Tales from the crypt

Thanks to Michael Specht, author of My Blog of HR and Technology Stuff, for pointing me to another identity horror story which is right up there with the ChoicePoint Saga and other tales from the identity crypt.

You can read the about the whole affair in a really clear whitepaper from Think Computer.

Yes, my hearties, prepare to shiver and twist as you learn how…

PayMaxx has unwittingly created a perfect example of how a security breach is possible over a connection that is technically secure.

And that:

Upon discovering the vulnerabilities in PayMaxx’s system and their extent on February 7, 2005, Think immediately notified PayMaxx that the problems were of a serious nature, and recommended that the company hire a security consultant to remedy them if it was unable to fix them on its own. After more than two weeks, PayMaxx issued no formal response and took no action, leaving the security holes wide open.

More ghoulish details:

Any employee, whether terminated, presently working, on leave, or even affiliated with a company that was no longer a PayMaxx customer, could therefore look up the supposedly confidential W-2 of any other onetime PayMaxx customer.

And again:

By simply changing one number in a hyperlink on PayMaxx’s “secure” web site, it was possible to scan through PayMaxx’s entire W-2 database for the year 2004. PayMaxx stored each employee’s data record sequentially in a table—a perfectly normal and acceptable practice, and one that Think uses frequently in its own software, but also one which made it possible to always guess the ID of the next record by simply adding 1.

But meanwhile…

Statements remained on its corporate site such as, “At PayMaxx, we are committed to maintaining your privacy and data security.” Interestingly enough, as recently as February 18, 2005, Attorneys General in thirty-eight states signed an open letter to ChoicePoint, Inc. protesting that company’s inaction after it was notified of a remarkably similar problem.

It shocks that PayMaxx apparently didn't react “full speed ahead” to rectify the situation it had created.

But then there are also deep technical implications to consider. Have you heard my audio interview with Carl Ellison? This is the perfect example of what he means when he says that security can't be done in layers, but needs a “diagonal” across all the layers to provide a holistic solution.

Markets and engineering

A while ago Eric Norlin of Ping provoked a lot of discussion with a piece called “Why the hateration towards marketers?” I found the ensuing commotion fascinating because the story painted the “Searlists” (that's pronounced like ‘surrealists’ but without the ‘real’ part…) as being gnawed at by growling engineers, themselves reacting as mindless victims of shameful abuse by pre-Searlist “marketing bullies’.

In the ensuing aha! I could see that the key to getting past this lies at least partly in explaining the “markets are conversations” message to engineers.

As engineers, if we are any good, we have already come to have a deep engagement with the people who use our software. And to the extent we have had a problem with marketing people, I think it was often because we didn't perceive them as having done the same. Many times it was our customers who told us this.

But Searlist marketing is an advanced form of this same engagement. So really it's marketing that can make sense to engineers. By the way, I don't mean to paint engineers as saints, or deny, in all fairness to marketers, that there are a great many weird dynamics that can skew our vision!!!

In a recent posting Eric says of Microsoft's Robert Scoble:

Scoble asks a question (re: RSS, “markets are relationships”, etc):

“Here's my thesis: companies that have lots of bloggers will end up making better products, will end up having better marketing and PR, will end up making more profit at the end of the day, and will be more likely to have more than one “hit product” and will be more likely to last 100s of years.

“Do you agree? Why or why not?”

Eric answers this way:

Yes, i do agree — though not because blogging is some revolutionary method of interaction, or because the world wide web lives by axioms of open-ness, or anything else like that. I agree because “markets are relationships” as a principle has held true since the bazaar, and still holds true (yes, i'm admitting to a belief in a fundamental – oh god, i'll say it – “human nature” )……RSS is an *evolutionary* step in that conversational relationship.

BTW- under scoble's lexicon, RSS sounds like it falls squarely in the realm of the product marketer/manager — someone that tries to facilitate a feedback loop around the voice of the customer back into product development. THAT is what A)ensures better products B) results in better marketing and pr C)results in more profitability and D) gives a company a *chance* to last 100s of years….

…and i think that holds true for ALL companies all of the time – and analyst relations, core messaging, positioning, product marketing, rss, a sense of humor, etc – they ALL play into that.

….so, yes, i'm agreeing w/ Scoble – i'm just hinting that its time that we place blogging in a larger context (in terms of the “marketing” discussion)…..

Well that's all pretty cool. But I think blogging changes more than this. It lets a product architect like me have a more direct relationship with the people for whom I am building products – with no interpreters in the middle. It lets me add a new conversation – one focussed around the scientific aspects of what we are doing. And allows (once we get things moving at the right clip) for deep discussions with people from other teams who are building complementary or potentially competing technologies. And with people like Craig Burton and Jamie Lewis who can help us all situate and theorize what we are doing.

So just as blogging transforms who is involved in journalism, might it not also transform who is involved in marketing? Not by marginalizing people like Eric who really understand it, but by allowing more of us to participate, such that the relationship between customers and product development becomes more unmediated?

I'll pause here for a moment, because I can hear people saying that we really need a division of labor. “If engineers spend their time talking with customers, they won't be able to get any work done.” And I don't deny that there is truth to this.

But I'm suddenly transported back maybe fifteen years, to a customer called Burks Smith from Sprint. I actually see him periodically and to this day he remains one of my favorite people. He had bought an email router I had designed, and was a wonderful customer who appreciated all its great features. But one day, it basically “blew up”, having unexpectedly encountered a particularly defective inbound message.

We worked through the technical support. As tens of thousands of messages queued up hour after hour, Burks never lost his focus or demeanor. But when things were back to normal, and we were doing the post mortem, he told me, “You know, that wasn't a software error – it was a train wreck.” That sunk pretty far into my head – and I have never done an “optimistic” design since.

The point here is that the conversation must touch all of us who work to create product. Not just marketing.

Eric concludes:

ps: heard through the grapevine that Wag-Ed – or at least some folks inside Wag-Ed – (msft's pr firm) finds microsoft blogs to be very hard to deal with…

I guess my blog could be one of the harder ones to deal with, because (except for pieces like this one) I try to go beyond opinion and concentrate on exploring new boundaries and approaches in computer science. Furthermore, it's well know that I'm a product architect for – what else – identity and access products, and that I'm not likely to leave my notions about what works and doesn't work at the door when I walk into my office. How do you fit that into a traditional marketing agenda?

I don't think you can. I think the agenda grows. And I think that will happen all over our industry – fast.