Subject: RE: Employee Certificates - Security Issues

From: "Guida, Richard [JJCUS]" <[email-masked]>
Date: Sun, 6 Oct 2002 08:36:49 -0400

Anders - this topic is not conducive to a full description in this thread,
too complicated and too easy to misinterpret.  So I have to give you a
simple and noncomplete answer: employees are trusted to use their electronic
credentials as they are trusted to use other credentials issued them by the
company.  If I took my company picture ID and used it at a local merchant as
proof of who I am for writing a check, AND the merchant accepted that ID, is
the company liable if the ID were forged or if I just left the company and
"forgot" to turn it in (and the company failed to demand it be surrendered)?
Same issue with certificates - if the relying party wants to rely on a
certificate: (a) without checking a CRL; and (b) without checking the
Certificate Policy (our CP explicitly says the certs can only be used for
J&J business and only establish identity, do not established authorization
to perform an act), then the relying party is incurring the risk.  And the
employee who is improperly using the credential is subject to disciplinary
action (or if a former employee, subject potentially to charges of fraud).
Now I realize in the litigious U.S. the "deep pockets" theory often results
in large corporations being hit with liability (responsibility) that they
don't deserve, but thankfully that is not true in much of the rest of the
world.

As for security officers taking the approach of "we don't trust anyone,"
that is a bit simplistic.  I proceed from the premise that the vast majority
of employees want to do the right thing but may get confused or may not know
what "the right thing" is, so training and awareness are paramount.  For
those few who are miscreants, you have to have in place an approach with
overchecks and safeguards to catch them before they can do much damage.  But
to proceed from the premise that every employee, given the opportunity, will
do something evil against his/her company is a scary proposition.  I would
not want to work for a company where management holds that view - and I do
not.

Authorization determinations are indeed handled "out of band," and hopefully
at some point we will employ SAML-based technology for that purpose.
Authorization is (as you and others have commented) an immensely complex
topic, especially given legacy systems and the fact that operating units
(correctly) demand autonomy in making such decisions regarding access to
their own applications.  Authentication, by contrast, is far more
straightforward.

Best regards -- Rich

Richard A. Guida
Director, Information Security (Medical Devices and Diagnostics)

Johnson & Johnson
One J&J Plaza, Room WH6132
New Brunswick, New Jersey  08933

E-mail: [email-masked]
Office:  732 524 3785

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Saturday, October 05, 2002 2:09 PM
To: Guida, Richard [JJCUS]; [email-masked]
Subject: Re: Employee Certificates - Security Issues

Richard,

It would be very interesting to know how J&J handles archiving
and authorization, as the conclusion from your answers seems
to be, "we trust all our employees for doing the right thing",
which BTW is in strong contrast to what security officers in
general say.  Not to mention bosses. :-)

In particular, how is authorization with respect to _external_
parties handled?  Based on out-of-band arrangements?

Although workable, I believe this is a very inefficient way to
perform "e-business", whatever the "business" is.

Anders

----- Original Message -----
From: Guida, Richard [JJCUS]
To: Anders Rundgren ; [email-masked]
Sent: Friday, October 04, 2002 21:30
Subject: RE: Employee Certificates - Security Issues

Anders - I don't think I misunderstood.  Your last e-mail makes the point
very well - you say that a company PKI is as bad as giving
employees company credit cards.  Well - I had a government credit card when
I worked for the USGovernment (as did almost everyone
else - at least those who traveled which was almost everyone, very few
exceptions), and I have one from my current employer as well
(again the majority of employees do).  Same is true for every company which
I know through professional affiliation.  So I agree
with the implication of your logic - we should do with certs for employees
the same as companies have done with credit cards for
employees.  That makes my case better than anything.  Thanks -- Rich

Richard A. Guida
Director, Information Securityu (Medical Devices and Diagnostics)
Johnson & Johnson
One J&J Plaza, Room WH6132
New Brunswick, New Jersey  08933
E-mail: [email-masked]
Office:  732 524 3785

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Friday, October 04, 2002 12:24 PM
To: [email-masked]; Guida, Richard [JJCUS]
Subject: Re: Employee Certificates - Security Issues

Richard,
I think you have mostly misinterpreted my messages.
Employee-PKI means (I do at least), that the employee has a certificate
that allows him/her to act on behalf on their employer.  This is
a fundamental characteristic of the US Federal PKI and commercial
efforts like Identrus.
What I'm saying is that this opens the organization to massive
and non-controllable attacks from disloyal employees etc.  It is a
smart as giving the entire work-force company credit-cards.
Regarding the market, it is interesting to note that there is not a
business system maker of any significance that support a model
where the client's certificate and signature is a part of _outgoing_
messages.  In the same way as there is not a single bank in the
world that does this either.  And this fact is completely independent
of the availability of client-side PKI.
Note: Client-side PKI is absolutely not a bad idea, it is
the idea to hand over specific "company keys" to employees
that is not such a terribly good idea.
Anders

