management: 2009

Tuesday, September 15, 2009

Reclaiming your account: Password Reset/Forgot Password

This is probably one of the oldest functionality that is part of any password based system and by now I was hoping that people will have figured out most of the ways of doing it. But while reading answers on stackoverflow on this topic, I was impressed by new ways being developed and implemented by developers in wild. While reading the discussion I felt that there is lack of a structure to look and study this functionality and this post is an attempt to define a structure.
Before I go there, I wanted to capture my understanding of the password reset functionality.

Why - Well if we are not noting down all the accounts we have created in life (either electronically or manually), it is possible that we are going to forget passwords for some accounts as we age. Even if you follow some techniques like having standard passwords across all your accounts, due to site limitations, change in word preferences, etc, you may not remember the applicable password for a site and so the lifesaver

Why Not create a new account -

a lot may be associated with that account in-terms of your reputation, information, etc
site limitations of being able to associate a personal identifiers (may be email address or bank account number) with only one account
the account id may be generated and can not be changed during your association with the site (SSN, biometric?).

What - Password reset/forgot password is a functionality (a bit different from change password - where you remember/know your password) by which user or someone else on behalf of user is able to change the password without presenting their existing password. Again even though the discussion would focus on password, it would probably apply to any shared secret between user and identity provider

How - As discussed earlier, the password reset can be done by user or somebody on their behalf. This process typically involves

Verifying the requester's identity
Ensuring that requester is authorized to request password reset (incase requester is same as owner of account, this check may be moot)
choose a new password (either generated or accepted from requester subject to fulfillment of password policy)
provision the password into the authentication system
notification that new password can be used, if out of band password change happens (and possible security notification to account owner that password has been changed)

This post explores the first part of the process i.e. verifying requester's identity

Classification Approach

Based on the basics of authentication process, we know that we can verify user based on something they know, have or are. Now in order for the authentication to work we need to ensure same information is available to user and Identity Provider at the time of verification. This implies that prior to verification there has to be an acquisition process which can be classified based on when (at registration, during usage of account or out-of-idp/user account relationship) and from whom (user, Identity/service provider, third-party like credit rating agency, public data) the acquisition has been made.
The verification process itself can be classified based on the type of shared secret/credential along with other criteria like verification channel.

Example

Based on this we can try to classify an approach for user verification which has been done for some of the most commonly used approaches. Please note that this is not an exhaustive list of various approaches in wild and just tries to show how the classification can work for some of the approaches being used in wild

Verification Approach	Acquisition						Verification
	When			From Whom			Type			Channel
	Registration	Account Usage	Out-of-band	User	Service Provider	Third Party	Know	Have	Are	Single	Multi
What is your pet's name	Y			Y			Y			Y
When was your last withdrawal from account XXX?		Y			Y		Y			Y
Did you live at ZZZ on DD/MM/YYY?			Y			Y	Y			Y
Please provide your date of opening the credit card account			Y		Y		Y			Y
Send a nounce+ to Email Address *	Y			Y				Y		Y
Send a nounce to Cellphone *	Y			Y				Y			Y
One time Password cards for specific duration			Y		Y	Y ^		Y		Y

* The classification may change depending upon the implementation but you get the idea.
^ If IdP is different from Service Provider
+ I do not want to use "temporary password" as it can be confusing

At present not all the permutation/combinations may be utilized but we may find other ways to combine these factors to create new methods. In addition to that, I have a feeling, we would figure out lot more ways of classification of the password reset process.

Why

Even though this was just a thought exercise, I think we may be able to use it to study and compare various verification techniques. Given that people are already treating some combination of authentication/verification techniques as multi-factor (even though theoretically they may be single factor), it may make sense to develop more detailed classification technique so that we can compare various "multi-factor" techniques and ensure that we are not using pseudo-"multi-factor" techniques. Based on my limited knowledge, I have not run into any such framework but would really appreciate pointer in such direction.

Thoughts?

Reclaiming your account: Password Reset/Forgot Password

Why Not create a new account -

a lot may be associated with that account in-terms of your reputation, information, etc
site limitations of being able to associate a personal identifiers (may be email address or bank account number) with only one account
the account id may be generated and can not be changed during your association with the site (SSN, biometric?).

How - As discussed earlier, the password reset can be done by user or somebody on their behalf. This process typically involves

Verifying the requester's identity
Ensuring that requester is authorized to request password reset (incase requester is same as owner of account, this check may be moot)
choose a new password (either generated or accepted from requester subject to fulfillment of password policy)
provision the password into the authentication system
notification that new password can be used, if out of band password change happens (and possible security notification to account owner that password has been changed)

This post explores the first part of the process i.e. verifying requester's identity

Classification Approach

Example

Verification Approach	Acquisition						Verification
	When			From Whom			Type			Channel
	Registration	Account Usage	Out-of-band	User	Service Provider	Third Party	Know	Have	Are	Single	Multi
What is your pet's name	Y			Y			Y			Y
When was your last withdrawal from account XXX?		Y			Y		Y			Y
Did you live at ZZZ on DD/MM/YYY?			Y			Y	Y			Y
Please provide your date of opening the credit card account			Y		Y		Y			Y
Send a nounce+ to Email Address *	Y			Y				Y		Y
Send a nounce to Cellphone *	Y			Y				Y			Y
One time Password cards for specific duration			Y		Y	Y ^		Y		Y

