White Papers


   "Entreprise Rights Management (ERM)" White Paper (25/01/2007)

White Paper written by IDC (Eric Domage).

INTRODUCTION

The increase in the number of working media emphasize businesses’ concerns regarding the control of their information.

In the situation of and IT manager, following questions can be raised :
How can we control the production chain when half of the tools, or even employees, are mobile?

How do we make sure that common office applications don’t throw open the doors to undesired visitors, for unorganised or unwanted sharing of information?

How do we make sure that that files are accessed for modification by authorised persons in accordance with in-house rules, or with the laws and regulations established by supervisory authorities?

How do we trace the business’ structuring operations in order to recreate an account closing history or an audit trail?

Brick by brick, a set of technologies meets all of these complex needs expressed by all types of businesses, both big and small.

This white paper lays the foundations for a new set of offers.

 

1-Enterprise Right Management: definition

In this white paper, IDC hopes to shed light on a new set of offers called ERM (Enterprise Right Management) which is positioned on the fringes of previously known solutions such as KM (Knowledge Management), DRM (Digital Right Management) and IAM (Identity Access Management); and which takes certain technological bricks from each of them.

From Knowledge Management (KM), ERM takes:

  • Optimal use of information assets
  • Information processing process (WorkFlow) management
  • Sharing organisation
From Digital Right Management (DRM), ERM takes:
  • Version management
  • Copy and modification rights assignment
  • Creation and ownership rights protection
From Identity and Access Management (IAM), ERM takes:
  • User rights management
  • Profile assignment
  • Directory management

Its intrinsic qualities:

  • ERM brings together security tools and technologies
  • ERM meets businesses’ specific needs for DRM and KM and does not cover management of rights to intellectual creations from outside the business (music, software, process, etc.)
  • ERM is based on technologies at the user level and requires little or no deployment or centralisation
  • ERM is based on user qualification and user action
  • ERM uses rules which are issued, checked and modified by general management based on security objectives
IDC considers the following solutions to be part of the ERM set:
  • Encryption on the workstation (local or central administration)
  • Secure exchange management: exchange of public keys, encrypted e-mail
  • Internal electronic signature (most often internal third party certifier)
  • Basic or elaborate identification (permanent login and password and directories)
  • Content rights management: copy, modification, transfer and printing

ERM meets businesses’ needs for:

  • Information traceability
  • Auditability of structuring actions (accounting, finance, development plans, procedures, etc.)
  • Simplified profile and people management
  • Information protection and integrity

ERM meets all information transmission and exchange needs, protected by encryption, in the public and private domains.

2-Where is information in business?

First of all, we must examine where information is located and stored in companies. The daily generation of digital content and data has forced businesses and users to look at where information is stored.

1) WHO HAS AN INFORMATION STORAGE STRATEGY?

European Businesses show a definite ability to remove data from workstations. This is a sign of real maturity.

Please estimate the percentage of all of your company’s data which is found on employees’ workstations.

IDC, 2006

2) HOW OLD IS STORED DATA ?

The older the data, the less European companies worry about it

Of all of your company’s data, including that on servers, workstations, external systems and on tape, what percentage of the data is aged…

IDC, 2006

The responses to these two questions show that businesses have at least acquired the reflex of finding data, and at best of removing it from workstations. This is the start of information storage and management strategies.

The second table shows us that the data are very fresh, reflecting the level of activity.


3-What businesses fear?

The massive computerisation of production tools forces businesses to develop strategies (more or less elaborate, more or less formal) in order to manage the risk of losing data.

3) THE FEAR OF LOOSING INFORMATION IS GREATER EVEN THAN THE FEAR OF VIRUSES

Most of all, Europeans businesses fear the consequences rather than the causes of computer incidents.

On a scale of 1 to 10, where 1 = not important 10 = very important.
How important are the following threats to your business’ activity?

IDC, 2006

The answers to this question teach us something very important: businesses have understood the importance of data security and rightly "fear" the consequences of computer problems (crashes, attacks, improper use) rather than the causes.

IDC believes that businesses have a real data security culture.

4-Terminal loss and theft

The Clusif (French based IT Security corporate end-users group) report "Politiques de sécurité et sinistralité en France en 2005" has dedicated an entire chapter (Topic 13) to security incident management.

For this user’s group, the increase in the theft and loss of hardware is "worrying, but logical".
According to the 2005 annual report published in 2006, these problems of theft or loss have risen from 6% of incidents observed in 2003 in companies with between 200 and 499 employees to 37% in 2005, for more than a sixfold increase in just two years.

