Security is ...

Confidentiality, Availability, Non Repudiation, Integrity. As a security professional, this is the mantra I (and most of the industry) preach.

What I like (on cursory examination) is the possibility of assigning rules to spreadsheets that haven't even been created. That's a boon to those who have to manage the security of these files. What I suspect doesn't work, although the article talks about it in a roundabout fashion, is the transfer of cellular security. But access control to the actual spreadsheet is a good first step.

However, the stumbling block is that someone, perhaps the creator, must apply internal security. So the security manager has to personally touch every new file anyways, since I don't trust the creator to adequately set up permissions and ACLs.

dillon, CISSP, in Tejas