Re: [ekmi] Re: Story Boards

[Tomas Gustavsson <tomas@primekey.se>]

Hi,

Looking at other proposals such as PSKDD or the new KMIP there is
another strength of more targeted systems like EKMI. This is the ease of
implementation and deployment. Looking at KMIP my first though as an
implementer was that - "what a nightmare to implement".
This is a reason I think solutions aiming to solve a more narrow window
of use cases should be more successful. It's easier to implement and it
will by much easier to deploy. Part of this is because when you want to
cross-match different use cases you have to pollute to protocol with
things that are specific to one use case (for example OTPs) but are not
at all applicable to other use cases (such as database encryption).
(I discussed this a bit with my colleague Anders as well so some of the
wordings are his).

Oh and what does this have to do with the Story board?
Perhaps an idea is to emphasize ease of deployment?

Regards,
Tomas

Arshad Noor wrote:
> I thought I'd start part of this discussion by providing my view
> on the story-boards; if we can do some part of the discussion over
> e-mail and reach a consensus, we can minimize the amount of time
> we spend on the phone on this topic.
> 
> While the storyboard has re-crafted some of the early EKMI slides
> we have in the OASIS repository, and I have no doubt that the flash
> motion/color/effects will make the finished product look better,
> I have some concerns that the storyboard is missing some critical
> elements we've learned over the last 2 years:
> 
> 1) I did not see anything in the storyboard that identifies
>    the business problem we're solving (Compliance to PCI-DSS, HIPAA,
>    FISMA, EU Directive, PIPEDA & Breach Disclosure laws for data-
>    protection);
> 
> 2) I did not see a discussion of the problems with data-protection
>    in a networked environment (over-emphasis on firewalls, IDS, AV,
>    and other network/host-based protection mechanisms) and the
>    gaping holes in applications that leaves data completely exposed);
> 
> 3) I did not see any mention of the "end-to-end security" concept
>    that SKSML enables for applications, and the futility of
>    encrypting data in any layer of the stack other than the
>    application layer.  After all, the largest breach in the history
>    of computing - TJX (now, perhaps Heartland) - did not involve
>    the theft of any hardware;
> 
> Are there other thoughts on this, and things I've missed?  Thanks.
> 
> Arshad
> 
> Arshad Noor wrote:
>> All,
>>
>> We've just received a first DRAFT of the storyboard from
>> the design-firm that was contracted to create the EKMI
>> flash-demo.  I've uploaded it to:
>>
>> http://www.oasis-open.org/committees/document.php?document_id=31134&wg_abbrev=ekmi
>>
>>
>> Please review this.  Lets discuss this internally on the
>> mailing list and come to a consensus on opinions.  I will
>> invite JD/Derol to join us for 15-20 minutes on the TC
>> conference-call on Feb 17th so they can get some feedback
>> from the TC and discuss any details that morning.
>>
>> JD/Derol, the call is usually scheduled between 8:00am and
>> 9:00am PST.  I'll forward you the call-in details later this
>> week.
>>
>> Thanks.
>>
>> Arshad Noor
>> StrongAuth, Inc.
>>
>> Derol Frye wrote:
>>> Arhad,
>>> Attached, is a power point doc with a brief storyboard of the demo.
>>> It's very rudimentary in nature, but hits the key points of what I'm
>>> hoping you're looking for.
>>> I'm sure it goes without saying that when we get to creating the
>>> actual piece, many of the bulleted lists will be strongly illustrated
>>> and animated. I'm thinking the final will probably come in at around
>>> 3 minutes, depending on the complexity of some of the animations...
>>> as the animations in the storyboard are very quick with no stalling.
>>> Please let me know after your preliminary review if there's some
>>> major points I'm missing, so we can include those into the
>>> storyboards before you pass them off to committee.
>>>
>>> Thanks,
>>> Derol Frye
>>> Art Director
>>> 57design, Inc.
>>
>> ---------------------------------------------------------------------
>> To unsubscribe from this mail list, you must leave the OASIS TC that
>> generates this mail.  Follow this link to all your TCs in OASIS at:
>> https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php
> 
> ---------------------------------------------------------------------
> To unsubscribe from this mail list, you must leave the OASIS TC that
> generates this mail.  Follow this link to all your TCs in OASIS at:
> https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php