Burton Group Identity Blog

The challenge in fixing Facebook’s underlying privacy problems

Blogger: Ian Glazer

A few Facebook hacks came across my desk this week. The first set are so called "rogue" applications which do the tediously predictable grab of user information followed by the equally tediously predictable spam-a-palooza. Calling such applications "rogue" is misleading. These didn't start out okay and turn evil somewhere along the way. These apps were built to cause trouble - they are malware. Facebook has a healthy set of malware apps and the number is growing every day. You can easily spot effected Facebook users by their status messages - "Sorry for the email - my Facebook got a virus."

The second hack is of a far more interesting class. Ronen Zilberman, a security researcher, harnessed features of the Facebook platform to unwittingly perform a man-in-the-middle attack on itself. Zilberman documents how the attack works in very clear language. You can even see a video of the attack in action. Why is this a more interesting class of attack on Facebook? First, it doesn't require an application to be added to the victim's Facebook profile. Second and more importantly, this attack fundamentally turns Facebook's goals against itself.

Facebook's mission is to "give people the power to share and make the world more open and connected." Its business is to accomplish this mission before someone else does. This requires that Facebook provide a means to connect as many people, websites and services as possible and as fast as possible. And in the course of this social networking land-grab, it is not surprising that we have seen both Facebook malware and the Facebook's platform being used to support anti-social behavior. The Facebook platform is optimized to provide frictionless connections and sharing of information. But as exploits for ill-purposes increase, Facebook has to act and act in a manner counter to their mission.

Facebook is currently trying to tackle some of its privacy issues with new privacy settings. The changes to the Privacy Settings are in beta, expected to rollout system-wide shortly. I sincerely hope that Facebook simplifies the privacy settings interface while adding more granular controls - though I am not too hopeful this will happen. Furthermore, I am very curious to see if changes in privacy settings will improve the situation I discovered with Privacy Mirror - again, not too hopeful. But changes in privacy settings are just patches on the underlying problem: increased privacy controls and platform restrictiveness are antithetical to Facebook's mission. Until Facebook institutes more control within its platform, we will continue to see more malware and more "interesting" attacks.

In order to achieve its mission, Facebook has to prove that it is a safe space in which its customers can engage in social behaviors. To accomplish this, Facebook must recognize the fact that its users have relationships with each other and that Facebook itself has a relationship with each of its users. These relationships are governed by social norms and are not dictated but negotiated through countless social interactions. These relationships and the rules governing them must be respected in order for Facebook to prove that it is a safe place to make shared information public and keep private information private.

“Role” World Challenges

Blogger: Kevin Kampman

On Wednesday afternoon at Catalyst, we closed the Identity Management, Role and Entitlement discussion with a panel consisting of enterprise practitioners Robert Amos of NuStar Energy, Paul Rarey of Safeway, and David Laurance of JPMorgan Chase. Also on the panel were Edward Coyne of SAIC, representing both the Veterans Administration and the INCITS CS1.1 committee responsible for Role Based Access Control (RBAC), and Alan O’Connor, Research Economist with RTI International.

The purpose of the panel was to discuss the challenges and opportunities facing Role Management as a discipline, and how industry can influence continuing efforts in the RBAC standards community. In particular, Alan O’Conner was at Catalyst to learn more about enterprise experiences with roles, in order to advise the National Institute for Standards and Technology (NIST) about areas for future investment.

There were several major observations from the panel. First of all, there was agreement that roles are a business challenge, but as Paul Rarey observed, “talking to the business about roles is a non-starter.” Instead, the conversation needs to focus on business value. Robert Amos cited success in convincing the business to take ownership of roles, however the proper infrastructure must be provided to manage the relationship of roles to resources.

Another challenge is in understanding what roles are about. David Laurance identified that there were seven applications of roles discussed during the afternoon:

1. To identify expertise
2. To manage job assignments
3. For authorization
4. To abstract identities from entitlements
5. To enforce policies such as separation of duties
6. To enable provisioning, and 
7. To establish accountability.

NIST and INCITS are interested in addressing implementation issues in organizations; this list represents a good starting point for future activity. It is not just the integration of attributes into applications that needs to be addressed, but guidance for organizations that want to characterize what people do in a meaningful context. 

David contributed three challenges for role management:

• Definition
• Analysis and interpretation, and
• Assignment to individuals.

During the afternoon, Robert and Paul provided excellent case studies about how their organizations successfully accomplished these, and admitted that their efforts are ongoing and would benefit from more consistent processes, procedures, and more effective role management applications. Alan observed that NIST needs these recommendations from industry in order to provide direction to their committees, and both Ed and Alan are soliciting participation of this nature.

Organizations wishing to provide input to RTI’s NIST survey can contact Alan O’Connor (oconnor@rti.org). Those interested in investigating revisions to the RBAC standard (INCITS 359-2004) can get more information about participation by contacting Ed Coyne (ed.coyne@va.gov) or Rick Kuhn (kuhn@nist.gov).