to explore SPML, here is something that you may find worth test-driving for SPML 1.0 amd SPML 2.0 based provisioning operations. I had been using SPML using Sun IDM 7.0 for a while now. Most… Read more »
Sun Ray Thin Clients has been widely popular in Government applications for a while now. With the introduction of HSPD-12/PIV cards, I had multiple requests from my SI friends asking me to verify whether PIV cards work on SunRays for hotdesking and enabling PKI based authentication. As on today, Sun Ray Session Server 4.0 does’nt officially support PIV cards …particularly… Read more »
Last week, I was at RSA Conference and I joined a panel with Mark Diodati (Burton Group) and Sampo Kellomaki (Symlabs) to discuss interoperable Identity provisioning ! I delved into SPML 2.0 and highlighted the strategies of using SPML 2.0 for interoperable provisioning. Here is the link to our slides – Interoperable Identity Provisioning in a Distributed World (With emphasis… Read more »
I had multiple opportunities to work on SPML based user-provisioning with Sun Java System Identity Manager. I found SPML as a very compelling standard, it worked as piece-of-cake on Sun IDM that certainly simplified my efforts on representing provisioning requests intended for creating, modifying, canceling, deleting, enabling, disabling, searching user accounts and associated access control privileges with multiple resources. Naturally… Read more »