Assurance

[Ann West <>]

Scott,

Can you explain what "a policy against such apps" means? Do you mean "a 
policy against non-silver-compliant apps using silver credentials"?

Ann


> >If you have services using your silver credential, they should
> >conform to
> >the Silver spec so the credential is not compromised. Look at the
> >trust
> >model diagram on page 4 of the IAAF and you'll see non-IdP Apps
> >within
> >the scope (shaded area) of the IAP implementation for that reason.
> >
> >I think this is one reason why many schools are layering on
> >two-factor
> >and using that for Silver-only apps, but I'm sure others can comment
> >further.
> 
> One of the conversations I recall not seeing a conclusion on was
> whether
> having a policy against such apps was sufficient or whether you had
> to
> have actual technical controls in place to prevent it.