Why

Wednesday, January 14, 2009

Functions of Management

Author: Shyam Bhatawdekar (eminent management guru, successful business leader, highly sought after management consultant and well-known author)

For everything you wanted to know on building leadership and management, refer Shyam Bhatawdekar’s website: http://shyam.bhatawdekar.com

(Refer our High Quality Management Encyclopedia “Management Universe” at: http://management-universe.blogspot.com/)

Management

It includes:

Management of business and profit making private and government run organizations.
Management of non-profit making organizations.
Management of trusts, societies, associations, charitable organizations.
Management of governmental organizations.
Management of NGOs.
Management of educational organizations e.g. universities, colleges, schools.
Management of day care units.
Management of hospitals and other health care organizations.
Management of sports related organizations and clubs.
Management of religious organizations.

Management for any organization is a function of organizing and channeling the people together to accomplish desired goals.

In common understanding, management is also referred to the body or group of persons who perform the various functions of management.

Mary Parker Follett was the first to define management as the art of getting things done through people.

Hierarchical Levels of Management

Top management (including the members of the board of directors of the company- responsible for strategic management).
Senior management (or upper management; normally, the heads of various departments- responsible for operations management).
Middle management (responsible for operational management).
Junior or lower management (they include supervisors, team leaders or, foreman etc- responsible for transaction control)

Functions of Management or Management Functions

Management consists of the functions given below. It is based on Henri Fayol's thinking on the functions of management.

Planning: generating plans of action for immediate, short term, medium term and long term periods.
Organizing: organizing the resources, particularly human resources, in the best possible manner.
Staffing: positioning right people right jobs at right time.
Directing (includes leading, motivating, communicating and coordinating): Communicate and coordinate with people to lead and enthuse them to work effectively together to achieve the plans of the organization.
Controlling (includes review and monitoring): evaluating the progress against the plans and making corrections either in plans or in execution.

Each of these functions is explained in some detail below.

1. Planning

Planning is decision making process.
It is making decisions on future course of actions.
Planning involves taking decisions on vision, mission, values, objectives, strategies and policies of an organization.
Planning is done for immediate, short term, medium term and long term periods.
It is a guideline for execution/implementation.
It is a measure to check the effectiveness and efficiency of an organization.

2. Organizing

Organizing involves determination and grouping of the activities.
Designing organization structures and departmentation based on this grouping.
Defining the roles and responsibilities of the departments and of the job positions within these departments.
Defining relationships between departments and job positions.
Defining authorities for departments and job positions.

3. Staffing

It includes manpower or human resource planning.
Staffing involves recruitment, selection, induction and positioning the people in the organization.
Decisions on remuneration packages are part of staffing.
Training, retraining, development, mentoring and counseling are important aspects of staffing.
It also includes performance appraisals and designing and administering the motivational packages.

4. Directing

It is one of the most important functions of management to translate company's plans into execution.
It includes providing leadership to people so that they work willingly and enthusiastically.
Directing people involves motivating them all the time to enthuse them to give their best.
Communicating companies plans throughout the organization is an important directing activity.
It also means coordinating various people and their activities.
Directing aims at achieving the best not just out of an individual but achieving the best through the groups or teams of people through team building efforts.

5. Controlling

It includes verifying the actual execution against the plans to ensure that execution is being done in accordance with the plans.
It measures actual performance against the plans.
It sets standards or norms of performance.
It measures the effective and efficiency of execution against these standards and the plans.
It periodically reviews, evaluates and monitors the performance.
If the gaps are found between execution levels and the plans, controlling function involves suitable corrective actions to expedite the execution to match up with the plans or in certain circumstances deciding to make modifications in the plans.

Our Books Publications (Books authored by Shyam Bhatawdekar and Dr Kalpana Bhatawdekar)

Own your copy/copies of the following bestseller books authored by eminent management gurus and consultants Shyam Bhatawdekar and Dr Kalpana Bhatawdekar:

1.HSoftware (Human Software) (The Only Key to Higher Effectiveness) or HSoftware Shyam Bhatawdekar’s Effectiveness Model)
2. Classic Management Games, Exercises, Energizers and
Icebreakers
3. Sensitive Stories of Corporate World (Management Case Studies)
4. Funny (and Not So Funny) Short Stories
5. Stress? No Way!! (Handbook on Stress Management)

You may like to go to the above-mentioned titles (web links) and order your copies on Amazon.com on Internet. The books are available in printed form and also as eBooks.
Or
Persons residing in India may like to write to our email address prodcons@prodcons.comand order your copies.

For More Guidance, Assistance, Training and Consultation

Contact: prodcons@prodcons.com

Training in all the soft skills and various management functions/techniques is imparted by Prodcons Group’s Mr Shyam Bhatawdekar and/or Dr (Mrs) Kalpana Bhatawdekar, eminent management educationists,

management consultants and trainers- par excellence, with distinction of having trained over 150,000 people from around 250 organizations.