Login  |  Register  |  Contact

Sorry, Data Labeling is *Not* the Same as DRM/ERM

First, a bit of a caveat. Andrew Jaquith of Forrester is an excellent analyst and someone I know and respect. This is a criticism of a single piece of his research, and nothing more.

Over at the Forrester Security Blog today, Andrew posted a change of policy on their use of two important data security terms. In short, they will now be using the term Data Labeling instead of Enterprise Rights Management:

So, here’s what Forrester will do in our future coverage. The ERM (enterprise rights management) acronym will vanish, except as a “bridge” term to jog memories. In the future, we will practice “truth in labeling” and call this ERM thing data labeling.

Unfortunately, this is a factually incorrect change since data labeling already exists.

I agree with Andrew that ERM is a terrible term – in large part because I’ve covered Enterprise Risk Management, and know there are about a dozen different uses for that acronym. Personally, I refuse to use ERM in this context, and use the term Enterprise DRM (Digital Rights Management). Enterprise Rights Management is a term created to distinguish consumer DRM from enterprise DRM, in no small part because nearly everyone hates consumer DRM.

The problem is that data labeling is also a specific technology with an established definition. One we’ve actively criticized in the past. Andrew refers back to the Orange book:

Here’s what the Orange Book says about data labeling: “Access control labels must be associated with objects. In order to control access to information stored in a computer, according to the rules of a mandatory security policy, it must be possible to mark every object with a label that reliably identifies the object’s sensitivity level (e.g., classification), and/or the modes of access accorded those subjects who may potentially access the object.” Sounds just like what what ERM is doing, no?

No – the difference is under the covers. Data labeling refers to tags or metadata attached to structured or unstructured data to define a classification level. Labels don’t normally include specific handling controls, since those are handled at a layer above the label itself (depends on the implementation).

DRM is the process of encrypting data, then applying usage rights that are embedded in the encrypted object. For example, you encrypt a file and define who can view it, print it, email it, or whatever. Any application with access to decrypt the file is designed to respect and enforce those policies… as opposed to regular encryption, which includes no usage rights, and where anyone with the key can read the file.

This shows the problem with consumer DRM and why it always breaks – in an enterprise we have more control over locking down the operating environment. In the consumer world, the protected file is always in a hostile environment. Since you have to have the key to decrypt the file, the key and the data are both potentially exposed.

Labeling and DRM may work together, but are distinct technologies. You can label an individual record/row in a database, but you can’t apply DRM rights to it (I suppose you could, but it’s completely impractical and there isn’t a single tool on the market for it). You can apply DRM rights to a file without ever applying a classification level.

I asked Andrew about this over Twitter, and our conversation went like this (Andrew’s post is first):

@rmogull Really? Do you think “ERM” is actually a useful name for that category? Want to discuss alternatives?

@arj I use “Enterprise DRM” I also hate ERM and refuse to use it.

@rmogull Makes sense. Want to send me an e-mail (or do a blog post) critiquing the post? I’m a pretty good sport.

I think we are on the same page now, and thank Andrew for bringing this up, and being willing to take some gentle lumps.

—Rich

No Related Posts
Previous entry: Friday Summary - July 24, 2009 | | Next entry: The Securosis Intern and Contributing Analyst Programs

Comments:

If you like to leave comments, and aren't a spammer, register for the site and email us at info@securosis.com and we'll turn off moderation for your account.

By Adrian Lane  on  08/01  at  05:41 PM

Over the last couple of days I have been referred to a couple of comments on other blogs discussing this topic. I am kind of shocked by the lack of understanding between DRM/ERM and Labeling.  As someone who spent several years architecting, designing and implementing a Digital Rights Management platform, and more recently designing and prototyping data discovery and labeling technologies, I can attest that Rich is exactly right in his analysis.  From experience I can tell you that the two concepts being discussed, and the associated technical implementations, are _very_ different things.  They work differently, are based upon different models, and they solve different problems. There is simply no doubt here. I can see some getting confused at how DRM and DLP differ, but the differences between labeling and DRM should be clear and distinct!  I will go so far as to argue that if your DRM technology has anything resembling labels, your design process failed. 

DRM/ERM terms have been in use for at least 15 years, intermingling the two seriously confuses the issue.

Name:

Email:

Remember my personal information

Notify me of follow-up comments?