In “On Attribute-Based Access Control,” I noted that NIST defined a subject as “a human user or NPE (Non-Person Entity), such as a device that issues access requests to perform operations on objects.” Again, there’s a need to determine that the NPE has the right attributes, and is not a fake, deep or shallow.
There’s clearly a need to identify non-person entities. If I work for IBM and have a computer issued by IBM, the internal network needs to know that this is my computer, and not the computer of a North Korean hacker.
But I was curious. Can the five (or six) factors identify non-person entities?
Let’s consider factor applicability, going from the easiest to the hardest.
The easy factors
Somewhere you are. Not only is this extremely applicable to non-person entities, but in truth this factor doesn’t identify persons, but non-person entities. Think about it: a standard geolocation application doesn’t identify where YOU are. It identities where YOUR SMARTPHONE is. Unless you have a chip implant, there is nothing on your body that can identify your location. So obviously “somewhere you are” applies to NPEs.
Something you have. Another no brainer. If a person has “something,” that something is by definition an NPE. So “something you have” applies to NPEs.
Something you do. NPEs can do things. My favorite example is Kraftwerk’s pocket calculator. You will recall that “by pressing down this special key it plays a little melody.” I actually had a Casio pocket calculator that did exactly that, playing a tune that is associated with Casio. Later, Brian Eno composed a startup sound for Windows 95. So “something you do” applies to NPEs. (Although I’m forced to admit that an illegal clone computer and operating system could reproduce the Eno sound.)
Something you know. This one is a conceptual challenge. What does an NPE “know”? For artificial intelligence creations such as Kwebbelkop AI, you can look at the training data used to create it and maintain it. For a German musician’s (or an Oregon college student’s) pocket calculator, you can look at the code used in the device, from the little melody itself to the action to take when the user enters a 1, a plus sign, and another 1. But is this knowledge? I lean toward saying yes—I can teach a bot my mother’s maiden name just as easily as I can teach myself my maiden name. But perhaps some would disagree.
Something you are. For simplicity’s sake, I’ll stick to physical objects here, ranging from pocket calculators to hand-made ceramic plates. The major reason that we like to use “something you are” as a factor is the promise of uniqueness. We believe that fingerprints are unique (well, most of us), and that irises are unique, and that DNA is unique except for identical twins. But is a pocket calculator truly unique, given that the same assembly line manufactures many pocket calculators? Perhaps ceramic plates exhibit uniqueness, perhaps not.
That’s all five factors, right?
Well, let’s look at the sixth one.
Somewhat you why
You know that I like the “why” question, and some time ago I tried to apply it to identity.
Why is a person using a credit card at a McDonald’s in Atlantic City? (Link) Or, was the credit card stolen, or was it being used legitimately?
Why is a person boarding a bus? (Link) Or, was the bus pass stolen, or was it being used legitimately?
Why is a person standing outside a corporate office with a laptop and monitor? (Link) Or, is there a legitimate reason for an ex-employee to gain access to the corporate office?
The first example is fundamental from an identity standpoint. It’s taken from real life, because I had never used any credit card in Atlantic City before. However, there was data that indicated that someone with my name (but not my REAL ID; they didn’t exist yet) flew to Atlantic City, so a reasonable person (or identity verification system) could conclude that I might want to eat while I was there.
But can you measure intent for an NPE?
Does Kwebbelkop AI have a reason to perform a particular activity?
Does my pocket calculator have a reason to tell me that 1 plus 1 equals 3?
Does my ceramic plate have a reason to stay intact when I drop it ten meters?
This week I originally planned to work on Monday, Tuesday, Thursday, and Friday and spend Wednesday at the B2B Marketing Expo at the Los Angeles Convention Center. I had figured out my Metrolink and Metro connections, signed up for a “speed networking” event, and even tied a planned blog post and LinkedIn post into my “CPA” marketing campaign.
‘Til Tuesday.
Now I worked Monday, Tuesday, Wednesday, and Thursday, and am taking most of Friday off.
Consulting firms (and other firms) make a big deal about the amazing processes we use when we onboard clients. (In Bredemarket’s case, I ask questions.)
But often we don’t talk about what we do when we OFFBOARD clients. And that’s equally important.
So let’s go inside the wildebeest habitat and see how Bredemarket handles client offboarding.
In 2023 I signed a contract with a client in which I would bill them at an hourly rate. This was a short-term contract, but it was subsequently renewed.
Recently the client chose not to renew the contract for another extended period.
On the surface, that would appear to be the end of it. I had completed all projects assigned to me, and I had been paid for all projects assigned to me.
So what could go wrong?
(Don’t) Tell all the people
Plenty could go wrong.
