Feeds

More thoughts on identity

Mary Branscombe comments

5 things you didn’t know about cloud backup

Reg Developer contributor Mary Branscombe has some thoughts on the Microsoft Identity Management Workshop (see blog here) - she fell foul of our seven day limit for replies.

So, here is her view:

Couldn't resist commenting myself! Identity and rights management; you can't manage who is allowed to view/change/print etc a document without having a good way to manage who they are. One reason why ADFS will be able to provision InfoCards for users (or whatever anodyne name InfoCards gets when the technology ships).

If I want to give you rights you are either an individual or in a class of those to whom I wish to grant rights. The current MS IRM - which has been around since 2003 in much the same form - handles the first group: people I can name, ideally through my Active Directory.

The second group are the ones I personally find interesting; I'd like to be able to say that everyone who has a subscription to a magazine I write for can download a copy of any of the articles I've written for the magazine and access that for up to three years after their subscription lapses, after which they can't access it until the article is at least five years old.

A business might say everyone who is of at least pay grade X can access this report. A website might say everyone who works for company Y can read our subscription-only white papers without signing up for an account. Depending on the information they put in the InfoCard, an InfoCard system could cope with all of those (though blocking the content after time and then re-releasing it is harder and needs a continuing infrastructure of some kind). But more companies wanted the first - let me limit the price list to the five people who should see it and stop anyone seeing it when it's more than six months old - than the second, because you can see an obvious immediate business case for implementing the first.

I am not a lawyer but I remember that the login for Windows was once considered an invitation even if you weren't the legitimate user. I believe that conversely, if you tell people that there's a policy that only person X can read document Y and employee Z who is aware of the policy reads it, then they're knowingly breaking company policy. Stopping people easily printing or copying the text means you have to use PrintScreen or take a photo or use a screen scraper - and it's hard to argue that you did any of those accidentally.

And I mostly agree, although Mary presents the normative case - there's nothing to stop you granting rights etc to people even though you don't really know who they are for certain.

Remember when security policies said that you were responsible for anything done on your login even if you weren't logged in? This assumed that if it wasn't you, you must have shared your password or chosen an easy one etc...Not necessarily true, but I bet many policies still say that - and passwords are a pretty poor way to manage identity...

So identity management is a requirement for effective rights management, but I'd rather MS got identity management working before confusing the issue with rights management...I suspect that rights management, for office documents, is simply going to be used to provide a cosmetic veneer of access control.

The MS project manager said that getting round DRM "proved" intent to defraud or damage the company. I'm not a lawyer either, but I'd still like to see specific case law before deciding that evading DRM proves any sort of "intent" - some of the "invitations to hack" have been pretty obscure and I think you might need training and written policy backup in addition to just installing some software. You can't always assume that what makes logical sense is what the law means.

I think Mary's split ("you are either an individual or in a class of those to whom I wish to grant rights" is very useful... ®

Boost IT visibility and business value

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Linux turns 23 and Linus Torvalds celebrates as only he can
No, not with swearing, but by controlling the release cycle
China hopes home-grown OS will oust Microsoft
Doesn't much like Apple or Google, either
Sin COS to tan Windows? Chinese operating system to debut in autumn – report
Development alliance working on desktop, mobe software
Apple promises to lift Curse of the Drained iPhone 5 Battery
Have you tried turning it off and...? Never mind, here's a replacement
Eat up Martha! Microsoft slings handwriting recog into OneNote on Android
Freehand input on non-Windows kit for the first time
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
This is how I set about making a fortune with my own startup
Would you leave your well-paid job to chase your dream?
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?