News, views, and other informal discussions about Adobe Systems Information Assurance initiatives that protect information by ensuring their authenticity, integrity, confidentiality/privacy, and non-repudiation. Digital Rights Management (DRM), Information Rights Management (IRM), digital signatures, Public Key Infrastructure (PKI), and identity management will be discussed frequently for Adobe applications and file formats.
Following on the heels of a number of successfulcustomerdeployments, Adobe is proud to welcome another respected organization to the CDS Program. Entrust announced today they have joined the CDS Program and will begin offering certificates under its auspices in early 2009. This will bring to five the number of CAs in the program, along with ChosenSecurity, GlobalSign, Keynectis, and VeriSign.
CDS makes creating and receiving authentic documents easier by not requiring a recipient to explicitly trust the author of the document. CDS signatures automatically validate in Adobe Acrobat or Adobe Reader 6.0 and above, providing integrity and long-term assurance to electronic documents of record. Providers involved in the CDS Program are required to meet stringent requirements for identity vetting, security, and operations.
According to Entrust’s President and CEO Bill Conner:
While electronic documents are an efficient method to do business, until recently they lacked the security necessary to be accepted for official enterprise use. With the advent of this standard and the specialized certificates, organizations can be confident that electronic documents are authentic and have not been tampered with or altered.
Since its induction into the Adobe Certified Document Services (CDS) Program, GlobalSign has been very busy working to build a customer base eager to leverage the native trust and assurance that CDS brings to any recipient opening a CDS digitally signed PDF document in Adobe Acrobat or Reader 6.0 and above. That work has paid off in three separate customer announcements this year, including one just released today:
December 8, 2008: In partnership with Adobe and SafeNet, GlobalSign today announced the success of the Antwerp Port Authority project. This port is the second largest in Europe and the fourth largest in the world. Looking to save time and money by eliminating paper invoices, and required by law to provide for the integrity and authenticity of the resulting electronic invoices for value-added taxes (VAT), the Port of Antwerp deployed a solution combining:
LiveCycle ES document generation and digital signature servers;
SafeNet hardware security modules (HSMs) to protect the signing keys themselves.
“We’ve seen a marked increase in the number of projects across the whole of Europe in recent months as the worldwide economic climate causes enterprises both large and small to re-evaluate their invoicing processes to drive down costs and remain competitive. DocumentSign is not only a cost effective and easy solution for businesses to use, but is also compliant with European e-VAT legislation.” -Steve Roylance, Business Development Director, GlobalSign.
May 2008: At the annual National Notary Association conference, GlobalSign announced the positive results of a pilot undertaken with the UK Notaries Society in which the cost efficiency and legal admissibility of eNotarization performed with GlobalSign CDS credentials was well-documented.
May 2008: Bodycote, a leading provider of testing and thermal processing services, announced that it had selected GlobalSign’s DocumentSign program, based on CDS credentials, to certify its test data and reports. With this solution Bodycote can provide results to its clients in PDF form, confident in the both the accuracy and integrity of the data contained within.
“DocumentSign services our security requirements but is also instantly deployable and very scalable – essential factors for rolling out a solution that can be easily understood by every person in the reliance chain. For our clients’ customers, they simply open the test results in [R]eader.” -
Alan Slater, Head of IS & IT Architecture, Bodycote
We’re always pleased to see our partners taking advantage of key, integrated capabilities of our products to better serve our joint customers’ needs. Yesterday, ARX (Algorithmic Research) announced that its CoSign product now supports the Adobe Signature Service Protocol (ASSP), built into Adobe Acrobat and Adobe Reader version 8.0 and above.
CoSign is a hardened, plug-and-play appliance that allows organizations to easily set up a centralized repository of digital IDs. These credentials are securely stored on the appliance, eliminating the need for users to carry hardware tokens, which can add to the cost of a digital certificate (PKI) rollout. The user simply authenticates to the server to access their credentials.
Prior to this announcement, ARX required users to install a small client to provide signing capabilities in Adobe products. Now, with ARX’s ASSP support, users can set up Acrobat and Reader to access their centralized (roaming) credentials in CoSign for digital signatures without any additional software. The ASSP protocol provides users with the ability to choose a roaming credential, specify an ASSP-capable server, and then, after clicking on a signature field, simply enter the appropriate authentication information to access their credential. ASSP handles the behind the scenes communication between client and server, passing the hash (fingerprint of the document) up to the server for signature and then returning it to the client to be embedded back into the document.
Here’s a brief demo of how the system works…note that I’m using a test credential here.
With today’s announcement, ARX joins our other security partner Arcot in featuring support for the ASSP protocol. This protocol is just the latest step in Adobe’s strategy to make electronic signature workflows easier and more productive.
As we’ve mentioned in earlier posts on this blog, LiveCycle Rights Management ES has a growing set of integrations with 3D CAD/CAM packages. Today we have integrations in the market to provide for rights management IP protection in native Pro/ENGINEER, CATIA, and XVL files.
