Feeds

More thoughts on identity

Mary Branscombe comments

7 Elements of Radically Simple OS Migration

Reg Developer contributor Mary Branscombe has some thoughts on the Microsoft Identity Management Workshop (see blog here) - she fell foul of our seven day limit for replies.

So, here is her view:

Couldn't resist commenting myself! Identity and rights management; you can't manage who is allowed to view/change/print etc a document without having a good way to manage who they are. One reason why ADFS will be able to provision InfoCards for users (or whatever anodyne name InfoCards gets when the technology ships).

If I want to give you rights you are either an individual or in a class of those to whom I wish to grant rights. The current MS IRM - which has been around since 2003 in much the same form - handles the first group: people I can name, ideally through my Active Directory.

The second group are the ones I personally find interesting; I'd like to be able to say that everyone who has a subscription to a magazine I write for can download a copy of any of the articles I've written for the magazine and access that for up to three years after their subscription lapses, after which they can't access it until the article is at least five years old.

A business might say everyone who is of at least pay grade X can access this report. A website might say everyone who works for company Y can read our subscription-only white papers without signing up for an account. Depending on the information they put in the InfoCard, an InfoCard system could cope with all of those (though blocking the content after time and then re-releasing it is harder and needs a continuing infrastructure of some kind). But more companies wanted the first - let me limit the price list to the five people who should see it and stop anyone seeing it when it's more than six months old - than the second, because you can see an obvious immediate business case for implementing the first.

I am not a lawyer but I remember that the login for Windows was once considered an invitation even if you weren't the legitimate user. I believe that conversely, if you tell people that there's a policy that only person X can read document Y and employee Z who is aware of the policy reads it, then they're knowingly breaking company policy. Stopping people easily printing or copying the text means you have to use PrintScreen or take a photo or use a screen scraper - and it's hard to argue that you did any of those accidentally.

And I mostly agree, although Mary presents the normative case - there's nothing to stop you granting rights etc to people even though you don't really know who they are for certain.

Remember when security policies said that you were responsible for anything done on your login even if you weren't logged in? This assumed that if it wasn't you, you must have shared your password or chosen an easy one etc...Not necessarily true, but I bet many policies still say that - and passwords are a pretty poor way to manage identity...

So identity management is a requirement for effective rights management, but I'd rather MS got identity management working before confusing the issue with rights management...I suspect that rights management, for office documents, is simply going to be used to provide a cosmetic veneer of access control.

The MS project manager said that getting round DRM "proved" intent to defraud or damage the company. I'm not a lawyer either, but I'd still like to see specific case law before deciding that evading DRM proves any sort of "intent" - some of the "invitations to hack" have been pretty obscure and I think you might need training and written policy backup in addition to just installing some software. You can't always assume that what makes logical sense is what the law means.

I think Mary's split ("you are either an individual or in a class of those to whom I wish to grant rights" is very useful... ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
PEAK LANDFILL: Why tablet gloom is good news for Windows users
Sinofsky's hybrid strategy looks dafter than ever
Leaked Windows Phone 8.1 Update specs tease details of Nokia's next mobes
New screen sizes, dual SIMs, voice over LTE, and more
Fiendishly complex password app extension ships for iOS 8
Just slip it in, won't hurt a bit, 1Password makers urge devs
Mozilla keeps its Beard, hopes anti-gay marriage troubles are now over
Plenty on new CEO's todo list – starting with Firefox's slipping grasp
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
Another day, another Firefox: Version 31 is upon us ALREADY
Web devs, Mozilla really wants you to like this one
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Cloudy CoreOS Linux distro declares itself production-ready
Lightweight, container-happy Linux gets first Stable release
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?