Subject: RE: Employee Certificates - Security Issues

From: "Guida, Richard [JJCUS]" <[email-masked]>
Date: Fri, 4 Oct 2002 15:30:02 -0400

Anders - I don't think I misunderstood.  Your last e-mail makes the point
very well - you say that a company PKI is as bad as giving employees company
credit cards.  Well - I had a government credit card when I worked for the
USGovernment (as did almost everyone else - at least those who traveled
which was almost everyone, very few exceptions), and I have one from my
current employer as well (again the majority of employees do).  Same is true
for every company which I know through professional affiliation.  So I agree
with the implication of your logic - we should do with certs for employees
the same as companies have done with credit cards for employees.  That makes
my case better than anything.  Thanks -- Rich

Richard A. Guida
Director, Information Security (Medical Devices and Diagnostics)

Johnson & Johnson
One J&J Plaza, Room WH6132
New Brunswick, New Jersey  08933

E-mail: [email-masked]
Office:  732 524 3785

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Friday, October 04, 2002 12:24 PM
To: [email-masked]; Guida, Richard [JJCUS]
Subject: Re: Employee Certificates - Security Issues

Richard,
I think you have mostly misinterpreted my messages.

Employee-PKI means (I do at least), that the employee has a certificate
that allows him/her to act on behalf on their employer.  This is
a fundamental characteristic of the US Federal PKI and commercial
efforts like Identrus.

What I'm saying is that this opens the organization to massive
and non-controllable attacks from disloyal employees etc.  It is a
smart as giving the entire work-force company credit-cards.  

Regarding the market, it is interesting to note that there is not a
business system maker of any significance that support a model
where the client's certificate and signature is a part of _outgoing_
messages.  In the same way as there is not a single bank in the
world that does this either.  And this fact is completely independent
of the availability of client-side PKI.

Note: Client-side PKI is absolutely not a bad idea, it is
the idea to hand over specific "company keys" to employees
that is not such a terribly good idea.

Anders

---

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 5 Oct 2002 20:09:13 +0200

Richard,

It would be very interesting to know how J&J handles archiving
and authorization, as the conclusion from your answers seems
to be, "we trust all our employees for doing the right thing",
which BTW is in strong contrast to what security officers in
general say.  Not to mention bosses. :-)

In particular, how is authorization with respect to _external_
parties handled?  Based on out-of-band arrangements?

Although workable, I believe this is a very inefficient way to
perform "e-business", whatever the "business" is.

Anders

----- Original Message -----
From: Guida, Richard [JJCUS]
To: Anders Rundgren ; [email-masked]
Sent: Friday, October 04, 2002 21:30
Subject: RE: Employee Certificates - Security Issues

Anders - I don't think I misunderstood.  Your last e-mail makes the point very well - you say that a company PKI is as bad as giving
employees company credit cards.  Well - I had a government credit card when I worked for the USGovernment (as did almost everyone
else - at least those who traveled which was almost everyone, very few exceptions), and I have one from my current employer as well
(again the majority of employees do).  Same is true for every company which I know through professional affiliation.  So I agree
with the implication of your logic - we should do with certs for employees the same as companies have done with credit cards for
employees.  That makes my case better than anything.  Thanks -- Rich

Richard A. Guida
Director, Information Securityu (Medical Devices and Diagnostics)
Johnson & Johnson
One J&J Plaza, Room WH6132
New Brunswick, New Jersey  08933
E-mail: [email-masked]
Office:  732 524 3785

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Friday, October 04, 2002 12:24 PM
To: [email-masked]; Guida, Richard [JJCUS]
Subject: Re: Employee Certificates - Security Issues

Richard,