Feeds

Microsoft security chief trapped in endless identity sales pitch

No end to 'End to End Trust'

Using blade systems to cut costs and sharpen efficiencies

RSA Microsoft on Tuesday gave the world a sneak peak at technology it said would streamline the process of validating people's identity without compromising their privacy.

Code-named Geneva, the software provides a framework for schools, businesses, and other large organizations to more safely manage sensitive data about their members. Rather than storing a vast array of data, the system collects only the identity attributes a member chooses to divulge. Geneva, which Microsoft describes as an interoperable claims-based access system, is being tested by The Lake Washington School District.

The demo came during a keynote at the RSA security conference in San Francisco by Scott Charney, corporate vice president of Microsoft’s Trustworthy Computing Group. He said the approach is one way to fix the way websites go about validating the identity of their users, a system he characterized as dysfunctional.

"The way we do identity today is completely flawed," he said. "I go to a website. They challenge me for some personal information, a social security number, date of birth, mother's maiden name. They validate that information and they give me a credential. Of course, those secrets aren't secret at all, yet that's the way we've done identity on the internet."

Trust, Charney argued, isn't a black-or-white thing. It may be perfectly OK to trust an unknown street vendor with a credit number that caps fraud losses at $50. Turning over a bank-account number to the same salesman might be altogether different.

Unfortunately, today's authentication procedures don't consider such nuances. When bartenders verify a patron is old enough to drink liquor, for instance, they ask to see her license, which contains an address and a wealth of additional personal information that is perfectly irrelevant to the task.

"We can do it differently on the internet," Charney said.

Charney's 40-minute talk was largely a rehash of a whitepaper (PDF) he delivered at last year's conference, when he introduced a sales pitch he called End to End Trust. In addition to Geneva, Charney also held out the next version of Windows and Microsoft's Forefront product as ways to ensure computer users can have more confidence in what's running on their machines and networks.

Windows 7, for example, will monitor whether applications that are about to be installed have been digitally signed by a reputable company. People administering large fleets of machines will be able to create group policies that forbid end users from installing titles that have no signatures. As reported earlier Tuesday, the new operating system will also extend its BitLocker encryption protection to USB drives. Additionally, it will included a new remote access feature designed to make it easier to securely connect to other machines.

A key part of Charney's End to End Trust shtick is industry collaboration. To that end, he said, Forefront is making it easier for admins to locate and quarantine machines on large networks that have been compromised by malware or other threats. APIs baked in to the management console ensure that even gadgets made by third-party companies will work seamlessly.

The former head of the Justice Department's Computer Crime and Intellectual Property Section, Charney also recounted the reaction he got from his colleagues when he announced, in 2002, that he planned to join Microsoft.

"Initially, my friends laughed because I used Microsoft and security in the same sentence," he said. "But it turns out in the years that followed I think we've proven we're very serious about security." ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.