CyberSecurity Institute

Enterprise Rights Management (ERM) is an umbrella term for products that mix elements of intellectual property protection with document control.

Unlike digital rights management technologies that strive to manage consumer use of published media, ERM focuses on business documents and data, seeking to control their creation, use and distribution. Rights management systems typically rely on servers operating in the background performing such functions as applying policies to content, authenticating users and granting rights. Rights management vendors and products have differing approaches and architectures.

In a nutshell, rights products can:
– Encrypt content;
– Assure that only the intended recipient can open the content;
– Control the recipient’s ability to copy, print, forward, alter or otherwise tamper with the information;
– Revoke access rights or expire the content itself to prevent further access; and
– Log all of the above to an audit trail.

Rights management vendors and products have differing approaches and architectures. SealedMedia, for example, works on the premise that content sent to external users gets returned to the sender once the sharing process is done. Liquid Machines sees rights management as enabling collaboration among trusted parties and focuses on usability — the idea that policy application and consequent document access should be as unobtrusive to processes as possible.

Some products — usually those that require server connectivity — allow rights to be changed even after the recipient has accessed the content.

Rights management shouldn’t be confused with records management. Although access rights to content can be expired using a rights management system, the content itself isn’t always destroyed, as it can be by a records management system. Losing the encryption key on a rights-protected document, for example, disables the recipient’s access to it, but the document itself may stay on the recipient’s drive.

Vendors such as PSS Systems offer a records management foundation and concentrate on applying company policy to internal documents so they can be controlled from creation to disposition, regardless of where they reside.

The Plan:
– Define the risks;
-Determine what content is worth protecting;
-Identify levels of trust and appropriate controls;
-Prescribe appropriate security for the content and the situation;
-Determine what assurance must be provided that content reaches only the intended recipient(s);
-Determine what should happen when content should no longer be shared; and
-Describe who has the authority to apply policies and what happens if policies conflict.

http://www.securitypipeline.com/49400427

The National Highway Traffic Safety Administration, part of the U.S. Department of Transportation, will give Digimarc a $1 million grant to collaborate on the study with states.The program will examine the possibility of creating licenses with embedded digital watermarks that can be read by machines operated by police officers, retailers and other people.

“Part of the value is that this shows good cooperation between federal and state governments, a number of which are already deploying the technology,” said Reed Stager, a Digimarc vice president. “This can be used to increase highway safety; it can reduce underage drinking…and also has potential to help reduce ID theft and fraud.”

Although driver’s licenses are ordinarily overseen by each state, the federal government is exploring ways to make such identification more secure, as part of an effort to improve highway safety and reduce counterfeiting. The federal drive for more secure ID has also been given impetus by concerns about homeland security. Many state driver’s licenses already have magnetic strips containing data, such as age, about their holders. This technology is built to commonly available specifications and is relatively easy to counterfeit, however.

Digimarc says its “covert watermarking” technology would provide an additional layer of security, since it would be harder to mimic. The Beaverton, Ore.-based company said it plans to use the $1 million grant to help fund state implementations of the watermarking technology, as well as to help establishments such as state-owned liquor stores to purchase card readers.

The pilot program is expected to be completed in late 2005, the company said.

http://news.zdnet.com/2100-1009_22-5390619.html?tag=default