Good comments, good ideas. But isn't the endpoint on device the user (or an application in case of a monitoring device?) That has been at least in my field, (wireless) public safety, mobile workforce, etc the main problem and I have always designed for that. Devices are usually easily recognized, interfaces and drivers checked, the connection(s, can be many per device) secured by keys, etc but what if the device is lost, stolen or just used by an unauthorized person? And in a well designed system even if the malicious traffic can get through communication, AAA and encryption layers the application will immediately reject it, audit it, alert and, if so configured, close the connection. That's kind of basic design on systems I have designed a long time. Isn't that a case in all sensitive systems? We have protocols and tools today for that. But I agree that two way authentication and authorization are a must (should be, too often forgotten.)
|
Does Verizon's Voyager stack up to the iPhone? |
|
|
5 IT skills that won't boost your salary 
[1,407]
Women 4 times more likely than men to cough up personal info [589]
Japan's 10 funniest tech-related commercials [Videos] [407]
Throwing away a promo CD is "unauthorized distribution"? [1,265]
Adults too quick to dismiss educational video games [682]
Attack of the iPhone clones [Slideshow] [578]
10 things IT needs to know about AJAX [1,258]
This Year's 25 Geekiest 25th Anniversaries [Slideshow] [409]
|
|
What does it solve?
While this is a very good synopsis regarding the current state of thinking by groups such as Jericho and others in the security industry, I wonder why there is not a single mention of the concept of information-centric security?
This is surprising since this is one concept that would seem to be integral to the whole concept of de-perimeterization and the goals of Jericho. What is there in the endpoint approach that answers the basic necessary question of "who is accessing what data and what are they are allowed to do with it" ?
At most, the authenticated endpoint device becomes only the most basic of proxies for authorized access to the network. On the other hand, a granular access and audit control system that operates on a whitelist basis at the data level and incorporates the clearly understood trust level boundaries that the author alludes to in his article, makes the endpoint device issue a non-issue.
A good comment
You hit it! Yes, we should protect information even more than the infrastructure. Infrastructure can always be repaired, reconditioned, replaced, etc but information once transfered can not be taken back. The sad thing is that many backbone systems have this type of protections but front end COTS clients (WEB browsers, etc) don't have standard ways to do that. It is more a technical problem which can be taken care to some level with proxies, proprietary stacks or drivers, etc on devices but the multitude of devices and operating systems makes it very difficult and expensive. Especially mobile devices can be used by more than one user (human / application) with different access rights at the same time, using the same connection and no time to re-authenticate or re-login and at the same time, for example, allowing unsolicited alarm / emergency messaging or roaming more than one type of network with different characteristics and trying not to lose the message or stream.
Previously that was true
"...but front end COTS clients (WEB browsers, etc) don't have standard ways to do that".
Actually, we offer a scalable multi-level security solution that works with an existing mixed platform environment and deals very well with the issues you mention.
The ability to have control over your business data flow allows the set up of trust zones within the environment that will not allow data to be released to a user, unless access privilege exists, no matter what device is used, (since a white list approach is used), but still allows mobile devices to be used with regular data, if the policies allow it. It will also allow users to have different levels of privilege in different user groups.
It is usually more advantagious to be able to setup and enforce things like separation of duties and roles, least privilege, etc., based on the business rules (information-centricity) rather than on infrastructure.
Post new comment