InfoPath Dev

Hi all,
in my company there're some doubts concerning security digital certificate. Here's the question: the possibility that an user can digitally sign a templete with a digital certificate (obtained by company's CA) in order to make it full trust is seen as a security failure, becouse he has the opportunity to access the machine for malicous purpose after, for example, being fired. So what do you suggest to solve the question?
Sigh the templete with a service account?
Can I sign a templete with a certificate requested by another user?
What do you usually do in your environment?

Thank u so much for your advices :)

The biggest problem sounds like the opportunity for someone to access a machine for a malicious purpose. No one should have this opportunity...

Can you not protect yourself from fired employees? I think this would be a pretty big problem.

---------------
Matt Faus
InfoPath Dev Texas

InfoPath just follows the same codesigning methodology and security model as signing any ActiveX control, EXE, CAB etc. So this discussion applies equally to both and the considerations for codesigning ActiveX, EXE, CAB, etc. apply equally to signing InfoPath XSN templates.

You are correct that the security of root certificates needs to be high so not just anyone can sign anything with that certificate. As you pointed out that would not be secure. The reason is that typically such certificates are pushed down to all desktops as trusted to make deploying legitimate applications easier.

For that reason, companies have very strict processes which allow only a small number of individuals to codesign using a corporate root or other such certificate. I am not an expert in this area but I know at my former employer (big corp) this was the case.

This is also the case outside corporate certificates. Software is signed with a certificate for distribution online and those Verisign trusted certs are also very valuable. Their integrity has to be protected.

So signing with any certificate that maps back to a trusted root authority (whether inside the corporate firewall or on the Internet) needs to be guarded by secure processes.



Shiraz Cupala
InfoPathDev

Thank u Shiraz and MFaus,
also in my Corp, which is worldwide, not all employees can get code signing certificate. But here we don't know very well the certificate management process. I guess if it's not better signing the templete with a code signing certificate obtained by our corporate's rooted CA requested by a "special" service user and not by myself who is a simple developer. I'm quite ignorant in this matter. Is the code signign certificate usable only by the user who requested it and usable only in the machine where the user requested it?

Thank u :)

You're welcome. Others can use your code signing cert if you give it to them and they manually install it. But it's not how you want to do a corporate deployment because it's not mapped to a root authority and won't have all the rigorous processes you'd normally want when codesigning.