Je kent het wel: je twijfelt aan jezelf en je vraagt jezelf af: “Had ik hem nou op het terras laten liggen? Of niet?”
Of je komt bij je auto, met als resultaat een ingeslagen raam. Je bent je telefoon kwijt. En nu?
 
Hoe je het ook went of keert, de telefoons van vandaag zijn heuse computers en worden steeds belangrijker in ons (zakelijke) leven. Bewust of onbewust ben je ineens een sleutel(apparaat) kwijt dat toegang geeft tot vele poorten. Je e-mail staat er op, smsjes, agenda's, contacten en wellicht nog wat documenten. Natuurlijk synchroniseer je deze met systemen als MS Exchange, Gmail, iCloud etc. Je bent je data niet kwijt want die staat netjes opgeslagen, maar je je smartphone heeft wel live toegang tot deze omgevingen. Denk eens na wat er dan allemaal mogelijk is: het resetten van je Facebook of paypal account? Aankopen doen op Amazon of Ebay? Je baas of die ene klant een vreemde email sturen? Of... het wissen van alle gegevens welke in deze systemen staan opgeslagen.
 
In de toekomst verwacht ik dat het nut van je mobieltje, smartphone of tablet alleen maar gaat toenemen. Nu al kun je je telefoon gebruiken voor toegangscontrole (vervanging van de bekende witte toegangspas) of voor betalingen (NFC). De functionaliteit van mobiele apparatuur wordt alleen maar groter.

Indien je je smartphone kwijt bent is het van groot belang om snel te reageren, maar ook niet overhaast omdat acties misschien wel voor meer problemen zorgen i.p.v. minder.
Wat doe je wel en wat doe je niet:

• Blokkeer je simkaart pas als je er zeker van bent dat niets meer mogelijk is. Als je deze laat blokkeren zal de telefoon van de buitenwereld zijn afgesloten, het automatisch vernietigen van data of eventuele GPS tracking is dan ook niet meer mogelijk. Dit geld ook voor je eventuele wachtwoorden van bijv. Exchange.
• Indien je de data op afstand vernietigd, ga er niet blindelings vanuit dat alle data ook echt verwijderd is. Veel telefoons hebben bijvoorbeeld een geheugenkaart met opgeslagen documenten of een backup.
• Indien gevoelige informatie op de telefoon was opgeslagen is het belangrijk eventuele gevolgen direct in te schatten. Meld deze gevolgen aan betrokkenen, het is beter vroeg te acteren dan dat men later de gevolgen moet opruimen.
• Doe aangifte, via deze weg kunnen instanties criminelen opsporen en wellicht te telefoon terug vinden. Als deze is terug gevonden controleer dan de status van het apparaat.
• Indien je twijfelt: zoek hulp bij professionals

ITQ assisteert haar opdrachtgevers regelmatig als er een security incident heeft plaats gevonden, ook op het gebied van mobiele apparatuur. Daarom hebben we een aantal voorbereidings tips:

• Denk er over na welke informatie er op een smartphone gebruikt mag worden: voorkomen is immer beter dan genezen en informatie die niet aanwezig is, kan ook niet zoek raken. Leg dit vast in een beleid en verbind er eventueel voorwaarden aan. En wat vooral belangrijk is: breng het beleid onder de aandacht van de medewerkers.

• Zorg voor beheersbaarheid, hierbij kun je denken aan:
  
  • Het afdwingen van een (sterke) wachtwoorden
  • Het verplicht stellen van een gedegen versleuteling
  • Automatische vernietiging van data (ook op afstand) bij misbruik/diefstal/verlies van de telefoon/pincode.
  • Lifecycle en patch management, telefoons met kwetsbaarheden kunnen bijvoorbeeld informatie op de telefoon in gevaar brengen.
  • Onderzoek naar track&trace functionaliteit van telefoons. Denk bijvoorbeeld aan telefoons die de GPS locatie kunnen  doorgegeven.

• Leg vast hoe er met smartphone security incidenten omgegaan dient te worden. Welke stappen pas je wel toe en welke niet? Wie mag deze stappen ondernemen en wat zijn de escalatie mogelijkheden?

• Het is verstandig om van te voren contact te zoeken met lokale instanties, specialistische bedrijven of telefoon providers en hiermee afspraken te maken. Op deze manier kan er snel geacteerd worden als een telefoon gestolen is.

Want ook voor verlies van smartphones geldt:
Een goede voorbereiding is het halve werk.