During the course of my engagement with the client, I had enjoyed access to:
Confidential information FROM the client.
Confidential information that I sent TO the client, as part of the work for hire arrangement.
Access to client systems. (In this particular instance I only had access to a single system with non-confidential information, but other clients have granted me access to storage systems and even software.)
And all of this data was sitting in MY systems, including three storage systems, one CRM system, and one email system.
By Unnamed photographer for Office of War Information. – U.S. Office of War Information photo, via Library of Congress website [1], converted from TIFF to .jpg and border cropped before upload to Wikimedia Commons., Public Domain, https://commons.wikimedia.org/w/index.php?curid=8989847.
Now of course I had signed a non-disclosure agreement with the client, so I legally could not use any of that data even if I wanted to do so.
But the data was still sitting there, and I had to do something about it.
Take It As It Comes
But I already knew what I had to do, because I had done this before.
Long-time readers of the Bredemarket blog will recall an announcement that I made on April 22, 2022, in which I stated that I would no longer “accept client work for solutions that identify individuals using (a) friction ridges (including fingerprints and palm prints) and/or (b) faces.” (I also stopped accepting work for solutions involving driver’s licenses and passports.)
I didn’t say WHY I was refusing this work; I saved that tidbit for a mailing to my mailing list.
So, why I am making these changes at Bredemarket?
I have accepted a full-time position as a Senior Product Marketing Manager with an identity company. (I’ll post the details later on my personal LinkedIn account…)…
If you are a current Bredemarket customer with a friction ridge/face identification solution, then I already sent a communication to you with details on wrapping up our business. Thank you for your support over the last 21 months. I’ll probably see you at the conferences that my employer-to-be attends.
That communication to then-current Bredemarket customers detailed, among other things, how I was going to deal with the confidential information I held from them.
So I dusted off the pertinent parts of that communication and repurposed it to send to my 2023-2024 client. I’ve reproduced non-redacted portions of that communication below. Although I don’t explicitly name my information storage systems in this public post, as I noted above these include three storage systems, one CRM system, and one email system.
Bredemarket will follow the following procedures to protect your confidential information.
Bredemarket will delete confidential information provided to Bredemarket by your company by (REDACTED). This includes information presently stored on (REDACTED).
Bredemarket will delete draft and final documents created by Bredemarket that include company confidential information by (REDACTED). This includes information presently stored on (REDACTED).
If your company has provided Bredemarket with access to your company OneDrive, Outlook, or Sites, Bredemarket will delete the ability to access these company properties by (REDACTED). This includes deletion from my laptop computer, my mobile phone, and my web browser. Bredemarket further recommends that you revoke Bredemarket’s access to these systems.
If your company has provided Bredemarket with access to all or part of your company Google Drive, Bredemarket recommends that you revoke Bredemarket’s access to this system.
I will inform you when this process is complete.
So I executed the offboarding process for my former client, ensuring that the client’s confidential information remains protected.
Love Me Two Times
Of course, I hope the client comes back to Bredemarket someday, in some capacity.
But perhaps you can take advantage of the opportunity. Since your competitor no longer contracts with Bredemarket, perhaps YOU can.
To learn WHY you should work with Bredemarket, click the image below and read about my CPA (Content-Proposal-Analysis) expertise.
Bredemarket’s “CPA.”
Postscript
No, I’m not going to post videos of the relevant Doors songs on here. Jim’s Oedpidal complex isn’t business-friendly.
Whether and how you delegate something depends upon its importance, especially if you recognize three levels of importance. Sometimes the very important and critically important items require a CPA, or Content-Proposal-Analysis marketing professional. (I know one.)
When you have a single level of importance, then decisions are pretty simple. For urgent things, do it yourself if it’s important, delegate it if it’s not.
When “importance” is more granular
But what if, instead of “Not Important” and “Important,” we had three levels of importance instead of just one? In other words, “Not Important,” “Important,” “Very Important,” and “Critically Important”?
A U.S. Navy plane flying over a Soviet ship in October 1962 is, um, classified as “Critically Important.” Oh, and it’s urgent. By USN – Dictionary of American Naval Aviation Squadrons Volume 2: The History of VP, VPB, VP(H) and VP(AM) Squadrons [4], Public Domain, https://commons.wikimedia.org/w/index.php?curid=7328539.
In that case, you not only consider whether to delegate something, but who should be delegated that thing. (Or, as you’ll see, WHAT should be delegated that thing.)
If the need is not important, delegate it, but it doesn’t really matter to whom or what you delegate it. ChatGPT or Bard is “good enough,” even if the result is awful.
If the need is important, delegate it to someone you trust to create very good content. Let them create the content, you approve it, and you’re done.
