by Shawn McKinney

Access Control is not a laughing matter

1. A couple of rowdy roles were ejected but returned the next day.

“Just who do they think they are?” asked the doorman.

“They rbac”, said the bartender.

2. Some random attributes wandered into the local bar and the bartender said,

“We don’t allow your kind around here.” The attributes were taken abac.

3. An RBAC permission walks into the bar and the bartender says,

“I thought I told you earlier to stay out of here.” The perm replies,

“You can’t deny my access.”

4. A hierarchical role walks into a bar. Bartender says,

“Hey, I know both of your parents so you best behave yourself.” And the role replied,

“Oh yeah, which ones?”

5. A group of wild attributes arrived onto the scene, stirring trouble, when the bartender said.

“You attrs better watch out, the roles rbac in town”.

6. A role and a permission walk into the bar and bartender asks,

“What’ll you have?”

“We’re celebrating a new relationship, may we please have a round?”, one asked politely.

“I’ll grant that”, replied the bartender.

7. An obviously ecstatic user strides into the bar, pulls out a huge wad of cash and buys everyone in the house a drink.

“Where’d you get all that dough?” asked the bartender.

“I’m on a role”, was the reply.

8. Two roles, in an adulterous relationship, obviously ill at ease, whispered to each other as they sat at the bar.

“What’s wrong with you two?”, the bartender asks.

“You look constrained”.

9. Two roles got into a heated political argument and a visibly annoyed bartender asks them,

“Hey, am I going to have to separate you two?”

“Don’t you be giving us static!”, one of them replied.

10. An obviously drunk role’s behavior grew increasingly unruly as the night wore on.

“Get the hell outta here!” the bartender yells at him.  Afterwards the role became inactive.

11. An ABAC permission’s wallet was stolen while sitting at the bar and asks for help.

“Who had access to you while you were here?”, the bartender asks.

“I have no idea”, the perm replied.

12. An abac attribute suddenly appeared and the bartender said,

“We don’t serve your kind here.”

“Why not?”, the attribute asked.

“Because there’s no telling where you came from”, said the bartender.

by Shawn McKinney

RBAC vs ABAC

Frequently debated within info sec circles.  Which one of them is better?

Use the right tool for the job as they say. RBAC, like any access control model, has its weaknesses. Many are well understood, even discussed by the original NIST team who framed the model.

Comments on “A Critique of the ANSI Standard on Role-Based Access Control”

However, there are a number of common fallacies wrt how RBAC works.  For example…

1. RBAC is static. It cannot use contextual information e.g. time, user location, device type.

Constraints are commonly applied during user, role and permission activation in RBAC. For example, placing temporal constraints on a role activation. Indeed INCITS 494 prescribes their use:

5.4 RBAC Policy Enhanced Constraints

Enhanced constraints go beyond the INCITS 359 RBAC Standard by including additional types of constraints. Constraints on roles may be static or dynamic. Static constraints are applied off- line before the role is activated by the user. Dynamic constraints are applied on-line after the role(s) are activated. These enhanced dynamic constraints can introduce attributes into the RBAC environment.
INCITS 494-2012, p. 8

2. RBAC cannot perform dynamic segregation-of-duty.

RBAC supports dynamic SoD constraints. From the spec:

5.3.2 Dynamic Separation of Duty Relations

Dynamic Separation of Duty Relations Static separation of duty relations reduce the number of potential permissions that can be made available to a user by placing constraints on the users that can be assigned to a set of roles. Dynamic Separation of duty (DSD) relations, like SSD relations, are intended to limit the permissions that are available to a user. However, DSD relations differ from SSD relations by the context in which these limitations are imposed. SSD relations define and place constraints on a user’s total permission space. This model component defines DSD properties that limit the availability of the permissions over a user’s permission space by placing constraints on the roles that can be activated within or across a user’s sessions.
ANSI INCITS 359-2004, p. 10

3. It relies on custom code within application layers (API, apps, DB…) to implement finer-grained controls.

Presumably what is meant here is that custom code must be written because RBAC controls don’t adequately satisfy security requirements for authorization.

Where are ABAC’s published functional specifications? Where are the standard object (data) and functional (api) model for computing (and storing) its decisions?