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 6 Oct 2002 16:00:16 +0200

Thanx Richard,

Note though that by using the Internet-bank model you can

- completely offload business parties from reading CPs
- give bosses and security officers the tools needed to monitor
   and control employees' external activities (regardless if they
   feel they need it or not)
- get automatic archiving
- essentially never have to transfer authorization data out-of-band
  as the Internet-bank model is an on-line system in contrast to the
  employee-PKIs' off-line paradigm
- deploy authorization schemes ranging from  the very basic which
  is the organization (rather than an employee), to sophisticated schemes
  using external authorities vouching for this and that
- easily add SAML for extranet authentication
- be compatible with coming e-business systems
- be able to efficiently manage a multitude of electronic business parties,
  long-term reducing costs
- increase "precision" and "trust" in your organizations' dealings with
  external parties

You current PKI would still operate and be worth preserving but would
never (when fully adapted), be the outermost (most authoritative) system
as the bank-model requires an organizational stamp in order to produce
an externally valid operation.

Also worth nothing is that this can be implemented now using existing
standard-technology, unlike end-to-end client-based PKI schemes
that today offers zero support for on-line authorization.  I cannot see
that it is even technically possible to obtain this functionality in
a client-based end-to-end PKI.

That this cannot happen overnight is for sure, but one can start
thinking about it at least.  Do some pilots etc.

cheers,
Anders

----- Original Message -----
From: Guida, Richard [JJCUS]
To: Anders Rundgren ; [email-masked]
Sent: Sunday, October 06, 2002 14:36
Subject: RE: Employee Certificates - Security Issues

Anders - this topic is not conducive to a full description in this thread, too complicated and too easy to misinterpret.  So I have
to give you a simple and noncomplete answer: employees are trusted to use their electronic credentials as they are trusted to use
other credentials issued them by the company.  If I took my company picture ID and used it at a local merchant as proof of who I am
for writing a check, AND the merchant accepted that ID, is the company liable if the ID were forged or if I just left the company
and "forgot" to turn it in (and the company failed to demand it be surrendered)?  Same issue with certificates - if the relying
party wants to rely on a certificate: (a) without checking a CRL; and (b) without checking the Certificate Policy (our CP explicitly
says the certs can only be used for J&J business and only establish identity, do not established authorization to perform an act),
then the relying party is incurring the risk.  And the employee who is improperly using the credential is subject to disciplinary
action (or if a former employee, subject potentially to charges of fraud).  Now I realize in the litigious U.S. the "deep pockets"
theory often results in large corporations being hit with liability (responsibility) that they don't deserve, but thankfully that is
not true in much of the rest of the world.
As for security officers taking the approach of "we don't trust anyone," that is a bit simplistic.  I proceed from the premise that
the vast majority of employees want to do the right thing but may get confused or may not know what "the right thing" is, so
training and awareness are paramount.  For those few who are miscreants, you have to have in place an approach with overchecks and
safeguards to catch them before they can do much damage.  But to proceed from the premise that every employee, given the
opportunity, will do something evil against his/her company is a scary proposition.  I would not want to work for a company where
management holds that view - and I do not.
Authorization determinations are indeed handled "out of band," and hopefully at some point we will employ SAML-based technology for
that purpose.  Authorization is (as you and others have commented) an immensely complex topic, especially given legacy systems and
the fact that operating units (correctly) demand autonomy in making such decisions regarding access to their own applications.
Authentication, by contrast, is far more straightforward.
Best regards -- Rich

Richard A. Guida

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Saturday, October 05, 2002 2:09 PM
To: Guida, Richard [JJCUS]; [email-masked]
Subject: Re: Employee Certificates - Security Issues

Richard,
----- Original Message -----
From: Guida, Richard [JJCUS]
To: Anders Rundgren ; [email-masked]
Sent: Friday, October 04, 2002 21:30
Subject: RE: Employee Certificates - Security Issues

Anders - I don't think I misunderstood.  Your last e-mail makes the point very well - you say that a company PKI is as bad as giving
employees company credit cards.  Well - I had a government credit card when I worked for the USGovernment (as did almost everyone
else - at least those who traveled which was almost everyone, very few exceptions), and I have one from my current employer as well
(again the majority of employees do).  Same is true for every company which I know through professional affiliation.  So I agree
with the implication of your logic - we should do with certs for employees the same as companies have done with credit cards for
employees.  That makes my case better than anything.  Thanks -- Rich

Richard A. Guida

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Friday, October 04, 2002 12:24 PM
To: [email-masked]; Guida, Richard [JJCUS]
Subject: Re: Employee Certificates - Security Issues

Richard,