Feeds

Microsoft security chief trapped in endless identity sales pitch

No end to 'End to End Trust'

Choosing a cloud hosting partner with confidence

RSA Microsoft on Tuesday gave the world a sneak peak at technology it said would streamline the process of validating people's identity without compromising their privacy.

Code-named Geneva, the software provides a framework for schools, businesses, and other large organizations to more safely manage sensitive data about their members. Rather than storing a vast array of data, the system collects only the identity attributes a member chooses to divulge. Geneva, which Microsoft describes as an interoperable claims-based access system, is being tested by The Lake Washington School District.

The demo came during a keynote at the RSA security conference in San Francisco by Scott Charney, corporate vice president of Microsoft’s Trustworthy Computing Group. He said the approach is one way to fix the way websites go about validating the identity of their users, a system he characterized as dysfunctional.

"The way we do identity today is completely flawed," he said. "I go to a website. They challenge me for some personal information, a social security number, date of birth, mother's maiden name. They validate that information and they give me a credential. Of course, those secrets aren't secret at all, yet that's the way we've done identity on the internet."

Trust, Charney argued, isn't a black-or-white thing. It may be perfectly OK to trust an unknown street vendor with a credit number that caps fraud losses at $50. Turning over a bank-account number to the same salesman might be altogether different.

Unfortunately, today's authentication procedures don't consider such nuances. When bartenders verify a patron is old enough to drink liquor, for instance, they ask to see her license, which contains an address and a wealth of additional personal information that is perfectly irrelevant to the task.

"We can do it differently on the internet," Charney said.

Charney's 40-minute talk was largely a rehash of a whitepaper (PDF) he delivered at last year's conference, when he introduced a sales pitch he called End to End Trust. In addition to Geneva, Charney also held out the next version of Windows and Microsoft's Forefront product as ways to ensure computer users can have more confidence in what's running on their machines and networks.

Windows 7, for example, will monitor whether applications that are about to be installed have been digitally signed by a reputable company. People administering large fleets of machines will be able to create group policies that forbid end users from installing titles that have no signatures. As reported earlier Tuesday, the new operating system will also extend its BitLocker encryption protection to USB drives. Additionally, it will included a new remote access feature designed to make it easier to securely connect to other machines.

A key part of Charney's End to End Trust shtick is industry collaboration. To that end, he said, Forefront is making it easier for admins to locate and quarantine machines on large networks that have been compromised by malware or other threats. APIs baked in to the management console ensure that even gadgets made by third-party companies will work seamlessly.

The former head of the Justice Department's Computer Crime and Intellectual Property Section, Charney also recounted the reaction he got from his colleagues when he announced, in 2002, that he planned to join Microsoft.

"Initially, my friends laughed because I used Microsoft and security in the same sentence," he said. "But it turns out in the years that followed I think we've proven we're very serious about security." ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Free virtual appliance for wire data analytics
The ExtraHop Discovery Edition is a free virtual appliance will help you to discover the performance of your applications across the network, web, VDI, database, and storage tiers.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.