Perhaps it is better to use a proven, non-standard ABAC implementation than a custom app widget? If that is what is being said then I agree, but neither are ideal.

ABAC has its place as does RBAC. Knowing when to use one, the other, or both, is important. Understanding the limitations and strengths of each is crucial before adequately addressing the challenges we face as security practitioners.

by Shawn McKinney

The Eleven Commandments for Aging and Exercise

After passing the half century mark a few years ago, I find myself in a quandary over exercise.  Damned if I do and damned if I don’t.  That’s because the aging process brings on arthritis, obesity, diabetes, heart disease and a host of other conditions.  The natural inclination at this stage is to start taking it easy, but what’s really needed is to maintain an active physical fitness regime.

The problem is activities learned in youth do more harm than good during the middle years.  For example the fifty-something’s heavy bench presses will surely tear a rotator cuff in their shoulder.  The resulting injury exacerbates the natural aging condition, further prolonging and encouraging inactivity, which induces declining function of the body.

Exercise when done correctly, has the opposite effect, prolonging vigorous activity beyond the middle years into old age.  But in so doing, its focus needs to be on using increased repetitions and lighter weights to reduce the strain placed on tendons.  This will enable muscle growth which improves skeletal stability while preventing overuse injuries.  With that in mind, here are eleven commandments for keeping fit into 2017 and beyond.

  1. I will not not use barbells.
  2. I will not use heavy weights during strength training exercises.
  3. I will work my legs at least once per week.
  4. I will superset between opposing muscle groups, to keep my heart rate elevated.
  5. I will work a different type of core exercise on every strength training day.
  6. I will keep my strength training workouts short, less than 30 minutes per day.
  7. I will perform strength training exercises often, between 3 and 5 times per week.
  8. I will perform cardio exercises, preferably outside, at least 3 times per week, and a duration of 60 minutes or more.
  9. I will eat more than 5 cups of fruits and vegetables per day.
  10. I will sleep at least 7 hours per night.
  11. I will take at least one rest day per week.
by Shawn McKinney

Apache Fortress Role Engineering Tutorial

Apache Fortress Role Engineering Tutorial

The goals of this tutorial are to

  • Gain understanding of the Role Based Access Control (RBAC) standard
  • Learn the repeatable steps of the Role Engineering Process
  • Learn about using the Apache Fortress RBAC engine

To get started, follow the instructions in the README located on github:

https://github.com/shawnmckinney/role-engineering-sample

More info here: A Practical Guide to Role Engineering.

by Shawn McKinney

2016 Dirty Kanza

This post is about my first-ever Dirty Kanza 200 experience on June 4, 2016.

It’s broken into nine parts:

Part I – The Signup

Part II – Prep / Training

Part III – Friday

Part IV – Starting Line

Part V – Checkpoint One

Part VI – Hitting The Wall

Part VII – Checkpoint Two

Part VIII – Checkpoint Three

Part IX – Finish Line

Just one more mornin’
I had to wake up with the blues
Pulled myself out of bed, yeah
And put on my walkin’ shoes

I went up on the mountain
To see what I could see
And the whole world was fallin’
Right down in front of me

Pull myself together
Put on a new face
Climb down off the hilltop now, baby
Get on back in the race

Gregg Allman, Dreams

20160606_154153

 

by Shawn McKinney

2016 Dirty Kanza Part IX – Finish Line

Note:  this post is about my first-ever Dirty Kanza 200 experience on June 4, 2016. 

Read Part I – The Signup

Read Part II – Prep / Training

Read Part III – Friday

Read Part IV – Starting Line

Read Part V – Checkpoint One

Read Part VI – Hitting The Wall

Read Part VII – Checkpoint Two

Read Part VIII – Checkpoint Three

Part IX – Finish Line

new team member

Did I say something about being +1 at Checkpoint Three?  I lied.  We were actually +2 with the addition of Kristin.

We made the deal after she led us back into Madison.  It made perfect sense.  She was riding alone and could use some company.  Gregg and I were minus a working GPS.  I don’t know that it was said in so many words, but it meant no one left behind.

new moon

It was now total darkness, but we had Kristin to guide us.

“In approximately .2 miles you will turn left onto the unmaintained roadway,” she’d tell us with her soothing southern lilt.  Her voice far better than the British woman who speaks to me in my car.  Kristin if you ever need a new job I bet Garmin would hire you.