Cloud, cloud cloud cloud… heard it enough? Hope not, this post is about clouds. The internet is full of cloud at the moment. Will the cloud take us all and connect us permanently to the internet? Or are we hanging on to a disconnected part of our digital lives? I took a dive in into the clouds to see where it would take me.

The first thing I did was install a cloud operating system. It still requires some installation, but after that, you’re floating somewhere in the clouds. This is where my first issue with the current cloud peeks around the corner. “Login or set up an account if you don’t have one” … great, more passwords to remember. Almost every cloud app I’ve used required me to set up an account. For some apps that’s not an issue as I had accounts for them already, but still, want to add an app, there is a good chance you need an account to take full advantage of the app. In some cases there is no way around it (for the OS itself for example), but for a news app that needs to display Dutch news instead of United States?

Accounts aside, it did all work. I had my documents (Dropbox/Skydrive), I had my music (Spotify) and my social stuff was there as well (Facebook, Twitter and Pidgin). With my Windows Live account I could access Office Live to edit my documents (part of this post was written in the cloud).

This is where we get to the real issue I see in the clouds. They are my files and folders on both Dropbox and Skydrive, but who’s to say they are safe and secure (this applies to all the stuff you can put in the cloud)? And what happens when my files go missing? What if I want to move all my stuff to a service that suits me better? Who can still access them after I delete my account? Privacy peeks around the corner as well, but I’ll skip that one.

I think the cloud is a great invention but are we heading towards an internet where everything is stashed away in a place we do not fully control? As it stands right now, I’m not ready yet to fully commit to the cloud, are you?

Windows Identity Foundation or WIF is a Microsoft technology that allows you to move authentication and authorization logic out of your application. Suppose you are building a web site, then using WIF you no longer have to build your own login page and user store. Instead, you let a so-called Identity Provider, sometimes called a Security Token Service or STS authenticate your users. Your web application, called the Relying Party (RP), has a trust relationship with the STS and when the STS presents a user token to the RP, the RP knows that the user represented by the token is authenticated.

To clarify the example a little, suppose you choose Windows Live as your STS. When I hit a secure section of my web site, WIF intercepts the request and redirects it to the Windows Live authentication page. I sign in with my Windows Live credentials, Windows Live creates a security token for me and redirects me back to my web site using this security token. WIF checks the token and I’m authenticated.

Multiple identity providers

In the example above I used a single STS but suppose I want to allow users from multiple identity providers (Google, Yahoo, Facebook, etc). Microsoft has a solution for this called AppFabric Access Control Service V2, available on portal.appfabriclabs.com. It is a proxy between your application and currently five identity providers.

In the screenshot I have activated two identity providers.

Claim sets

When you sign in to an identity provider, it generates a token that represents who you are. So what exactly is a token? A token contains a set of claims about a user and is digitally signed by the STS. So when I login to Windows Live, a token is generated that contains some claims about me. A claim can be an e-mail address or a last name or anything else that the identity provider may wish to disclose about you. And that’s what we are interested in today. Each identity provider provides a different set of claims. Some may produce more claims, others may produce just an identifier. So the question is: what are the claims provided by each identity provider currently supported by AppFabric ACS?

For this post I have not yet tested Microsoft Active Directory Federation Services 2.0 because I haven’t set that up yet. When I have, I’ll update this post or write a new one describing the possibilities that ADFS offers.

Before we start it is important to note that AppFabric ACS simply passes all claims from each identity provider through unchanged.

Windows Live ID

Windows Live is the provider that offers the least amount of claims. It only gives your application a unique user identifier. The other claim is added by AppFabric ACS to let you know what identity provider was used (you’ll see this claim type for every STS).

Windows Live does not offer any options for getting more user information. This is a deliberate choice to protect user’s privacy. This is also the reason that Windows Live does not ask the user for confirmation to share information with a third-party application: no personal information is actually shared.

Google

Google offers a little more user information when asked for it. Besides, Google as an additional step explicitly asks your permission to share your information with AppFabric ACS. In my case this means that I have to confirm that rwwilden-appfabric-labs.accesscontrol.appfabriclabs.com is allowed access to information from my Google account.

The reason Google asks for your permission to share information is that they actually provide information that can be traced back to a person.

Google does not offer any options for getting additional information.

Yahoo!

Yahoo! provides the same claims Google does. They also have a confirmation step to allow the user to think again before sharing information with a third-party application.

