By Elisabeth Goodridge
Microsoft Windows Rights Management Services and Information Rights Management Helps Protect Valuable Corporate Information No Matter Where It Goes
Confidential financial e-mail leaked to the press before the quarterly earnings call? A CEO’s first reaction may be to break out in a cold sweat. The second step may be to call the IT director to ask how the breach could have been prevented.
To help avoid this scenario, Windows Rights Management Services (RMS) with Office 2003 Professional Edition offers organizations a new layer of information protection technology by providing tools to control their business information, no matter where it goes.
With no single end-to-end corporate security offering, there is a definite need for these solutions, says Ray Wagner, an analyst with Stamford, Conn.-based Gartner Inc. “Microsoft raised the bar with this technology, as it helps IT managers meet business requirements,” he says.
Whether shared accidentally or intentionally, proprietary information sent to the wrong people can lead to a loss of revenue, competitive advantage or customer confidence. According to a 2002 survey of 130 companies by consulting firm PricewaterhouseCoopers, U.S. companies lost up to $59 billion in intellectual property and proprietary information from June 2000 to June 2001.
New federal regulations, such as the Sarbanes-Oxley Act and the Health Insurance Portability and Accountability Act (HIPAA) and a growing reliance on digital information, are forcing responsibility of corporate content protection on IT personnel. Companies make business processes more efficient by shifting medical records, salary histories and other sensitive documents to digital formats, but the information is still vulnerable to malicious or accidental misuse.
Most digital information protection has been limited by available technology: Corporate firewalls, authentication technologies and encryption algorithms can restrict access to sensitive information but can do little to protect how this data is used or shared once access is granted.
“Many customers had internal rules and procedures regarding proprietary information, but no ability to enforce those rules,” says Jon Murchinson, a Microsoft RMS Communications Specialist. Organizations could only rely on employees’ judgment on who should see and use sensitive information.
Compounding the issue is the growing mobility of the information worker. With laptops and handhelds, employees increasingly view and use corporate intellectual property outside the company’s physical boundaries—from home offices, hotel rooms and even wireless hot spots at airports and coffee shops.
Creator Control
With policy enforcement tools and flexible administrative options, RMS with Office 2003 provides IT managers with the tools and infrastructure to enable persistent, file-level protection to Office documents across the organization. “The key work to RMS is ‘management’,” says Chris Le Tocq, an analyst with Los Gatos, Calif.-based Guernsey Research. “RMS links protection services with directory services, authenticating a class of people to use a class of documents.”
But the technology has to be easy to use, says Mike Meltzer, a product manager with Microsoft Office Information Worker Product Management Group. “People want something that works within their existing infrastructure. If it’s too difficult, they won’t use it.”
RMS enables Information Rights Management (IRM), a policy enforcement tool currently available with Microsoft Office Professional Edition Word 2003, Excel 2003, Outlook 2003 and PowerPoint 2003 applications. IRM provides the built-in functionality that allows users to apply these digital rights permissions.
For example, say a marketing executive wants the sales team to receive a highly confidential e-mail regarding the company’s new advertising campaign. In the Permission sub-menu of Outlook 2003, he selects a predefined “Highly Confidential” rights template, chooses his distribution list and appropriate access rights. Or he can select the new Permissions button on the toolbar to apply “Do Not Forward” rights to the e-mail.
On the backend, the RMS Server issues an Extensible Rights Markup Language (XrML)-based publishing license to the document creator. If this is the first RMS activity for the executive, an XrML client licensor certificate is also issued to verify his identity and allow for future offline publishing.
With IRM functionality, the executive has control over whether recipients can print, copy or paste information or forward the e-mail to unintended users. The Windows print screen function is also disabled when a rights-protected document is open. The author can also set an expiration policy.
On the client side, IRM encrypts the data and locks in the usage rights into the document at the file level. When the recipient receives the e-mail, RMS validates the user’s credentials and usage rights. If those credentials are valid, then a use license is issued. An audit log records the file name, user name, date, time and whether the request was accepted.
The protection policies remain with the document regardless of whether the document is online or offline, or within or outside the corporate firewall.
Keys to Successful Deployment
Ease-of-use at the front end does not mean an onerous implementation at the backend. In addition to an RMS-enabled application, such as Office Professional Edition 2003, an RMS solution requires two main infrastructure components: Windows RMS for any edition of Windows Server 2003, and Windows RMS Client software, updated APIs for the Windows Desktop. Active Directory directory service and a database server, such as Microsoft SQL Server or Microsoft SQL Server 2000 Desktop Engine, are also required to authenticate users and store configuration data, respectively.
A significant aspect of an RMS deployment is determining corporate policy, says Bill Kilcullen, a principal consultant in the Microsoft Enterprise Services Practice at Plano, Texas-based EDS Corp. “Carefully planning what type of content needs to be protected is incredibly important to deployment,” he says. “There’s also time involved when considering who will have actual authorization to view and protect what content.”
Once policies are in place, deployment begins by adding and provisioning the RMS components and administrative console to Windows Server 2003. IT administrators then install and activate the Windows RMS client software on each client computer, and the RMS server acts as a proxy to acquire and then distribute a unique code to identify each client computer. Lastly, an administrator installs and activates RMS-enabled applications.
Microsoft Office Professional Edition 2003 is required to create, view and modify rights-enabled documents. However, these documents can be viewed and modified in Microsoft Office Standard Edition 2003. Users who have prior versions of Office can view documents using a free HTML viewer, if they have the appropriate access rights.
Improved Management
With the RMS Administrator console, administrators can manage the RMS environment centrally, and defined individuals can have full control over all rights-controlled data.
IT managers can create revocation lists, audit trails and exclusion policies as well as roll back the entire system. This allows for “excellent damage control,” says Meltzer. “The audit trail, for example, gives you a view of who is accessing documents and who is attempting to access them.”
Similar to an end-user assigning rights in a Microsoft Office program, administrators can develop customized templates with predetermined access controls, for use in any RMS-enabled application and for use by the entire organization or specific company departments. “The templates for a legal or finance department are more granular than for customer service,” says Kilcullen.
RMS establishes the trust environment with the publishing and use licenses, and identification and account certificates. After verifying their identity with a NT or an appropriate authentication system, each user on the system obtains an account certificate from the RMS server for their specific computer. Before the user first publishes or views RMS-enabled e-mails or documents, user’s identity must be validated.
A New Layer of Corporate Security
No protection technology is completely secure, and RMS and IRM do not protect against employees reading confidential e-mails over the phone to an unauthorized person or social engineering attacks. The technology can however drastically reduce the chances of unauthorized users’ electronically receiving or viewing private business information.
“The ‘I accidentally viewed this stuff’ has been a great argument all along, but it will no longer work,” says Wagner.
Companies should continue to invest in corporate firewall and security technologies, says Marie Maxwell, Group Product Manager for Windows Rights Management Services. “But at the end of the day, the information worker can be the weakest link by forwarding an e-mail or document to an unauthorized person. RMS addresses that weak link by augmenting existing security technologies with another layer of protection,” she says. With encryption, data privacy remains intact, even if the user finds a way to mail the document
|