She was absolutely brilliant.  A positive light leading us to the finish line.

mishap

What’s the second thing your GPS (sometimes) does after telling you which way to turn?  It tells you to turn back around because it got confused – right?  We all know it happens.  Another reason Tim told me to not use the GPX tracks.  Next time…

On one such turnaround, I got sloppy and fell over.  Gravel aggravated old hip injury now inflamed with pain and swelling.

Don’t worry about it, get up and continue on, the voice inside my head told me.

inspiration

Now and then we’d stop and let Gregg catch up.  At the turns.  I didn’t count, maybe four or five times.  In truth we didn’t have to wait very long.  Long enough for a good drink or to rifle through the frame bag to replace a battery unit on the headlight.  But it was dark, the field had thinned and the roads twisted.

“You guys don’t have to wait on me!” he would say.  He didn’t want to be the one that prevented us from getting a finishers glass.  I’d been keeping an eye on the times and distance.

“We got this,” would be the reply.

humor

As the riders passed, they’d ask questions, wondering which way to turn, trying to figure out who knew what, following the competent ones.

“Do you guys know where you’re going?” one pair asked.

“We’re going to Emporia,” I told them in a cheerful voice.  “Where are you guys headed?”

The old man, holding a lantern and clanging a cowbell like crazy.  It’s zero dark thirty, riders trickling by and he’s still out there.

gut checks

As we propped each other up with words of encouragement.

Dig deep.  Good work.  Almost there.  We got this.

suspense

A few miles from Emporia I remembered the railroad tracks.  That every 17 minutes a train passes through.  That there is a barricade.  That under no circumstances does a rider cross one.

It was then I noticed what I thought was a blinky rider taillight were actually lights on a barricade.  The train was stopped and its last car was blocking the crossing.  Then slooowly it crept away and the guards lifted.  We’re moving again.

finish

The last couple of miles went quickly.  Weaving our way through campus and onto Commercial Street I knew we were in time.

And they waited for us, cowbells still a-clanging and cheering like it meant something, which of course it did.

When it came time to cross, I waved Kristin ahead.

“No, let’s cross together,” she said.

finish-line-shawn-kristin

Kristin and I at the finish line.

the celebration

IMG_0136

Wish there was still beer.

13322107_10208535114988952_5373638712455820277_n

I put my steed to rest.  Well done Willard. Well Done.

We were nearly the last across, but in this race, finishing is all that really matters.

Screen Shot 2016-06-19 at 3.22.26 PM

the end

 

 

by Shawn McKinney

2016 Dirty Kanza Part VIII – Checkpoint Three

Note:  this post is about my first-ever Dirty Kanza 200 experience on June 4, 2016. 

Read Part I – The Signup

Read Part II – Prep / Training

Read Part III – Friday

Read Part IV – Starting Line

Read Part V – Checkpoint One

Read Part VI – Hitting The Wall

Read Part VII – Checkpoint Two

Part VIII – Checkpoint Three

Read Part IX – Finish Line

eastbound

We were late pulling out of Eureka – almost 4pm and knew our odds of finishing before the 3am cutoff…

After a few miles a voice.

“Well hello there Arkansan!  And no, I’m not stalking you…  I read it on your jersey,” she offered politely.

This is Kristin.  Remember I mentioned something about my GPS being messed up earlier?  It wasn’t long after meeting her that I had to turn it off.  I’ll not dive into the details.  Why am I mentioning a broken GPS and Kristin in the same paragraph?

gps glitch

A few miles later I watched Kristin turn in the “wrong” direction but stifled the urge to call out because I knew my Garmin was in the process of fubaring.  When another rider made the same mistake I knew it was me and not them.  I took off after them.

Gregg was not far behind.  He has the same kind of GPS as me.  Guess who set it up?  I was mad and then remembered Rebecca’s (Rusch) words the day before.

“Things will go wrong.   Don’t worry about it.  Just deal with it.” (shit happens)

I’m paraphrasing but you get the point.  I have cue sheets in frame bag, bike computer (odometer), map, three compasses.  Three Compasses.

northbound

A man next to the road was holding a water hose and I stopped.  Over the next two minutes we talked and topped off the water tanks.  He provided intel about weather and the next water crossing.

