Feeds

Microsoft security chief trapped in endless identity sales pitch

No end to 'End to End Trust'

Internet Security Threat Report 2014

RSA Microsoft on Tuesday gave the world a sneak peak at technology it said would streamline the process of validating people's identity without compromising their privacy.

Code-named Geneva, the software provides a framework for schools, businesses, and other large organizations to more safely manage sensitive data about their members. Rather than storing a vast array of data, the system collects only the identity attributes a member chooses to divulge. Geneva, which Microsoft describes as an interoperable claims-based access system, is being tested by The Lake Washington School District.

The demo came during a keynote at the RSA security conference in San Francisco by Scott Charney, corporate vice president of Microsoft’s Trustworthy Computing Group. He said the approach is one way to fix the way websites go about validating the identity of their users, a system he characterized as dysfunctional.

"The way we do identity today is completely flawed," he said. "I go to a website. They challenge me for some personal information, a social security number, date of birth, mother's maiden name. They validate that information and they give me a credential. Of course, those secrets aren't secret at all, yet that's the way we've done identity on the internet."

Trust, Charney argued, isn't a black-or-white thing. It may be perfectly OK to trust an unknown street vendor with a credit number that caps fraud losses at $50. Turning over a bank-account number to the same salesman might be altogether different.

Unfortunately, today's authentication procedures don't consider such nuances. When bartenders verify a patron is old enough to drink liquor, for instance, they ask to see her license, which contains an address and a wealth of additional personal information that is perfectly irrelevant to the task.

"We can do it differently on the internet," Charney said.

Charney's 40-minute talk was largely a rehash of a whitepaper (PDF) he delivered at last year's conference, when he introduced a sales pitch he called End to End Trust. In addition to Geneva, Charney also held out the next version of Windows and Microsoft's Forefront product as ways to ensure computer users can have more confidence in what's running on their machines and networks.

Windows 7, for example, will monitor whether applications that are about to be installed have been digitally signed by a reputable company. People administering large fleets of machines will be able to create group policies that forbid end users from installing titles that have no signatures. As reported earlier Tuesday, the new operating system will also extend its BitLocker encryption protection to USB drives. Additionally, it will included a new remote access feature designed to make it easier to securely connect to other machines.

A key part of Charney's End to End Trust shtick is industry collaboration. To that end, he said, Forefront is making it easier for admins to locate and quarantine machines on large networks that have been compromised by malware or other threats. APIs baked in to the management console ensure that even gadgets made by third-party companies will work seamlessly.

The former head of the Justice Department's Computer Crime and Intellectual Property Section, Charney also recounted the reaction he got from his colleagues when he announced, in 2002, that he planned to join Microsoft.

"Initially, my friends laughed because I used Microsoft and security in the same sentence," he said. "But it turns out in the years that followed I think we've proven we're very serious about security." ®

Internet Security Threat Report 2014

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.