A feature expected in the next version of Windows that will allow users to tag documents and other files with “metadata” could lead to embarrassing information disclosures if companies are not careful, according to research from Gartner Inc.
New features in beta releases of the next version of Microsoft Corp.s Windows make it easy to attach metadata, or keywords, to different documents.
However, there is no easy way to control the metadata once documents leave the Windows system or enterprise network.
Companies need to be aware of this fact and take steps to make sure that sensitive keywords and other metadata are stripped from documents before they are made public, Gartner said.
Gartners research note, “Plan to deal with metadata issues with Windows Vista,” published Wednesday, takes Microsoft to task for not designing security into the upcoming versions of Windows, code-named Vista, and Microsoft Office.
Those programs make it easy to attach keywords to documents, but they dont make it clear that the keywords and other metadata can be viewed by anyone.
Metadata is a key component of the next version of Vista, and will make it easy for Windows users to label and retrieve all kinds of information using enhanced Windows search features.
For example, a company could label all documents related to accounts for customers in the Northeast with a keyword identifying that geographic area, then retrieve all those documents with a Windows search.
/zimages/4/28571.gifClick hereto read about security features planned for Windows Vista.
Such keywords, which reflect internal or personal classifications, could be potentially embarrassing, according to Gartner analysts Neil MacDonald and Michael Silver.
For example, documents with keywords like “good customer” and “bad customer” could turn up in the hands of those customers, damaging business relationships. Even internal tracking numbers for accounts could reveal sensitive information to customers or competitors, Gartner warned.
Metadata has been causing black eyes and unanticipated changes in employment for years. Hidden revision marks and author comments have stung government agencies and corporations alike.
/zimages/4/28571.gifMetadata-type tagging on the Web is gaining backers. Read morehere.
Recently, the Pentagon accidentally leaked the names of U.S. soldiers involved in the shooting of an Italian secret service agent, Nicola Calipari, in March when it incorrectly attempted to redact the names from an Adobe PDF document.
More recently, the Democratic National Committee got burned for circulating an “unsigned” Microsoft Word document critical of Supreme Court nominee Samuel Alito that was traced back through hidden metadata that identified the author and organization.
Microsoft will include a metadata removal tool with Windows Vista that can scrub documents of sensitive keywords before they are released. The company may also make keyword features less prominent in the final version of Vista, according to Gartner.
A better solution, Silver and MacDonald said, would be to redesign the way Windows manages and protects metadata attached to documents.
The analysts suggested that Windows could introduce rights management technology that limits access to metadata to a select group of users, or allow users and companies to create policies that limit the use of metadata tags and allow companies to have metadata automatically stripped from documents when they are moved or copied.
Enterprises that are planning to deploy Windows Vista should begin formulating a policy for addressing metadata in documents prior to deployment, Gartner said. The analyst firm suggested user training about proper metadata use or, in extreme cases, even postponing deployment of Vista until better metadata controls are in place.
/zimages/4/28571.gifCheck out eWEEK.coms for Microsoft and Windows news, views and analysis.