I can’t recall his name but would like to thank him sometime.  Ran his own aid station.  Wants to do it again next year.

Over the next forty miles, I raced (chased?) whoever in front of me.  There were hills.  There were roads.  Some shouldn’t be called roads.

As expected, with the sun setting the temps became comfortable.  The winds turned into a nice summer breeze.

As the evening turned to night we rolled (back) into Madison.

Screen Shot 2016-06-18 at 9.38.19 PM

Rolled into Madison @ 10p

Thirty minutes under the cutoff.

IMG_2618

Madison (again)

Our team was +1.  Brian, another DK200 participant, had dropped out at 100 miles and was now in our pit.

Kelly was shoveling pizzas and cokes my way.  I was back.  Emporia is 44 miles away and time is running out.

Next Post – Part IX – Finish Line

by Shawn McKinney

2016 Dirty Kanza Part III – Friday

Note:  this post is about my first-ever Dirty Kanza 200 experience on June 4, 2016. 

Read Part I – The Signup

Read Part II – Prep / Training

Part III – Friday

Read Part IV – Starting Line

Read Part V – Checkpoint One

Read Part VI – Hitting The Wall

Read Part VII – Checkpoint Two

Read Part VIII – Checkpoint Three

Read Part IX – Finish Line

The day before the race was a blur.  So many loose ends.  Started with a phone call when I flared on Gregg.  I’ll gloss over the details (to spare the victims) but can assure you there were heroics on this day.

Somehow Kelly and I managed to make it to the riders meeting in Emporia by 5pm.

20160603_170128

What?  The 200 mile race is actually 206 miles?

which made us kind of thirsty…

20160603_180322

Mulready’s gave us a warm welcome after the 5p riders meeting

 

Had a nice dinner at Bruff’s and off for the last bit of preparations.  We’d heard it was the best steakhouse in town and my KC strip did not disappoint.  Something said during dinner, hung in the air for me.  Once upon a time, one of us ordered steak the night before a big race and suffered GI distress because of it.

“That won’t happen to me,”  I confidently stated.

Somewhere while dotting all those i’s and crossing them t’s I forgot about getting a good nights sleep.  It was well past midnight before I laid and two hours past that before the sleep.

Disappointed.  I had a 25 miler plotted that would have taken the edge off.  It went out and back along the DK routes.  A hard lesson learned.  Arrive two days early.  Do the prep on Thursday.  Leave Friday for some R&R.

Next Post: Part IV – Starting Line

 

 

by Shawn McKinney

2016 Dirty Kanza Part VII – Checkpoint Two

Note:  this post is about my first-ever Dirty Kanza 200 experience on June 4, 2016. 

Read Part I – The Signup

Read Part II – Prep / Training

Read Part III – Friday

Read Part IV – Starting Line

Read Part V – Checkpoint One

Read Part VI – Hitting The Wall

Part VII – Checkpoint Two

Read Part VIII – Checkpoint Three

Read Part IX – Finish Line

west then southbound

I did not feel well and had eaten very little since Checkpoint One.  I was getting dehydrated, had an intermittent cramp in the left quadricep and had just Hit The Wall.

Droad-1758-(ZF-7239-61149-1-001)

D Rd. mile 75, Linda Guerrete Photography

By now Gregg and I were (mostly) riding within eyesight of one another.  He would catch me on the downhill sections and I would pull away on the climbs or when facing the wind.

2nd leg was the toughest…

  1. The winds 20 mph+
  2. The hills
  3. The heat

Gregg didn’t have to tell me that he was hurting and every time he asked how I was doing would always be the same reply.  Talking (or even thinking) about it made it worse.  Once he shared a partial bottle of water.  It wasn’t enough, but the gesture was.

I would have been much better with some fresh water.  The EFS mixture was holding out in my frame bag but I had to force myself to drink from it and it didn’t quench my thirst.  My mind thought I was dying – of thirst.  My body was struggling too with fatigue, GI and heat distress.

At midday the sun was brutal and riders began clustering around what shade there was alongside the roads (not much).  I knew stopping now would be a mistake so kept crawling along.

It was also during this section I got off my bike and walked a few hills.  I did not count, but guess three or four.  Some riders dismounted on every hill and pushed their bikes over.  Many were limping.