In companies with over 1 000 employees, theft and loss represented 65% of incidents in 2005.
CLUSIF considers that the increasingly common use of mobile tools is behind this phenomenon.

http://www.clusif.asso.fr

We need to examine this brutal increase in its context.

  • In 2003, mobile tools had not reached their peak of use, and businesses were discovering security problems and their solutions. As a general rule, "theft" was not an issue.
  • In 2005, Clusif observed that the context is different and that theft is now considered one of the greatest threats to be fought.


    5-Obligations weighing on businesses

    As a general rule, the framework surrounding economic activity is becoming more structured and is producing numerous regulations, laws and obligations.
    Following major scandals like Enron and Worldcom in the United States and Crédit Lyonnais in France, the number of obligations has increased significantly.
    Most of the time, these obligations, whether issued by governments, corporations or companies, put in place one or all of the following components:

    • Transparent business account management
    • Transaction traceability
    • Transaction recording and archiving

    Obligations concerning the company’s behaviour in society :

    • Sarbanes Oxley (Transparency): concerns all American companies and all companies traded on an American market and their subsidiaries
    • The Financial Security Law (France): the French version of SOX, almost identical
    • The digital economy trust law (LCEN): transparency and traceability of Web transactions; IAPs are required to keep connection logs and operators keep traffic logs
    • The domestic security and anti-terrorist laws: operators are required to archive subscriber activity.

    Obligations linked to business sectors

    • Traceability in the foods sector: one of the leading sectors with strict obligations following the mad cow scare. This sector is composed primarily of small businesses which were forced to adapt very quickly.
    • Banking sector: the Basel II agreements have restructured how trust ratios are calculated between banks. Banks must be able to view their customer and operational risk (including computing and even flooding of the Seine) then cover these risks with their equity capital. Primarily composed of large and very large banks, the banking world is definitely well underway in managing these obligations.
    • Medicine: the search for civil and criminal liability includes increasingly strict penalties, leading to substantial increases in insurance premiums. Action traceability is subject to increasingly heavy regulatory pressure.
    Obligations for the professions
      A number of professions are subject to information control obligations.
      Most of the regulated professions (chartered accountants, auditors and bailiffs) have already dematerialised their archiving and procedures getting a significant head start in the area of electronic signatures and legal digital archiving.

    Information control, a reality for everyone

      As a general rule, few businesses, regardless of their size, can avoid at least some form of information control obligation. From accounting and financial acts to medical actions, recording, traceability and access are now realities which need to be organised to meet obligations or else be banned from the market.


    In the vast majority of cases, obligations cover:
    • user authentication
    • message confidentiality
    • information integrity
    • event logging

    While very large firms have set up the procedures which take the onus off of the end user by automating the respect of obligations, medium, small and very small businesses expend a great deal of energy in ensuring they respect these obligations.

    6-CONCLUSION: ERM, an answer to new security needs

    The first security solutions proposed fill structural holes or weaknesses in computing. Perimeter tools (firewall, anti virus, IDS & IPS) defend companies against attacks and external threats, while communications security tools (VPN) secure links outside the company.

    New corporate behaviours associated with new transparency, traceability and information integrity requirements give new meaning to the circulation of information within the company.

    Rather than a standard exchange, file and data communication inside the company becomes a transaction where:

    • the sender and recipient are known, referenced and authenticated,
    • content is locked, protected and verified,
    • the exchange is recorded and protected by central tools.
    These three obligations call on different technical responses which have long been kept separate in business usages.
    • Identity and access management solutions (IAM) manage senders and recipients.
    • Data encryption solutions protect confidentiality and integrity as messages circulate.
    • Centralized administration solutions distribute certificates and encoding keys.
    By unifying these responses within one and the same solution, the new needs expressed by businesses can be addressed.

    IDC believes that this unified solution comes naturally under the umbrella of "Enterprise Rights Management" or ERM."


    7-ZoneCentral by Prim'X: an ERM information management solution

    By Serge Binet, Co-Founder of Prim'X Technologies

    The Prim’X ZoneCentral product offers a vision of a transparent security policy for the user which is administered by the company. The software is totally integrated in the Windows core, and manages encrypted, distributed and partitioned user spaces (management of the right to know).

    APPLICATION

    • Protecting fleets of laptops
      • ZoneCentral protects laptops by encrypting file systems. It is totally integrated in the system core and transparent. Its original and flexible approach is easily integrated in the company’s logistics, and provides services which are indispensable for good security. Thanks to the spaces partitioned by ZoneCentral, the computer can be administered or repaired by a third party (internal or external), or even used by a “guest” without any secrets being given away (passwords, confidential codes).

