Simplicity - overlooked or over rated?

I was catching up on my reading this weekend and the global message that continues to resonate is that we have forgotten simplicity when trying to address complex business issues. It’s as if we need to be as or more complex with our solution to the problem than the problem itself.

Case in point… I was reading SC Magazine and in the For/Against column was discussing database security – 'The best approach to database security is monitoring traffic before it enters the database.' I have two issues with this:

1. Whoever crafted the question, missed the point, IMHO. What does ‘monitoring’ have to do with security, and actually preventing the unauthorized access to begin with which is what you want. The relative uselessness of monitoring as compared to actually PREVENTING access should be pretty obvious. When you can monitor the unauthorized activity, alert appropriate teams, and prevent access – now that’s useful. The ‘Against’ guy alluded to it (Dr. Murray Mazer from Lumigent).
2. Let’s keep it simple. The ‘For’ guy (Gautam Vij from Symantec) had a credibility issue from the get go, working for a security vendor with 1200+ SKU’s for their products. Note to Symantec – hire an offshore firm to tackle the integration problem, or get a new marketing and product management team to come up with more integrated offerings a la Acura. They had one option with the 2006 TSX – Nav system or not. Simple works. Simple sells.

The other thing I could help but think about was a conversation I had with a colleague about how convoluted and complex IDM has become. Why? The companies that I work with today are trying to solve the same problem the companies 5 years ago were trying to solve – managing users better post authentication and automating workflows. I still need to think through what happened but I believe that it’s akin to how IDM vendors got into their space – the directory was being asked to do things it was never intended to do, and they were propagating, proprietary, and proving to be a bear to implement. Is Identity Management at the application layer headed down the same road?

What happens when you add machine identity to the mix so that companies identify machines and maintain privacy at the same time? Look here for a possible solution.

identitystuff@ gmail.com