The sad thing here is that this is basically a solved problem, and the solution is very inexpensive to implement. It is, of course, digital signatures and PKI, both available for free for more than a decade. True, implementing a completely general PKI is hard work, but it is much easier for a corporate intranet. But, yet again, we have a problem with management buy-in so very few companies will implement it until after a few highly sensationalised incidents, then they will run out and buy a half baked proprietary solution instead of just okaying the IT guys' proposal from n years ago.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11228/32047#32047