1. Work Plan for 2008 – Mid Year Client Update
BurrellesLuce
MediaContent Portal
Work Plan for 2008 – Mid Year Client Update
Doug Smith

2. MediaContent 2008 - YTD Releases Completed this year: 2.5.3: 2/29/2008
2.6: 3/15/2008
2.6.1: 5/9/2008
2.6.2/Icebreaker: 7/10/2008

3. MediaContent 2.7
First Post-Icebreaker package will be first of three point releases
Start migration to master/user account management structure
Deliver on-line password change
Automate lost password handling
Obsolete file1 and file2
Does my SQL do record locking.

4. MediaContent 2.7.1
Removes Windows server, all nodes running LAMP migrate Auth database to MySql
Stops multiple simultaneous logins
Records latest login time for usage reporting
Admin tool can clear account if a user is locked out
Complete Admin tool move and delete
1. As discussed in the Blue Sky meeting we will reduce portal costs by eliminating SQL Server and the Windows platform, all MC nodes will be standard LAMP.
2. The first step is upgrading user account management is to record when a user ID is active in the database and disallow additional logins. The MC code is not written for multi user purposes.
3. When the users logs out or the cookie has expired ( 24h ) the ID can be used again.
4. In the event of a lockout the Admin Tool will be able to release the ID and clear the login.
5. The Admin tool move and delete, partly completed last Summer, will be completed. This will obsolete file1 and file2 and remove it from the account provisioning process.

5. MediaContent 2.7.2 Continue Admin Tool build out
Identify one user per site as Master account with address
All users store for password management separate from alerts
Admin Tool does not display password in the clear.

6. MediaContent 2.7.2
Continue Self Service Portal build out the iMonitor program
Preference page allows user to change their own password
Event is logged for auditing purposes
No password stored in the clear, use MD5
Need to agree on reuse rules and length
Realtime strength measure for cool points, see
Use enters the new password twice to confirm and it is not displayed in the clear. Submit button posts the changes. UI is unresponsive while database update is in progress, returns to preferences page. New password is effective with next login. Users still choose their own password.
Considerations:
Minimum and maximum length restrictions ?
Required password strength level ?
Frequency of Rotation ?
Real time strength as you type the password: See script at
Common guidelines for choosing good passwords are:[13][14][15][16] from Wikipedia
Include numbers, symbols, upper and lowercase letters in passwords
Password length should be around 12 to 14 characters
Avoid passwords based on repetition, dictionary words, letter or number sequences, usernames, or biographical information like names or dates.

7. MediaContent 2.7.3
Reduce support calls by automating lost password management
Login failed page will offer ‘ my password function’
Audit trail on when and where sent
Admin tool can pull the Audit trail for diagnostic purposes.
There were 326 HelpDesk tickets in the last 12 months relating to MediaContent password. The goal here is reducing the number of support calls related to lost password and password changed by doing what other sites have done for years – the password to a trusted address. Where a login is unsuccessful and the service is subscribed to, the password failed page will provide a button to the password to the account master address. The request, and where it was sent will be written to the server logs and the admin tool will read and filter the logs to locate change information for a particular user, in the event there is a problem.