Sometimes I would issue a lament, intended in jest, to break tension during the climbs.

I thought Kansas was supposed to be flaaat.

endure

And the miles slooowly ticked away.  I forced myself not to look at speed and distance and focus instead on controllable things like heart rate, respiration and conservation of the remaining matches.

I recall walking up one particularly (especially) steep hill and noticing the heart rate was still hovering around 147.

Are you kidding me?  If I have to work this hard I might as well be pedaling and vowed not to walk up another, and didn’t.

The cramping was kept under control.  Occasionally the left quad would squawk and I would ease off.

I was still having fun.  The hills were technical and required unwavering concentration and skill to navigate.  Let your mind drift at the wrong moment and things go from bad to worse in an instant.  These are the moments I live for.

It was around mile 97 that my thirst became unbearable.  It was still 6 or 7 miles from Checkpoint Two.  Normally not very far but under these circumstances perhaps too far.

I still had a little EFS left in the tank but again it wasn’t easing my thirst.  I began to consider the damage being done to my body and calculated if it was worthwhile to continue.

Suddenly two jeeps appeared in the distance, kicking up dust, and sped my way.  After rapidly closing distance, they pulled alongside the road and several passengers immediately burst into view waving bottles of water in the air.

It was a sight of indescribable beauty.  I pulled over, held out a hand and a bottle magically appeared in its palm.  I poured it down in about three seconds and put out my other hand in hopes of another.  That one straight to the jersey pocket.  Held it out again, poured over my head1.   Ahhhh!  Held it out again, also downed in a few seconds.

In a few moments everything changed.  I went from the brink of collapse to a new resolve.  Was I considering a DNF?  Not only no but HELL NO!!!

And I’d unlocked the Roadrunner’s cryptic message, before things got so damn crazy.  He told me to use them jeeps.  Ostensibly because they have fresh water. 🙂

eureka

Gregg caught up and we rode the last few miles into town together, lightheartedly bantering with the locals, smiling and exchanging high fives with the children, basking in the glory of the moment.

turning point

Didn’t realize it at the time but things were starting to go our way.

Our support team was now +1.  Kelly, who’d stepped off the course at Checkpoint One (more on that later) was now working in our pit full time.  This added a pair of hands for the bikes, to load bottles, and another brain to help troubleshoot problems.

Our support team knew we were both in trouble.  Gregg was sitting in a semi catatonic state and I refused to eat.  They poured water on Gregg and began putting things in my face to eat.  I would wave them off.

No sandwich, no payday, no rice cakes.  Pickle? I think I’ll try a bite of that.  Yuck .  Water melon?  OK let me try that (not too bad).  Jerky no.  Gu no, chips, cookies, oranges, no. You have a homemade barcake thingie made just for us and this race?  Normally I’d be all over it but right now… NO.

What’s that a cracker with a little tuna on it.  Let me try that.  Well that isn’t horrible, ok, I’ll try another, and another…

(null)

Here I am at Checkpoint Two, Eureka KS

Kelly is a marathon runner and he’s dealt with his share of cases of exhaustion.  He pointed out that my voice had that raspy sound runners get just before quitting.

What me quit?  HELL NO!!  It was here that I formulated a battle cry that would be carried over the next 100 miles.

not quitting unless

  1. Kicked off the course (missed a cutoff)
  2. Left leg fully cramps
  3. GI distress becomes acute (no description needed)

We managed to get in and out of the Checkpoint Two in about 20 minutes which was a bit better than the first checkpoint.  But time was not on our side.

Screen Shot 2016-06-15 at 4.09.49 PM

Leaving town somewhere before 4pm meant there’s a hell of lot of real estate left to cover and we still haven’t turned north yet, back into the wind.

My hope was with the sun dropping, so too would the temps and the winds.  The weather patterns seemed to support that hypothesis.

We shall see…

Next Post: Part VIII – Checkpoint Three

Footnotes

1. (Should be obvious)
The merit of pouring a bottle of water on top of oneself (i.e. to cool off) is proportionate to the proximity of fresh water.  If it’s a long way, save it for drinking.

by Shawn McKinney

2016 Dirty Kanza Part V – Checkpoint One

Note:  this post is about my first-ever Dirty Kanza 200 experience on June 4, 2016. 

