To get the problem statement right

When searching for information on security, ran across a document about the "Shrinking Perimeter" . The article contained the statement"

To get a good result the engineer, the financial planner, and the corporate visionary all have the same core focus: To get the problem statement right. The wrong problem statement gets us "solutions in search of a problem" or "we solved the wrong problem" or "these sunk investments did not yield value." In every case, it is getting the problem statement right that makes the difference.

This certainly could be and should be expanded to consultants (and most anyone else). Many times the consultant is brought in to do a project that was determined by someone else. The consultant is essentially being asked to validate problem statement created by someone else. Way too often I see consultant happily take the clients money knowing all along that the problem statement is treating a symptom of or masking the real problem.

The consultant is usually brought in as a subject matter expert and the easy thing to do is to go along with what the client said they wanted and not speak up. Is it not the consultant's purpose and obligation to speak up?

To do the hard thing and talk to the client about the "real" problem?
-jim

Automated Walk Away Detection

Does the title make sense to you?
The concept would be to detect when you are not at your computer and lock your computer.

Occupancy sensors that detect people presence within a room are difficult and not always reliable. Sure there are the Ultra-sonic and infrared and those that are hybrids of both. However, it turns out, detecting a motionless person who is reading or relaxing in a hot bath is not reliable with today's generally available technologies.

Presence Identification of people, as in identifying who is in which room, is much more difficult.

RFID (Radio Frequency IDentification) does work, for most scenarios (problem with the hot bath), in theory, but does require people to posses RFID tag or badge. Now being in the Secure Identity and access control business we learned a long time ago that if you set up a policy, you better have a policy for exceptions to the policy. When the CEO forgets his RFID badge, the security person will have a hard time stopping him from entering the premises.

Now we want to identify who is sitting in front of a computer.

Possible solutions?

• RFID Tag or Badge
  
• Pressure sensitive mat
• Monitor Mounted Sonar

I am sure you can find some issues with each of the above and if we can do that while reading an article. Now, think about how many ways a person that used one of them every day would be irritated or find ways to defeat them.

Viion Systems Inc. says they have a better way. They call it; "Sentinel Sign-Off". An interesting methodology that utilizes their special software and a WEB-CAM to detect the person who is at the computer and to lock it when the person is no longer present. You can read the details at their product page. The white-paper, referenced at the bottom of the page, has even more details.

Basically, the product integrates with the Windows GINA and therefore, AFAIK, is limited to the Windows platform. I assume that their software must do some proprietary algorithm to come up with a value for a persons face or other characteristics. The output of the algorithm must be stored locally or perhaps with the Windows domain credentials. Certainly an interesting concept that some people should consider.

Anyone using the product that can provide feedback?