Adobe recently hosted a joint webcast with PTC to showcase how customers can improve design collaboration while reducing risk using Pro/ENGINEER and LiveCycle Rights Management. In today’s global manufacturing marketplace, survival depends on fast time-to-market. Spreading the design process across the supply chain continues to increase design complexity as customers demand better products, quickly. The key is better collaboration, but as companies try to deliver better information, earlier in the process, to a broader audience, the risk of intellectual property (IP) loss goes up dramatically. Survey after survey has shown that protection of design information is at the top of the list for most engineering organizations. Companies that learn to balance improved collaboration with the risk of IP loss will be the winners moving forward.
Included in these case studies, Adobe customers will describe how electronic signature solutions involving products from Adobe and our Security Partner Community have improved their internal workflows and, in turn, saved them significant amounts of money, time, and resources. You can expect to hear from:
In addition, conference attendees will learn about government and insurance industry views on e-signatures; legal, regulatory & standards updates; and finally how the new administration might affect the future of e-signature policy. For an updated agenda, keep checking here.
Partners are critical to everything we do in the security space, and we are very proud of the best-of-breed Community we have fostered in order to best create solutions based on Adobe’s capabilities and customized to each customer’s needs.
With that in mind, we’re always extremely pleased to see cooperation among our many security partners so that they can also mutually leverage their capabilities which in the end is all the better for our own customers.
And ARX, Inc., a security partner offering a convenient , virtually plug-and-play CA and signing appliance, CoSign, announced relationships (here and here) with two of our Certificate Authority partners, GlobalSign and ChosenSecurity,to provide more complete and easy-to-deploy solutions around these two companies’ digital ID offerings.
So, how do these new relationships benefit Adobe’s customers? CIC’s relationship with 4Point means that customers deploying LiveCycle will have more electronic signature options on the table. With ARX, customers looking to speed workflows with digital signatures can deploy the ARX CoSign product, centrally storing user signing credentials from GlobalSign or Chosen Security, both leading certificate authorities in their own right.
This entry is part of our continuing educational series, “What is an Electronic Signature, Anyway?” (Parts 1, 2 and 3.)
In June, at an event at the National Press Club, Jerry Buckley, Founding Partner at the Buckley Kolar law firm in Washington DC, as well as Counsel to the Electronic Signatures and Records Association (ESRA), an organization devoted to promulgating the use of electronic signatures & documents and educating the public & industry on those matters, stated that the “train had left the station” when it came to electronic signature usage around the world. As the demand for more fully electronic workflows becomes more pronounced, especially given the meteoric rise in gas, and thus shipping, prices, as well as an increasing desire on the part of enterprises and organizations to ‘go green,’ electronic signatures will become even more ubiquitous.
In early 2008 PTC shipped Pro/ENGINEER Wildfire 4, their integrated solution for 3D CAD/CAM. As announced in our relationship last year, PTC and Adobe have worked together to integrate Adobe LiveCycle Rights Management ES directly into Pro/ENGINEER, providing native CAD document protection. Sold as the Pro/ENGINEER Rights Management Extension, this solution exclusively works with Adobe LiveCycle Rights Management ES, allowing designers to provide persistent and dynamic access control to Pro/ENGINEER part, assembly, and drawing files.
Adobe’s latest release of the LiveCycle Rights Management — ES Update 1 — provides additional functionality for Pro/ENGINEER customers wishing to manage and track iterated versions of protected parts and assemblies. These extensions enable designers to ensure that suppliers are instantly updated to the latest version of a design, decreasing the pain of mismatched versions when designing products sourced from multiple organizations.
Click on the following screenshot of Pro/ENGINEER for a brief tour of the functionality:
Two weeks ago, Adobe held its annual 2008 Security Partner Summit. The Summit is designed to offer partners the chance to see where our products are headed, to learn how they can best leverage the security capabilities in those products, and, most importantly, to interact directly with our product management & engineering teams to affect the future course of our products. The Summit also provides Adobe with a great opportunity to listen to what our partners are hearing from their customers and how the changes we make in our products impact their business.
Partners in attendance were able to gaze into the future of both Adobe Acrobat and LiveCycle ES. They also heard the latest on Adobe’s…
thought leadership on electronic signatures;
EMEA partner strategy and unique regional requirements; and
Rights management capabilities and partnering opportunities.
For Adobe, partners are absolutely essential when it comes to matters of security as we define it: electronic / digital signatures, authentication, and rights management / encryption. Our philosophy is to build robust capabilities into our own products and then adapt to particular customer needs through the careful selection of partners who can bring these solutions into being. Whether it’s a handwritten electronic signature required to open an account at a bank branch office, single sign-on authentication into a LiveCycle administration portal, or certifying the US Federal Budget, our Security Partner Community is part and parcel of our ability to deliver powerful, compelling security solutions to clients the world over.
If you are a developer or systems integrator working with Adobe products and focusing on security, you owe it to yourself and your customers to join Adobe’s Solution Partner Program and Adobe’s Security Partner Community (SPC) . As a member of these two programs you’ll get access to a wide variety of benefits, including invitations to the annual Security Partner Summit & our MAX Conference.
If you’re already a member of our Solution Partner Program, but haven’t yet reached out to the SPC, what are you waiting for? Adobe’s next Security Partner Summit is scheduled for 5-6 May 2009…we look forward to seeing you there!
And oh…about my speech relating security to my vacation in the Bahamas? Well, you had to be there.