Facebook

Facebook does not have a very good record of keeping its user’s data private (I inserted some random links to sites I found when searching for ‘facebook privacy violation’). However, the set of claims when using Facebook as your STS is limited. The extra claims are an access token and an expiration date.

Besides, Facebook asks for your permission when you sign in for the first time, just as Google and Yahoo! do.

However, you can configure AppFabric ACS to ask the Facebook STS to grant access to an extensive set of permissions based on the access token claim. For example, I can let AppFabric ACS ask Facebook for permission to read a user’s birthday.

The above screenshot is from the AppFabric ACS portal. When I sign in this time via Facebook I get a new request for permission (in Dutch) asking me to allow the third-party application access to the birthday field.

When I allow this, there are no new claims added to the claim set. However, I can use the provided access token to get additional user data via Facebook’s Graph API. The url

https://graph.facebook.com/rwwilden?fields=birthday&access_token=…

gives me a small JSON document:

{
   "birthday": "04/11/1977",
   "id": "100001960422926"
}

containing my birthday. So far so good. My application has requested permission to access my birthday, I have given this permission and using the provided access token claim I can access the birthday field.

What about other fields? The documentation for the Facebook API User object specifies that I need the user_work_history permission to read the work field. I have never given this permission so the following url should generate an error or at least no work history.

https://graph.facebook.com/rwwilden?fields=work&access_token=…

And it works as expected:

{
   "id": "100001960422926"
}

Conclusion

The differences between identity providers currently supported by AppFabric ACS are large. On the one end there is Microsoft with Windows Live, providing only a user identifier. On the other end there is Facebook with a lot of configuration options. If you want to support Windows Live ID, the only information the STS gives you is that a user is authenticated. Additional user information can only be stored inside your application.

Even if you use Google or Yahoo! you probably need to store additional user information. The Facebook API offers all personal information you may ever need to know about your users so there is no need to store any additional user information inside your application. Facebook clearly wins when you look at it from an application builder standpoint.

From a privacy standpoint it is clear that Microsoft wins. For a third-party application making use of Facebook as an STS it is very easy to know all about its users. It’s only one button click away.

Yesterday I was trying to upgrade an ASP.NET MVC 2 web application to ASP.NET MVC 3 RC2. I also wanted to use the new Razor view engine that allows a more compact and less obtrusive way of writing ASP.NET MVC view templates.

There already is an excellent guide of how to upgrade your MVC 2 application to MVC 3 RC2. If you are running your MVC 2 application in Windows Azure, you must take some additional steps, which are described here. Visual Studio 2010 doesn’t (yet) allow you to specify an ASP.NET MVC 3 Web Role, so when running in Azure, you always have to upgrade if you want to use MVC 3.

You should reference some extra DLL’s from your MVC project and make sure that for all these DLL’s you set Copy Local to True. This is necessary because on the virtual machine your application is deployed to these DLL’s are not in the GAC. The DLL’s you have to reference are:

• Microsoft.Web.Infrastructure
• System.Web.Helpers
• System.Web.Mvc
• System.Web.Razor
• System.Web.WebPages
• System.Web.WebPages.Razor
• WebMatrix.Data (I’m not sure why this one is necessary)

and these are located either somewhere below C:\Program Files (x86)\Microsoft ASP.NET for 64bits or below C:\Program Files\Microsoft ASP.NET for 32bits. So far so good.

Having taken all the required steps (or so I thought) I tried to run my first Razor template in the Windows Azure emulator:

No what I expected: The name ‘ViewBag’ does not exist in the current context. I must have forgotten something. After double-checking I had all the required dependencies that all had there Copy Local property set to True, I took a better look at the Compilation Source. My page appeared to extend from System.Web.WebPages.WebPage. This class doesn’t have a ViewBag property so that explains the compilation error.

Back to the upgrade instructions. It appeared I had forgotten one small step. In the Views sub directory there is an additional Web.config file. In an MVC 3 project, it contains a new configuration section: system.web.webPages.razor. In this section, a new page base type is specified: System.Web.Mvc.WebViewPage. After copying this Web.config file from another MVC 3 project, everything worked as expected.

A classic case of RTFM. But if you ever happen to see this compiler error when using the Razor view engine, check your Web.config file.

