June 23, 2008, 11:05 AM — The Liberty Alliance has released the first versions of two key frameworks for how businesses can share and protect sensitive data in their networks.
The Liberty Alliance, a coalition of businesses and other organizations, has worked to develop protocols and policies for federated identity and Web services, which have the potential for new efficiencies in data handling but come with many risks if data is lost or mishandled.
Now that the technical infrastructure and protocols used for identity management is fairly mature, the policies and rules around identity management need to be easier for businesses to understand, said Roger Sullivan, president of Liberty's management board and vice president for Oracle's identity management group.
One of Liberty's new frameworks helps organizations set policies around certain types of data in order to be compliant with legislation such as the European Data Protection Initiative and Sarbanes-Oxley.
The Identity Governance Framework (IGF) is an XML (Extensible Markup Language) schema that lets organizations set rules for specific types of data, Sullivan said. For example, the schema can be modified to tell a particular application to erase a certain type of personal data after 24 hours if it is no longer needed.
The schema can also define the rules under which one application is allowed to access information in another, or under what circumstances the information can be shared, Sullivan said. If data is lost, the schema can be set so the application displays a warning message of what to do and who to call.
Liberty also released the Identity Assurance Framework (IAF), a program by which businesses can get certified that they are qualified to handle data at varying levels of sensitivity.
The framework has four "assurance" levels, Sullivan said. The idea is that an external consultant can certify a business as complying with the framework at a certain level. The certification will act as a confidence-builder for another business that wants to enter into an arrangement where the two exchange data.
One of the highest concerns businesses have regarding sharing data is whether their systems implement controls to safeguard it against theft or loss, as both cause high-profile attention and potential reputation damage.
The framework's first level starts with relatively simple data handling, such as anonymous registration at a Web site, and goes through a fourth level, which could involve pharmaceutical drug shipments or high-value bank wire transfers, Sullivan said. To be certified, a business's IT security would be tested to ensure it's capable of protecting information.
