Feeds

Microsoft security chief trapped in endless identity sales pitch

No end to 'End to End Trust'

Securing Web Applications Made Simple and Scalable

RSA Microsoft on Tuesday gave the world a sneak peak at technology it said would streamline the process of validating people's identity without compromising their privacy.

Code-named Geneva, the software provides a framework for schools, businesses, and other large organizations to more safely manage sensitive data about their members. Rather than storing a vast array of data, the system collects only the identity attributes a member chooses to divulge. Geneva, which Microsoft describes as an interoperable claims-based access system, is being tested by The Lake Washington School District.

The demo came during a keynote at the RSA security conference in San Francisco by Scott Charney, corporate vice president of Microsoft’s Trustworthy Computing Group. He said the approach is one way to fix the way websites go about validating the identity of their users, a system he characterized as dysfunctional.

"The way we do identity today is completely flawed," he said. "I go to a website. They challenge me for some personal information, a social security number, date of birth, mother's maiden name. They validate that information and they give me a credential. Of course, those secrets aren't secret at all, yet that's the way we've done identity on the internet."

Trust, Charney argued, isn't a black-or-white thing. It may be perfectly OK to trust an unknown street vendor with a credit number that caps fraud losses at $50. Turning over a bank-account number to the same salesman might be altogether different.

Unfortunately, today's authentication procedures don't consider such nuances. When bartenders verify a patron is old enough to drink liquor, for instance, they ask to see her license, which contains an address and a wealth of additional personal information that is perfectly irrelevant to the task.

"We can do it differently on the internet," Charney said.

Charney's 40-minute talk was largely a rehash of a whitepaper (PDF) he delivered at last year's conference, when he introduced a sales pitch he called End to End Trust. In addition to Geneva, Charney also held out the next version of Windows and Microsoft's Forefront product as ways to ensure computer users can have more confidence in what's running on their machines and networks.

Windows 7, for example, will monitor whether applications that are about to be installed have been digitally signed by a reputable company. People administering large fleets of machines will be able to create group policies that forbid end users from installing titles that have no signatures. As reported earlier Tuesday, the new operating system will also extend its BitLocker encryption protection to USB drives. Additionally, it will included a new remote access feature designed to make it easier to securely connect to other machines.

A key part of Charney's End to End Trust shtick is industry collaboration. To that end, he said, Forefront is making it easier for admins to locate and quarantine machines on large networks that have been compromised by malware or other threats. APIs baked in to the management console ensure that even gadgets made by third-party companies will work seamlessly.

The former head of the Justice Department's Computer Crime and Intellectual Property Section, Charney also recounted the reaction he got from his colleagues when he announced, in 2002, that he planned to join Microsoft.

"Initially, my friends laughed because I used Microsoft and security in the same sentence," he said. "But it turns out in the years that followed I think we've proven we're very serious about security." ®

Mobile application security vulnerability report

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.