Security, Part 3

Another thing I've been thinking about when using external sites for things like wikis, blogs, and other collaborative tools is that, although you may be able to control access rights on a user level, it probably doesn't work as well as you think. Here are some examples:

* you grant access to anyone who has the same corporate domain email ID that you do ("@xyzcompany.com"). Whenever someone tries to access your information, the system validates that their account has that domain. However, it doesn't check to see if that domain is currently valid, just that it was originally. In other words, if someone creates an account on this system, using a corporate email account, it's only validated then. Never again.

* you grant access to someone whose account ID looks like the person you mean ("Joe Abercrombie" = "jabercrombie"). It turns out to be someone else.

* you've granted access to your co-workers. A new person joins the team, but you only remember to add her to 5 out of your 6 on-line tools.

* if you use a corporate directory/ ldap system internally at your company, you are probably used to being able to grant access to groups like "Sales," "U.S.-only," and "Managers." No such luck on external systems.