At PDC10 Microsoft announced a new Compute Instance Size: Extra Small. Previously, there were four Azure Virtual Machine Instance sizes: Small, Medium, Large and Extra Large, each with its own price and resources. The standard price for an Extra Small instance is $0,05/hour (to compare, the Small VM costs $0,12/hour). What you get for this price is not a lot as you can expect:

• 1 x 1GHz processor
• 768 MB memory
• 20GB storage
• 5Mbps network bandwidth

These low resource levels are achieved by having multiple XS VMs share resources on the same node.

In my opinion the new XS VMs are interesting for two reasons. First of all, they’re ideal for testing purposes. Individual developers can get there own Windows Azure account and use it to deploy only XS instances. A few days ago I deployed an ASP.NET MVC app to four XS instances. After confirming everything worked, I removed the hosted service and the whole excercise cost me just $0,20.

A second reason this may be interesting is when you have a large workload that you can divide over a (very) large number of nodes. Suppose you have a workload that can be divided into 1000 chunks. Using 1000 Extra Small instances will cost you $50,00 per hour, using the same number of Small instances will cost you $120,00 per hour.

Deploying Windows Azure roles to Extra Small VMs is really easy. Just like the other VM sizes you select it in the role’s property panel:

Yesterday evening I was working on a small Windows Azure project. One web role and one worker role with blob storage and a queue. I deployed the app yesterday using the ‘old’ management portal. This evening I had to choose: do you want to continue using the old portal or do you want to use the new and improved Silverlight management portal. That’s an easy choice to make.

At first looks it’s pretty complete. The home page offers some links to help pages in case you don’t know where to find your services. On the left you have a menu and the top contains a ribbon bar.

I’m not really into reading tutorials so the menu item ‘Hosted Service…’ seems the next logical step. It brings you to a window with some new menu options and the top-level one is ‘Deployment Health’. I’m not really a power user but it seems my single deployment is healthy, lucky me!

What’s also cool and what you see in every window is a timer that tells you when the data on the current window will be refreshed. In this case it’s 4 seconds until the next refresh.

As you can see I have one hosted service and one storage account. Selecting my hosted services brings you to the next window that shows my Azure subscription containing one hosted service.

There’s a wealth of information here. The properties pane on the right shows you relevant information for the selected node. You can select additional columns with information like ‘Environment’, ‘Subscription ID’ and others. When you select the ‘Storage Accounts’ menu item you can see the endpoint urls for your blob, table and queue storage and you get easy access to your primary and secondary access keys for accessing your storage.

Although I’m using just a tiny amount of the functionality offered by Windows Azure it seems that this new Silverlight portal is a huge improvement over the previous web-based one. First of all it gives the impression that it’s really fast. Second there’s a lot more information readily available. In the web-based portal this information was usually one or two clicks further away.

Until now I found one thing missing in the new portal and that’s the billing information. I’m not sure they should incorporate this into the Silverlight application but there should at least be a link to the Microsoft Online Services Customer Portal.

As you may have noticed in the screenshot, there’s a menu item in the bottom left corner called ‘Virtual Network’. This is actually the feature I told you about in a previous post that allows you to connect to on-premises machines from Windows Azure services. Unfortunately the beta program hasn’t started yet or my subscription for the Azure Connect has failed so I can give you no more details on that.

Maybe next time more on Windows Azure itself or on one of the new beta features (Extra Small VMs, Windows Azure Connect and VM Role).

Some people asked me after my previous post, how we could move Provisior into the cloud. As some of you may (or may not) know, Provisior is a user provisioning portal that uses Microsoft Active Directory (AD) extensively. This AD is usually a very valuable organizational asset that lives inside a DMZ behind a number of firewalls. This forces us to also install Provisior inside the DMZ. Provisior as a cloud-based service seems impossible.

However, Bob Muglia announced two new Windows Azure features in the PDC 2010 keynote that may make this possible: Windows Azure Virtual Machine Worker Role and Windows Azure Virtual Network (the links actually take you right to the announcements inside the keynote, pretty cool).

With the VM Worker Role it will become possible to migrate completely configured Windows Server 2008 R2 into the cloud. You can run any application you like inside this VM.

Virtual Network is the umbrella name for all Windows Azure networking functionality. One of its features will be the possibility to join a cloud-based VM directly to a customer domain. Perhaps now you can see where we’re going…

The picture below gives a general overview of the idea. Provisior will become a cloud-based web application running inside Azure Web Role. There can of course be different skins for different customers, some customers may have specific functionality enabled but every customer essentially connects to the same application. For every customer a VM is configured inside Windows Azure that joins the customer Active Directory domain. The picture shows three VM’s that correspond to three customer domains. Code running inside each VM uses a sufficiently privileged domain account to be able to access the customer AD.

