NOCTI News

Rights of Passage. COMPUTERWORLD. JULY 04, 2005
http://www.computerworld.com/softwaretopics/erp/story/0,10801,102891,00.html.com

Rights of Passage

Enterprise rights management software ensures that sensitive documents and e-mail can be circulated and don't end up in the wrong hands.
Corning's Scott would rather not automate that process. "We want our users to think about document classification overtly," he says. The more immediate problem, he says, is creating document security "roles and rules," classifications and policies that fit business needs. These must also be consistent with document classifications used in other areas, such as the corporate records information management and content management systems.
"You have to think ahead of time about what are the roles, the groups, and go through the homework of creating policies," says Henry.

That process can take more than a year, adds Scott, but he says it's essential to avoid "classification by exception." For Corning, that process was especially difficult because Scott identified few other companies that could serve as a model. While many have three or four classifications for paper documents, few have addressed electronic documents. "We have not found many leading examples," he says.

Going Outside

Extending the protection of documents outside of the corporate firewall presents a different set of challenges. A user who receives a document must receive authorization from the issuing policy server before it can be opened, so those services must be made accessible from the Internet. Recipients of protected documents must be authenticated when they first open them and may be required to do so each time they view the files, or users may be issued a "lease" that allows access for a specified period.

When National Occupational Competency Testing Institute Inc. (NOCTI) needed to protect Web pages used for securing its online testing services, RMS alone wasn't sufficient. "It could not enforce the rights through a browser for a machine that was not a member of my domain," says Shawn Davis, IT manager. He uses GigaMedia Access Corp.'s GigaTrust product, which is built on top of RMS.

With GigaTrust, clients use a plug-in for Internet Explorer. GigaTrust hosts Microsoft RMS, which issues the encryption keys to unlock requested HTML test pages once registered users log into the testing Web site. Test takers can view and interact with Web pages, but they can't print or cut and paste content.

Because the client PC had to request a new license to retrieve each Web page and then decrypt it, load times were as long as eight seconds. "That was a killer for us," Davis says. After GigaMedia modified its software to allow local caching of the client-access certificate, load times dropped to about two seconds. Half of that time is taken up in decrypting the file, Davis says. The performance is now acceptable.
Dealing with document certificate expirations is another issue. If the defaults aren't set correctly for a given use case, IT managers could end up taking an angry call from the CEO, who could be locked out of files on his laptop when traveling. While NOCTI requires tight controls on lease times, Microsoft's Lumba says his company is more liberal, enabling rights to encrypted e-mail content for a year.

With 15% of NOCTI's customers using online testing, and demand growing at 30% to 40% a year, document security has been a critical part of obtaining new business. "It's been a big deal for us. The fact that we're using this technology has been a primary selling point for our customers," Davis says.

ERM technology is still maturing, says Henry. He describes current users as early adopters and says nascent industry standards aren't yet fully developed. For example, there are no established standards for agent software, encryption, key management or a common rights markup language. That could be a problem for large enterprises if business units end up using different products, he says, and it makes scalability outside of the enterprise more difficult. ERM systems are also expensive and may average $100 to $200 per seat and $1 million or more for enterprisewide deployments.

Nonetheless, ERM works well for "tactical" applications where security needs are high, Henry says. Protection of intellectual property, business-to-business e-mail containing sensitive content such as price lists, or strategic information shared among executives are all good places to start. And he warns that some users, particularly executives, may balk at the technology if it's too complicated.

But that's not a problem with executives at Pretorius' firm. "The enthusiasm for this is very high," he says. RMS has been reliable, Pretorius says, and with Service Pack 1 already out, he thinks there's no reason not to go forward. "I don't think anyone needs to wait," he says.