Balancing Organizational Controls and Technical Controls in Data

Technical Controls – The security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system.

Organizational Controls – The security controls (i.e., safeguards or countermeasures) for an information system that primarily are implemented and executed by people (as opposed to systems).

NIST-800

The definitions above come from the glossary of the NIST-800 series of cybersecurity publications. While they are focused on cybersecurity, the broader concepts – automated controls versus manual controls – are applicable elsewhere. Over the last couple of weeks, and especially since I attended the TUgis conference, I have been thinking about these concepts in terms of data in general and schema in particular.

I find schema to be an interesting concept. The term “schema” is fairly wide-ranging in its definition but it can be defined as “an underlying organizational pattern or structure; conceptual framework.”

Read more

A Few Updates to pg_webhooks

At the time of my last post, there were a few outstanding issues that I wanted to address in the code of pg_webhooks. I’ve addressed three of them this week. There wasn’t actually a route to unsubscribe from a channel, so I added that shortly after the initial release. Another key shortcoming was that the … Read more

Organizational Muscle Memory

I’ve had plenty of opportunity to tell my “story” lately. After my initial post that my current position is ending, there has been a pleasantly surprising amount of interest and activity. Others have told me that I shouldn’t be surprised, but I feel like I’ve been fairly heads-down the past six years so it was … Read more

Reflections, Twenty-One Years On

Yesterday was the 21st anniversary of 9/11. I tend to let that day go by without comment. My recollections of the day itself add nothing as I was 50 miles outside of DC at the time. Even that far away, the roads were filled with panicked people and the phone networks were crashing, but I wasn’t in the city and I have nothing to add about that day.

Twenty-one years ago today, I was driving back home with my family and, as we crossed the Harry Nice Bridge from Virginia back into Maryland, it was flanked on either side by armed boats from local law enforcement and the National Guard. At that time, I was a contractor supporting an infrastructure protection program for the Department of Defense. There was no clearer illustration of the importance of what we did than those boats on that day.

Read more

Simple Isochrone Analysis in QGIS

With my MBA program behind me, one of my goals has been to shake the rust off my coding and GIS skills. For this post, I thought I would start simply, just to make sure I remembered how to find my way around QGIS.

We recently purchased a plug-in hybrid. It has a 17-mile range when running fully electric, so I used this as the basis for a quick analysis with QGIS. Of course, any such experimentation isn’t much fun without a few unrealistic assumptions, so here they are:

  1. The car was parked with an empty tank.
  2. It was brought up to a full charge overnight.
  3. Rather than immediately going to a gas station, we’ll go to a charging to top off the battery again.

These assumptions are, of course, ridiculous, but they allow me to have some fun.

I decided to build out drive-distance isochrones representing ten miles and sixteen miles. Ten miles represented the safe range, and sixteen represented the edge of insanity, at which I should use the last mile to find a gas station.

Read more

SaaS, IPaaS, and Interoperability

I started this blog back in 2006 during a time when I wasn’t doing much geospatial work at all. I was working on building a human resources system for a federal government customer who was falling under the then-new and now-defunct National Security Personnel System. Because it was new and sufficiently different from the GS system, there were no off-the-shelf products to acquire. So I found myself deep in the development of logic to model workflows for personnel reviews, tracking accomplishments, and other minutiae of managing different types of personnel. There was no room for anything geospatial and I felt it, probably incorrectly, slipping away so I started doing personal projects at home. This blog started out as the means for documenting those diversions, which included my first dabblings with PostGIS among many other things.

I find myself in a similar period now. I’ve been mostly occupied the past few months with migrating to a new billing system. It’s not sexy and it’s certainly not geospatial, but billing is a necessary engine of any business. When people talk about “growing pains” as businesses scale up, billing is one of the biggest.

Read more

Geography, Geospatial, and GIS

I was participating in a Clubhouse discussion today when someone asked the about the distinction between GIS and geospatial. Since Clubhouse is audio-only, I am paraphrasing by contribution to that particular discussion here.

I think the boundaries and definitions of these concepts are pretty blurry and I am reticent to create hard distinctions between them. In my daily life, I use the three terms “geography,” “geospatial,” and “GIS,” but I don’t use them interchangeably. I see all three as related in a layered fashions with geography being the bottom base layer and GIS being the top layer. I’ll briefly discuss each from bottom to top.

GrammarFascist, CC BY-SA 4.0 https://creativecommons.org/licenses/by-sa/4.0, via Wikimedia Commons

First is geography. The way I think about it, geography is the science that underpins the entire “geo” technology industry, as well as others. It is the theoretical, mathematical, and scientific construct that defines the boundaries of the sandbox in which we play. Because it’s a science, those boundaries are always changing and expanding, but that’s simply understood. Without the science of geography, the rest isn’t possible.

Read more

Return on Non-Investment

Yesterday evening, I had the pleasure of participating in a panel discussion on Clubhouse, hosted by Todd Barr and Jordan Cullen, and including Will Cadell of SparkGeo. Clubhouse seems to be a really convenient venue for setting up such a forum with low barriers to entry, so that was enjoyable. The topic of the discussion was “Geospatial ROI” and we talked about various ways to articulate the value of geospatial (the data and the concept) and GIS (the toolset to exploit geospatial).

One topic that we didn’t have time to get to, but has been at the front of my mind for a while is the “return on non-investment” with regard to open-source tools, geospatial or otherwise. Open-source has been mainstream for quite some time and platforms like Github make it easier to publish, manage, and maintain open-source tools. As a result, it’s easier than it’s ever been to find and use open-source tools to solve your problem.

Read more

Data Is Hard

Where I work, we have developed a nuanced philosophy to describe the niceties of collecting data, managing it, validating it, and preparing it for use: “Data is hard.”

This was brought to light in a very public manner by the vandalism that was displayed on basemaps produced by Mapbox. The responses by Mapbox  and their CEO, Eric Gendersen, are good examples of how a company should respond to such incidents. Kudos to him and the team at Mapbox for addressing and rectifying the situation quickly.

The Gordian Knot
By jmerelo [CC BY 2.0 (https://creativecommons.org/licenses/by/2.0)], via Wikimedia Commons
Speculation quickly ran to vandalism of OSM, which is one of the primary data sources used by Mapbox in their products. That speculation was backed up by the edit history in the New York area, but it is interesting to note that the vandalism was caught early in OSM and never came to light is OSM itself. In this case, the crowd worked as it was supposed to.

Read more