Assurance

["Cantor, Scott" <>]

On 8/20/12 10:36 AM, "Ann West" 
<>
 wrote:
>
>This sentence kinda confused me but I think I know where you're going
>"and I have been interpreting "appropriate" to mean "the same as all the
>policies and procedures relevant to our IDP infrastructure." I think the
>answer is that you are correct.
>
>If you have services using your silver credential, they should conform to
>the Silver spec so the credential is not compromised. Look at the trust
>model diagram on page 4 of the IAAF and you'll see non-IdP Apps within
>the scope (shaded area) of the IAP implementation for that reason.
>
>I think this is one reason why many schools are layering on two-factor
>and using that for Silver-only apps, but I'm sure others can comment
>further.

One of the conversations I recall not seeing a conclusion on was whether
having a policy against such apps was sufficient or whether you had to
have actual technical controls in place to prevent it.

-- Scott