Feeds

More thoughts on identity

Mary Branscombe comments

Build a business case: developing custom apps

Reg Developer contributor Mary Branscombe has some thoughts on the Microsoft Identity Management Workshop (see blog here) - she fell foul of our seven day limit for replies.

So, here is her view:

Couldn't resist commenting myself! Identity and rights management; you can't manage who is allowed to view/change/print etc a document without having a good way to manage who they are. One reason why ADFS will be able to provision InfoCards for users (or whatever anodyne name InfoCards gets when the technology ships).

If I want to give you rights you are either an individual or in a class of those to whom I wish to grant rights. The current MS IRM - which has been around since 2003 in much the same form - handles the first group: people I can name, ideally through my Active Directory.

The second group are the ones I personally find interesting; I'd like to be able to say that everyone who has a subscription to a magazine I write for can download a copy of any of the articles I've written for the magazine and access that for up to three years after their subscription lapses, after which they can't access it until the article is at least five years old.

A business might say everyone who is of at least pay grade X can access this report. A website might say everyone who works for company Y can read our subscription-only white papers without signing up for an account. Depending on the information they put in the InfoCard, an InfoCard system could cope with all of those (though blocking the content after time and then re-releasing it is harder and needs a continuing infrastructure of some kind). But more companies wanted the first - let me limit the price list to the five people who should see it and stop anyone seeing it when it's more than six months old - than the second, because you can see an obvious immediate business case for implementing the first.

I am not a lawyer but I remember that the login for Windows was once considered an invitation even if you weren't the legitimate user. I believe that conversely, if you tell people that there's a policy that only person X can read document Y and employee Z who is aware of the policy reads it, then they're knowingly breaking company policy. Stopping people easily printing or copying the text means you have to use PrintScreen or take a photo or use a screen scraper - and it's hard to argue that you did any of those accidentally.

And I mostly agree, although Mary presents the normative case - there's nothing to stop you granting rights etc to people even though you don't really know who they are for certain.

Remember when security policies said that you were responsible for anything done on your login even if you weren't logged in? This assumed that if it wasn't you, you must have shared your password or chosen an easy one etc...Not necessarily true, but I bet many policies still say that - and passwords are a pretty poor way to manage identity...

So identity management is a requirement for effective rights management, but I'd rather MS got identity management working before confusing the issue with rights management...I suspect that rights management, for office documents, is simply going to be used to provide a cosmetic veneer of access control.

The MS project manager said that getting round DRM "proved" intent to defraud or damage the company. I'm not a lawyer either, but I'd still like to see specific case law before deciding that evading DRM proves any sort of "intent" - some of the "invitations to hack" have been pretty obscure and I think you might need training and written policy backup in addition to just installing some software. You can't always assume that what makes logical sense is what the law means.

I think Mary's split ("you are either an individual or in a class of those to whom I wish to grant rights" is very useful... ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Why has the web gone to hell? Market chaos and HUMAN NATURE
Tim Berners-Lee isn't happy, but we should be
Microsoft boots 1,500 dodgy apps from the Windows Store
DEVELOPERS! DEVELOPERS! DEVELOPERS! Naughty, misleading developers!
'Stop dissing Google or quit': OK, I quit, says Code Club co-founder
And now a message from our sponsors: 'STFU or else'
Apple promises to lift Curse of the Drained iPhone 5 Battery
Have you tried turning it off and...? Never mind, here's a replacement
Linux turns 23 and Linus Torvalds celebrates as only he can
No, not with swearing, but by controlling the release cycle
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
This is how I set about making a fortune with my own startup
Would you leave your well-paid job to chase your dream?
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.