There are of course some challenges to be resolved:

• How do we make sure that every user request is directed to the correct VM?
• How do we authenticate users? Currently, Provisior uses Windows authentication. Can we still use this somehow, given that users from different domains access the same cloud application. I haven’t looked into that yet.
• And a more practical question: how difficult is it to transform Provisior into a cloud application?

When the CTP for Windows Azure Virtual Network is released, I’ll surely take a look to see what is possible.

 EDIT: If you want to know more about Windows Azure Virtual Network, there is a pre-recorded PDC session that goes into the details: http://player.microsoftpdc.com/Session/3a93d6a3-e52e-4613-b18b-a49754203d09.

Ook het support wat er bij hoort gaat allemaal niet zo hard.

De MSDN subscription die ik heb omvat ook SQL Azure, 3 databases als het goed is.
Alleen als ik in het control panel kijk dan zie ik wel een SQL Project, maar daar kan ik niets mee omdat deze disabled is. Ik dus via dat control panel een case ingediend dat mijn SQL Azure service disabled is. Dit was op zondagmiddag, en blijkbaar worden die cases alleen met US office hours bekeken want ik kreeg pas om 16:30 de volgende dag bericht terug.

En dit was het antwoord:

I have taken a look at the screenshot you sent me and searched your subscription within our system. I was able to find the MSDN Premium subscription and was able to verify that the subscription is active, so you should be able to create databases.

I would like to advise you to contact our Frontline Azure Support (FAS) directly through https://support.microsoft.com/ , as I am unable to assist you in this matter directly.

Juist. Blijkbaar heb ik de verkeerde helpdesk te pakken ofzo.. terwijl ik wel de instructies gevolgd heb.. beetje zonde van de doorlooptijd zo. Goed, dus een nieuw support request aangemaakt, om 17:00 was dat.. en volgens de site zelf zat er een response tijd van 1 uur op het issue... ben benieuwd. 3 uur later bericht dat er een engineer togewezen is aan mijn case, maar verder niets inhoudelijks. Nog maar een uurtje wachten... niets.. dan maar zelf een mailtje sturen. Half uur later een inhoudelijk bericht:

Issue Definition: We understand that that your SQL azure Service is disabled for the newly purchased MSDN subscription and you would like to activate the service.
Scope Agreement: We would enable the SQL azure Service for your subscription at the earliest and shall update you with the status of the issue at the earliest. We would like to inform you that it may take up to 24 hours for us to activate your subscription.

Okay. weer 24 uur wachten dus.

Al met al (zie ook hier) krijg ik niet echt een warm gevoel bij die Azure cloud. En de cloud en ik hebben niet echt een goede start gehad samen op deze manier, maar ik geef nog niet op hoor.. wordt vervolgd

EDIT: Het werkt inmiddels. 8 uur na de initiele melding bij Azure Frontline Support.

Naar aanleiding van Flores zijn "Cloud == Traag ?" verhaal leek het me ook eens verstandig om de cloud te bekijken vanuit een data perspectief.

Wat voor mij het grootste probleem met data in de cloud is, is dat je er geen controle over hebt. De data kan letterlijk overal ter wereld staan op 1 systeem, 2 systemen, etc.? Natuurlijk kan je contractueel een hoop afdekken maar vergeet niet dat de wetten in een ander land enorm kunnen verschillen waardoor je alsnog je data kan verliezen. Dit probleem geldt trouwens niet alleen voor cloud omgevingen maar ook voor remote servers

Maar dan versleutel je toch je data? Ja dat kan maar ook versleutelde data kent zijn “houdbaarheid”. Versleuteling welke nu nog niet te kraken is kan over 5 jaar misschien wel gekraakt worden. Als het dan gaat om bijvoorbeeld medische gegevens dan zou ik niet zo blij zijn als deze data in een land staat waar de zaakjes minder op orde zijn….

Waarom zou ik de cloud dat wel gebruiken? Nou als het gaat om publieke informatie welke flexibele capaciteit vereist. Neem als voorbeeld Youtube, zij gebruiken hun eigen servers voor alle content en indien het nodig is dan schakelen ze capaciteit bij voor populaire content. Op die manier kan je flexibel en veilig acteren.