3 ms·
It's standards based just like any other SSO these days: OpenID Connect and SAML. Is there something specific you want to know?
by atlgator 5y ago
It's standards based just like any other SSO these days: OpenID Connect and SAML. Is there something specific you want to know?
- Jerrrry 5y agoThis is correct. The "FedRamp" contract overhaul pretty much locks in the requirements and specifications to these above implementations. I have designed an API that revolves around and side-steps this that currently serves 60 million US civilians...but in the end, the security assessment pretty much comes down to the Privacy Acts interpretations and the common sense security landscape.
- awb 5y agoHow is it different from working with a private company? Lots of stakeholders? More documented testing procedures?
- Spooky23 5y agoSomeone said it best upthread: the incentives are different. If you are a leader in the bureaucracy, your incentive is to not personally fail, which is not the same as to succeed. There is an army of auditors waiting to question every decision, so the obvious way to avoid that is to not make any. Balancing the need to do something without deciding anything is an art of sorts.
- wslack 5y agoAlso, to be clear, those incentives aren't coming from within the bureaucracy. For example, let's say that a program tries to do something and it totally doesn't work. A news story about this will be roughly the same if $10,000 is spent as if $100,000 is spent as if $1,000,000 is spent. That creates an incentive never to label anything a failure and just keep pumping good money after bad - that's how to avoid the negative article.