Bjorn's identity
Once again, DotSec were proud sponsors of the AusCERT information
security conference.
The event was great, and provided a good
opportunity to catch up with past colleagues and discuss a range of
topics.
We
gave a presentation entitled, "Bjorn's identity" (very witty, I'm sure
you'll agree :-) but which also could have been entitled, "Identity
Management at Queensland
Health: A True Story!"
The presentation described a couple of
things:
First of all, it described how DotSec, QH and Australian and overseas publishers have successfully implemented SAML-based Identity Management (IdM) for a variety of resources that make up the Clinician's Knowledge Network (CKN).
This presentation presented an
overview of what CKN is and does, the goals for IdM with the CKN, and
the benefits
that have resulted from having implemented the CKN IdM
infrastructure.
The presentation also outlined some of the tricks and traps that were associated with the deployment, and some of the options for CKN and IdM in the future.
Of course, no presentation is much fun
without live, on-line demos, so we connected our laptop to the WLAN and
ran a couple of demos on the servers back in Brisbane. The demos
showed a couple of things including how Dr Bjorn could rely on the
underlying IdM infrastructure to take advantage of Web Single Sign-On
and Single Log Out.
That was neat enough but for the real
meat, we showed how Bjorn could share private information across
servers in different domains, in a controlled way. Our demo servers
utilised DotSec's SAML-based IdM infrastructure, and Google's Google
Apps authentication infrastructure. Demo applications were hosted on
servers within both environments, and both were able to securely
exchange Bjorn's calendar information in a controlled way using SAML
and Oauth.
Please feel free to download the presentation slides and to contact us if you have any questions or comments.
Internet banking is dead! Long live Internet banking!
Once again, DotSec were proud sponsors of the AusCERT information
security conference. The event was great, and provided a good
opportunity to catch up with past colleagues and discuss a range of
topics.
DotSec was also able to deliver a
presentation, which is linked to below, but first of all, a confession:
The title of this presentation is intentionally tongue-in-cheek,and we
do not really think that Internet banking, as a general service, is
dead. In fact, the presentation did not even focus exclusively on
Internet banking! However, since Internet banking is essentially one of
the archetypal secure online applications, it provides a convenient
example of why secure applications-development frameworks should exist,
as well as illustrative examples of what can go wrong if they do not.
In order to provide some concrete examples, the presentation included
live demonstrations of three types of attack. The demonstrations were
taken from vulnerabilities that we have seen in applications from the
legal, government, education and finance sectors, all of which have
been munged together and anonymised on a fake DotSec-hosted site, for
our use during the presentation.
Please feel free to download the
presentation slides and to contact us
if you have any questions or comments.