Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/11/2007
09:48 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Architect's Many Identities

Dale Olds, creator of Novell's eDirectory, talks open-source ID, tuba photography, and how not to configure your home firewall

After a long day of developing an open-source identity environment, Novell distinguished engineer (yep, that's his title) Dale Olds unwinds by schlepping around his broken tuba and a camera -- photographing the instrument sitting on a mountaintop, Temple Square in Salt Lake City, hanging from a tree, and even parked in a men's restroom.

Figure 1:

Olds, who is one of the original architects of Novell's eDirectory and currently heads up its Bandit project, has had the ramshackle tuba since high school when he found it sitting in his neighbor's trash. He took a photo of the tuba there and decided to keep it and shoot it on location in other places which he has done on and off over the years. He got a new digital SLR camera recently, and now he's back shooting the tuba. "The tuba pictures have gotten a resurgence" now.

He says there's a strange symmetry here with his day job. "There's a correlation [between] a lot of people I work with in the industry and music and photography." Olds says he sees a link between identity and security folks and quirky senses of humor and photography.

But the dangers of identity theft and security are no joking matter to Olds, 46. He says the main problem is users have too many online accounts, and there's no way they can truly secure and manage them. "It's difficult to keep track of usernames and passwords for all those accounts and it's insecure," he says.

What scares him even more are efforts to centralize identity data under one umbrella. "Identity is already everywhere," he says. "We see this with the lessons we learned with NDS: Large corporations could hold and manage all the [identity data] and control ACLs [access control lists] on it. But that meant NDS admins were a political entity and had too much power in the organization. That became a big bottleneck."

Bandit's goal is to provide open source components for authorization, authentication, and auditing, he says, so you have a consistent IT experience.

When he first joined Novell, Olds served a brief stint as manager of the OS/2 Redirector team. But Olds confesses management wasn't for him: "I just really sucked at being a manager," he says. So Olds took up a project to resuscitate a Novell project that implemented X.500 Directory Services for NetWare, which eventually became NetWare Directory Services, and now, eDirectory.

"At the time I thought, 'OK, I'll take it because this project was already flailing for a year, and it has no chance for success, but it would get me working on the network kernel, into the guts of the OS,'" he says.

He notes that directory services really isn't called that anymore -- it's now morphed into identity management.

It was Olds' son JT, now 21, who actually gave the elder Olds his first official lesson in security, however. JT, who had come home from college on a visit, noticed that the family's firewall wasn't configured properly, resulting in one of the home computers being compromised. His dad had left the SSH port visible and the family babysitter's account on one machine had been compromised. "I had a breach in my firewall, and he chewed me out and locked me out of the firewall," the elder Olds recalls. "He said he's a security guy and I'm an identity guy, and that's why my security practices were lax."

JT, a student at the University of Minnesota and currently an intern with Google, was aware of a wave of password attacks targeting weak passwords like that of the Olds' babysitter. "So he reinstalled all the machines and wouldn't give me the password to the firewall," Olds says with a laugh. "So we had a standoff for a month. Finally, I made it clear I still paid for the DSL. So he gave me back the password."

Olds says the key to securing identity is networking human identities like machines. "If we do something like combine all user credentials into a single store and try to protect it, we could end up with a doomsday scenario politically and otherwise, and end up doing real harm. That's the really scary aspect of this."

Personality Bytes

  • Instruments Olds plays: Not the tuba... "Violin, guitar, mandolin, though none of them well anymore."

  • Coding for fun rather than profit: "A few snippets of C# code on Mono to help my daughter solve some number problems for her homework. Also, some code to automatically find duplicate files (particularly photos) in a large, messy file system. I also played around with some PHP code in an identity provider for the PamelaProject."

  • Favorite team: "Um, I'm sports challenged."

  • After hours: "I drive my children around."

  • Favorite hangout: "Red Butte Gardens outdoor summer concert series. Last night was a great blues show with Susan Tedeschi and Derek Trucks."

  • What Olds most recently added to his iPod: "John Butler Trio, Corinne Bailey Rae, and Kenny Wayne Shepherd. But my iPod is mostly audio books. Most recent are the Tipping Point, Blink, and Cesar's Way."

  • PC or Mac? "Linux, almost exclusively."

  • Comfort food: "Very spicy Thai or Indian. Anything with wasabi on it."

  • Ride: "Nissan Pathfinder. It gets me where I want to go."

    — Kelly Jackson Higgins, Senior Editor, Dark Reading

  • Novell Inc. (Nasdaq: NOVL)
  • Google (Nasdaq: GOOG) Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Mobile Banking Malware Up 50% in First Half of 2019
    Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
    Exploits Released for As-Yet Unpatched Critical Citrix Flaw
    Jai Vijayan, Contributing Writer,  1/13/2020
    Microsoft to Officially End Support for Windows 7, Server 2008
    Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: This comment is waiting for review by our moderators.
    Current Issue
    The Year in Security: 2019
    This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
    Flash Poll
    [Just Released] How Enterprises are Attacking the Cybersecurity Problem
    [Just Released] How Enterprises are Attacking the Cybersecurity Problem
    Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-7227
    PUBLISHED: 2020-01-18
    Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
    CVE-2019-15625
    PUBLISHED: 2020-01-18
    A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
    CVE-2019-19696
    PUBLISHED: 2020-01-18
    A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
    CVE-2019-19697
    PUBLISHED: 2020-01-18
    An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
    CVE-2019-20357
    PUBLISHED: 2020-01-18
    A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.