Feeds

Microsoft security chief trapped in endless identity sales pitch

No end to 'End to End Trust'

High performance access to file storage

RSA Microsoft on Tuesday gave the world a sneak peak at technology it said would streamline the process of validating people's identity without compromising their privacy.

Code-named Geneva, the software provides a framework for schools, businesses, and other large organizations to more safely manage sensitive data about their members. Rather than storing a vast array of data, the system collects only the identity attributes a member chooses to divulge. Geneva, which Microsoft describes as an interoperable claims-based access system, is being tested by The Lake Washington School District.

The demo came during a keynote at the RSA security conference in San Francisco by Scott Charney, corporate vice president of Microsoft’s Trustworthy Computing Group. He said the approach is one way to fix the way websites go about validating the identity of their users, a system he characterized as dysfunctional.

"The way we do identity today is completely flawed," he said. "I go to a website. They challenge me for some personal information, a social security number, date of birth, mother's maiden name. They validate that information and they give me a credential. Of course, those secrets aren't secret at all, yet that's the way we've done identity on the internet."

Trust, Charney argued, isn't a black-or-white thing. It may be perfectly OK to trust an unknown street vendor with a credit number that caps fraud losses at $50. Turning over a bank-account number to the same salesman might be altogether different.

Unfortunately, today's authentication procedures don't consider such nuances. When bartenders verify a patron is old enough to drink liquor, for instance, they ask to see her license, which contains an address and a wealth of additional personal information that is perfectly irrelevant to the task.

"We can do it differently on the internet," Charney said.

Charney's 40-minute talk was largely a rehash of a whitepaper (PDF) he delivered at last year's conference, when he introduced a sales pitch he called End to End Trust. In addition to Geneva, Charney also held out the next version of Windows and Microsoft's Forefront product as ways to ensure computer users can have more confidence in what's running on their machines and networks.

Windows 7, for example, will monitor whether applications that are about to be installed have been digitally signed by a reputable company. People administering large fleets of machines will be able to create group policies that forbid end users from installing titles that have no signatures. As reported earlier Tuesday, the new operating system will also extend its BitLocker encryption protection to USB drives. Additionally, it will included a new remote access feature designed to make it easier to securely connect to other machines.

A key part of Charney's End to End Trust shtick is industry collaboration. To that end, he said, Forefront is making it easier for admins to locate and quarantine machines on large networks that have been compromised by malware or other threats. APIs baked in to the management console ensure that even gadgets made by third-party companies will work seamlessly.

The former head of the Justice Department's Computer Crime and Intellectual Property Section, Charney also recounted the reaction he got from his colleagues when he announced, in 2002, that he planned to join Microsoft.

"Initially, my friends laughed because I used Microsoft and security in the same sentence," he said. "But it turns out in the years that followed I think we've proven we're very serious about security." ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.