Feeds

More thoughts on identity

Mary Branscombe comments

Providing a secure and efficient Helpdesk

Reg Developer contributor Mary Branscombe has some thoughts on the Microsoft Identity Management Workshop (see blog here) - she fell foul of our seven day limit for replies.

So, here is her view:

Couldn't resist commenting myself! Identity and rights management; you can't manage who is allowed to view/change/print etc a document without having a good way to manage who they are. One reason why ADFS will be able to provision InfoCards for users (or whatever anodyne name InfoCards gets when the technology ships).

If I want to give you rights you are either an individual or in a class of those to whom I wish to grant rights. The current MS IRM - which has been around since 2003 in much the same form - handles the first group: people I can name, ideally through my Active Directory.

The second group are the ones I personally find interesting; I'd like to be able to say that everyone who has a subscription to a magazine I write for can download a copy of any of the articles I've written for the magazine and access that for up to three years after their subscription lapses, after which they can't access it until the article is at least five years old.

A business might say everyone who is of at least pay grade X can access this report. A website might say everyone who works for company Y can read our subscription-only white papers without signing up for an account. Depending on the information they put in the InfoCard, an InfoCard system could cope with all of those (though blocking the content after time and then re-releasing it is harder and needs a continuing infrastructure of some kind). But more companies wanted the first - let me limit the price list to the five people who should see it and stop anyone seeing it when it's more than six months old - than the second, because you can see an obvious immediate business case for implementing the first.

I am not a lawyer but I remember that the login for Windows was once considered an invitation even if you weren't the legitimate user. I believe that conversely, if you tell people that there's a policy that only person X can read document Y and employee Z who is aware of the policy reads it, then they're knowingly breaking company policy. Stopping people easily printing or copying the text means you have to use PrintScreen or take a photo or use a screen scraper - and it's hard to argue that you did any of those accidentally.

And I mostly agree, although Mary presents the normative case - there's nothing to stop you granting rights etc to people even though you don't really know who they are for certain.

Remember when security policies said that you were responsible for anything done on your login even if you weren't logged in? This assumed that if it wasn't you, you must have shared your password or chosen an easy one etc...Not necessarily true, but I bet many policies still say that - and passwords are a pretty poor way to manage identity...

So identity management is a requirement for effective rights management, but I'd rather MS got identity management working before confusing the issue with rights management...I suspect that rights management, for office documents, is simply going to be used to provide a cosmetic veneer of access control.

The MS project manager said that getting round DRM "proved" intent to defraud or damage the company. I'm not a lawyer either, but I'd still like to see specific case law before deciding that evading DRM proves any sort of "intent" - some of the "invitations to hack" have been pretty obscure and I think you might need training and written policy backup in addition to just installing some software. You can't always assume that what makes logical sense is what the law means.

I think Mary's split ("you are either an individual or in a class of those to whom I wish to grant rights" is very useful... ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
'Google is NOT the gatekeeper to the web, as some claim'
Plus: 'Pretty sure iOS 8.0.2 will just turn the iPhone into a fax machine'
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.