First, a bit of a caveat. Andrew Jaquith of Forrester is an excellent analyst and someone I know and respect. This is a criticism of a single piece of his research, and nothing more.

Over at the Forrester Security Blog today, Andrew posted a change of policy on their use of two important data security terms. In short, they will now be using the term Data Labeling instead of Enterprise Rights Management:

So, here’s what Forrester will do in our future coverage. The ERM (enterprise rights management) acronym will vanish, except as a “bridge” term to jog memories. In the future, we will practice “truth in labeling” and call this ERM thing data labeling.

Unfortunately, this is a factually incorrect change since data labeling already exists.

I agree with Andrew that ERM is a terrible term – in large part because I’ve covered Enterprise Risk Management, and know there are about a dozen different uses for that acronym. Personally, I refuse to use ERM in this context, and use the term Enterprise DRM (Digital Rights Management). Enterprise Rights Management is a term created to distinguish consumer DRM from enterprise DRM, in no small part because nearly everyone hates consumer DRM.

The problem is that data labeling is also a specific technology with an established definition. One we’ve actively criticized in the past. Andrew refers back to the Orange book:

Here’s what the Orange Book says about data labeling: “Access control labels must be associated with objects. In order to control access to information stored in a computer, according to the rules of a mandatory security policy, it must be possible to mark every object with a label that reliably identifies the object’s sensitivity level (e.g., classification), and/or the modes of access accorded those subjects who may potentially access the object.” Sounds just like what what ERM is doing, no?

No – the difference is under the covers. Data labeling refers to tags or metadata attached to structured or unstructured data to define a classification level. Labels don’t normally include specific handling controls, since those are handled at a layer above the label itself (depends on the implementation).

DRM is the process of encrypting data, then applying usage rights that are embedded in the encrypted object. For example, you encrypt a file and define who can view it, print it, email it, or whatever. Any application with access to decrypt the file is designed to respect and enforce those policies… as opposed to regular encryption, which includes no usage rights, and where anyone with the key can read the file.

This shows the problem with consumer DRM and why it always breaks – in an enterprise we have more control over locking down the operating environment. In the consumer world, the protected file is always in a hostile environment. Since you have to have the key to decrypt the file, the key and the data are both potentially exposed.

Labeling and DRM may work together, but are distinct technologies. You can label an individual record/row in a database, but you can’t apply DRM rights to it (I suppose you could, but it’s completely impractical and there isn’t a single tool on the market for it). You can apply DRM rights to a file without ever applying a classification level.

I asked Andrew about this over Twitter, and our conversation went like this (Andrew’s post is first):

@rmogull Really? Do you think “ERM” is actually a useful name for that category? Want to discuss alternatives?

@arj I use “Enterprise DRM” I also hate ERM and refuse to use it.

@rmogull Makes sense. Want to send me an e-mail (or do a blog post) critiquing the post? I’m a pretty good sport.

I think we are on the same page now, and thank Andrew for bringing this up, and being willing to take some gentle lumps.

Share: