A Question of Security

Feb 06, 2008

Abstract

The demands of business have long past moved from computing as a desk-bound activity to one that occurs wherever the business is – on the road, at client locations, and between global partners. It is increasingly wireless and increasingly unconstrained by media types bound to specific devices. The same can be said for government activities and for the infrastructures that all use information communications technology (ICT) to operate their systems and improve operational efficiencies. In a word having gained wide use in the past year, we can say that ICT is deperimeterized, no longer constrained to the enterprise LAN or the data center.

We ask the question – how well has security measured up to this change in the way that the business of business, the business of government and the management of national infrastructures is conducted? There is ample evidence is that it has not measured up well at all and general agreement that we can and must do better. It is less clear what we can do to correct this trend. The rises of Botnets, increasingly sophisticated social engineering schemes, the increased availability of cyber-criminal services have made the challenge greater.

This we know, there is no silver bullet solution and no easy answer to this problem; it is complex and it will take an approach better than the approach taken to date of reactive, after market security solutions. In this seminar, we explore two complementary lines of thinking that offer a better approach. First we will consider a security framework developed at Bell Laboratories and adopted as ITU/T X.805 as a way to design for security in a consistent way that hardens products and solutions. Second, the "positive model" of security controls. They are not, as said already, silver bullets to fix the problems. They are about getting more disciplined, about recognizing that concomitant to the increased dependency in ICT systems, we must have the appropriate levels of assurance that these critical systems can continue to serve their important functions even in the midst of a growing threat.