    • Protecting desktop terminals
      • ZoneCentral can also be used on desktop terminals, with ‘terminal on’ security features: the computer does not need to be turned off to close encrypted spaces and keys, and network access to terminals is also encrypted (only those with the correct keys can read the content).
      ZoneCentral can also encrypt users’ “personal” network units.

    • Protecting file servers
      • ZoneCentral can also be used on file servers to provide encrypted sharing for users or user groups. The spaces can be partitioned based on rights, and encryption is totally transparent for the servers, which can be of any type (Windows, Novell, Linux/Samba, filers) since no software is installed on the servers.
      This service is very useful when servers are used by third parties (internal, service providers, outsourcing), to partition departments (HR, information security, GM, R&D), and manage the ‘right to know’ in house. Even backups are encrypted.

    • Securing an infrastructure
      • By combining its ability to encrypt workstations (laptops or desktops) and share files on networks or servers, ZoneCentral can fully encrypt the file infrastructure of a department, division or entire company, with maximum transparency for users AND operators.
      ZoneCentral is compatible with advanced infrastructures, such as roaming profiles, public terminals, "off-line" files, ActiveDirectory or Novell networks, remote installation, central ‘policy’ administration (GPO), etc.

    • Securing USB memory keys
      • The contents of USB memory keys can also be encrypted spaces. ZoneCentral proposes different management modes for these very useful, but also very dangerous, objects: full or partial encryption, encrypted or read only, etc.

    • Exchanging confidential documents
      • ZoneCentral integrates the companion product Zed! invented by Prim'X Technologies, which creates encrypted multi-access containers (passwords and/or certificates).
      These containers are extremely simple and intuitive, and are used exactly like zip files in Windows XP. They quickly become ‘diplomatic briefcases’ for internal exchanges and especially for exchanges with third parties (partners, subcontractors, customers). A free and free-use module lets correspondents access and modify content. This lets correspondents modify existing documents or add new ones.


    THE KEYS POINTS OF ZONECENTRAL
    • Transparency for the user
      • ZoneCentral is invisible. Users don’t need to change their habits or reorganise their work space (files, folders, networks): the product is quickly forgotten.
      The user now works in a fully encrypted space, everything is automatic, systematic, transparent and… secure.
      Thanks to this transparency, users quickly accept the security. Deployment and training costs are reduced.

    • Encrypted work spaces
      • Users’ entire work space can be encrypted, including their Windows profile (desktop, "My Documents", etc.), temp files, system swap, Internet cache, and all their folders, on all local disks and on the company’s networks.

    • Shared encrypted spaces on file servers
      • Shared spaces on all types of file servers (Windows, Novell, Linux/Samba, filers) can be encrypted for work groups with different encrypted access rights (right to know), in a way which is transparent for users and for server operators.

    • Extended compatibility with network infrastructures
      • ZoneCentral is compatible (and cooperative) with advanced Windows services: roaming profiles, off-line folders, redirected folders and smart card login. It also works in a TerminalServer or Citrix environment.
      ZoneCentral can also use existing logistics to facilitate deployment and administration: remote installation, policies (GPO), ActiveDirectory, LDAP directories and remote control.

    • Partitioning with technical departments
      • On the terminals, common system and network administrator interventions (internal or service providers) require no key or the user's presence. However, this does not mean that network administrators have the right to know and to understand the content of the folders which remain encrypted.
      In the same way, operating tasks on the servers do not need keys (or even software!) and do not change. Even backups are encrypted.

    • The Encryption Plan allows central administration
      • The Encryption Plan is composed of instructions which define what needs to be encrypted. It is defined centrally and then automatically and systematically applied by ZoneCentral. This plan frees users from all "application procedures".

    • Free choice of authentication methods and PKI compatibility
      • ZoneCentral accepts all types of authentication: passwords, smart cards or RSA tokens (major market manufacturers), and biometric tools.
      If there is a PKI, ZoneCentral knows how to use this infrastructure (keys, certificates, CRLs). If there isn’t one, or if it is only partially deployed, ZoneCentral can also apply password-protected access.
      So, the choice of key logistics is not structuring; it can evolve over time, and can even be heterogeneous.

    • Encryption adapted to the business
      • ZoneCentral integrates all services indispensable to the implementation of encryption in the company, in particular for user recovery and rescue services.
      Prim'X is publisher of confidence products. A certification procedure “Common Criteria” (EAL2+) of the entire product is in progress.
      See DCSSI website (French)




    		•