If the need is very important, then you may delegate some of the work, but you don’t want to delegate all of it. You need to be involved in the content creation process from the initial meeting, through the review of every draft, and of course for the final approval. The goal is stellar content.
If the need is critically important, then you probably don’t want to delegate the work and will want to do it yourself—unless you can find someone who is better than you in creating content.
As I noted in October, a more granular approach to importance increases the, um, importance of Bredemarket’s services.
In the simple Eisenhower Matrix model, Bredemarket handles the Not Important stuff while you handle the Important stuff.
In the “three levels of importance” model, Bredemarket handles the Very Important and Critically Important stuff. Because the merely Important stuff and the Not Important stuff doesn’t require my 30 years of technology, identity, and biometrics expertise.
Sometimes you need a CPA (but NOT a Certified Public Accountant)
But if your needs are critical, and you require the services of a CPA (Content-Proposal-Analysis marketing professional), then you need to learn what Bredemarket can do for you. Click on the image to learn more.
In my circles, people generally understand ‘biometrics’ to refer to one of several ways to identify an individual.
But for the folks at Merriam-Webster, this is only a secondary definition of the word “biometrics.” From their perspective, biometrics is primarily biometry, which can refer to “the statistical analysis of biological observations and phenomena” or to “measurement (as by ultrasound or MRI) of living tissue or bodily structures.” In other words, someone’s health, not someone’s identity.
Fun fact: if you go to the International Biometric Society and ask it for its opinion on the most recent FRVT 1:N tests, it won’t have an answer for you.
So Abbott salespeople, real or imagined, won’t be interested in what I’ve been doing for the last 30 years. ‘Cause you know sometimes words have two meanings.
But those of you who use biometrics (and other factors) for individualization WILL be interested. Click on the image to find out more.
Drive content results with Bredemarket Identity Firm Services.
Perhaps I was a little agitated or excited this afternoon.
Perhaps I was a little agitated because five (or maybe more; I lost count) scammers had sent me LinkedIn DMs when they gravitated to my #opentowork LinkedIn banner…like flies speeding to a carcass. (Which gave me an excuse to write about identity management on LinkedIn.)
Or perhaps I was a little excited because a Never Search Alone participant had shared an identity management product marketing position with me.
The bot says hello
After applying for said job, I was reading the company’s website to learn about its identity management product when the company’s bot kept on messaging me.
At 2:30 pm Chat Bot says: Hello, this is an AI Rep from [COMPANY]. If you need any assistance, feel free to ask.
At 2:30 pm Chat Bot says: Saw that you’re interested in our SaaS management and identity governance software. Any questions?
Being the curious type (after all, I worked for IDEMIA), I wondered how the chat bot would deal with what I REALLY wanted to ask about.
Not about a demo.
Not about the company’s recent funding round. (Series B, $35 million.)
At 2:47 pm I say: With 30 years’ identity experience and 9 years as a PMM, I just applied for your Sr PMM Identity Management role. So the only question that I have is when you will interview me.
And yes, my assumption that the company would immediately drop everything and interview me may have been a little overconfident. But it’s better than imposter syndrome.
And after all, this was just a bot. I assumed that the bot would be completely confused by my question, so no harm would come from overconfidence.
You know what they say about people who assume?
The bot exceeds expectations
At 2:47 pm Chat Bot says: Thanks for applying for the Sr PMM Identity Management role! Could you provide your email address so we can follow up on your application status?
One note here: the bot parroted my response back to me. The company’s job description does not include a job title with the “PMM” acronym.
Regardless, I was pleasantly surprised. The bot was trained to respond to job applicants. So I provided the email address that I used for my job application.
The bot does not meet expectations
That’s when I was UNPLEASANTLY surprised.
At 2:47 pm Chat Bot says: Thank you for your interest. Please provide a business email address so we can follow up on your application status.
Apparently the training wasn’t thorough enough. Think about it; if you’re an individual applying for a job, why would you apply with a “business email address”? Which one? From your current employer? THAT is not a good idea.
But as it turns out, I DO have a business email address-the one for Bredemarket. So I entered that, even though that email address does not appear anywhere on the job application that I had just submitted.
At 2:47 pm Chat Bot says: Thank you for providing your email. Our team will review the conversation and follow up if necessary. How else can I assist you today?
So it will be interesting to see whether the company contacts me at both of my email addresses.
(Post image generated at craiyon.com)
Postscript for those who don’t click on every link in a Bredemarket post
You missed Brian May’s collaboration with the Weebl folks.
This resonated with me because in mid-September I spent some Instagram time thinking about the word “flash” (as in how fast a human can create content).