Read Part I – The Signup

Read Part II – Prep / Training

Read Part III – Friday

Read Part IV – Starting Line

Part V – Checkpoint One

Read Part VI – Hitting The Wall

Read Part VII – Checkpoint Two

Read Part VIII – Checkpoint Three

Read Part IX – Finish Line

warning

When I first turned south, past the early mud flows, through a peaceful field, a kooky roadrunner came out and issued a warning.

“Jeep.  Jeeep!  Jeeeeeep!!!”  Looking right at me.  I hoped that it was meant for another, but nope, just me.

I watched him watch me as I continued on my path southward, he stayed put, in the middle of the road, waiting, silent, expectant.

What was the message my strange sentinel of the Flint Hills carried I wondered.  Was he telling me that I should go rent a jeep before continuing on?  Ride like a jeep maybe (hopefully)?  Beware the jeep?  Or, that it would be a jeep that would have to rescue me later?

crazy

And that’s when things got a little crazy.  There were hills, water crossings, cattle guards and the roughest of roads.  It was rocky, muddy, technical and fast.  My machine performed capably and I had a blast.  Never out of control, kept speeds lower than 30 on the downhills, lower than 20 over the ruts, washboards and unpredictable surfaces that were commonly encountered.

DSC_1838-(ZF-9614-10542-1-001)

C. Heller Photography

What I signed up for.  Forget the worldly cares and focus on the NOW.  Past the obstacle in front, and the next.  Take them one at a time.  Amazingly, awesome therapy.  🙂

Dirty Kanza16_3865-(ZF-10162-92722-1-002)

River crossing, MSPhotos

The other side (a few moments later)

13412169_10208118693477817_3066497783666581284_o

handheld gopro shot

The field was crowded (shared with half pinters).  There often were two lines.  The temps were comfortable, winds favorable and everything seemed to be fine.

Dirty Kanza16_0877-(ZF-7072-54430-1-001)

Camp Creek Rd., mile 25, MSPhotos

_MG_0217-(ZF-0684-60143-1-001)

Camp Creek Rd., mile 30, TBL Photography

matches

I was feeling pretty good until looking down and being surprised at my heart rate.  It was running a full ten points over the expected.

It’s called burning matches.  Burn them too soon and you run out before the finish.  Once you’re out, it’s over.  This is still early, why all the matches?

My cousin Gregg later characterized the first leg as doing squats for four hours straight.  That’s probably not far from the mark.  Speaking of Gregg, it was just before we hit Checkpoint One that he speeds past me.  I hadn’t seen him since around five or six miles in but there he goes now.

I remember wondering what that meant.  Was it because I was getting slow, he fast, or a combination of both?

madison

No worries, push it to the back of the mind and press on.  Rode into Checkpoint One feeling kind of OK but not really.  Sort of sputtering.  A piston was misfiring.

20160604_100656

Checkpoint One, Madison, KS.

Gregg had beat me by a few minutes.  Somewhere in the back of my mind I knew there was trouble.  Nonetheless I stocked up on the ample provisions that were waiting for us.

Special care had to be taken of the equipment.  The water crossings on the first leg had dried out the drive trains and they were squeaking mightily.

My appetite was waning.  Higher temps were kicking in and a normally hearty food consumption rate was dropping off.

mistake

It was then a fateful decision was made about hydration opting to refill both bottles and the 1.8L bladder with the EFS mixture.  I thought going all-in with the EFS would get me back some of the calories being lost from lack of appetite.

I should have carried a couple more pints of pure water.  There was plenty of room inside the jersey.

These mistakes were caused by a fuzzy-head, from the lack of sleep the night before.

And another problem… time.  As in it’s being wasted.   It had taken almost four hours to reach Checkpoint One.  Some of that can be blamed on derailleurgate, but really?  Four hours to go the first fifty?  Not good.

Screen Shot 2016-06-14 at 9.08.16 PM

Not exactly burning up the race course.

Adding insult to injury, it took (what seemed like) ten minutes to find the support vehicle.  Bottom line, it was thirty minutes before returning back to the course bound for Checkpoint Two.

Waaay too long and yet another worry that had to be pushed to the back of the mind.

Next Post: Part VI – Hitting The Wall