Wave Systems Corp. (fka WAVXQ)

[mymoneybgone]

Securing the Enterprise Beyond the Perimeter
Deperimeterizing security architecture

By: Richard Moulds
Dec. 23, 2005 05:00 PM

http://issj.sys-con.com/read/159567.htm

Recent high-profile security breaches have taught us a clear lesson: organizations that rely primarily on a secure perimeter to protect sensitive data are fooling themselves. This year, hardly a week has passed without headlines about a security breach involving sensitive data.

However criminals get the data, whether through a traditional perimeter breach, use of insider credentials or outright theft of physical storage media, the lesson is the same. Organizations can no longer regard everything inside the traditional perimeter (people, machines, and networks) as "trusted," requiring only a "soft" approach to security that consists primarily of procedural controls and weakly enforced permissions.

It's an approach to IT security that's like a candy M&M: once criminals penetrate the hard shell that protects the network from the wholly untrustworthy public Internet, they can easily devour the data at the soft center. Actually they often don't have to penetrate the perimeter at all. They can simply go around it by stealing unencrypted backup tapes, for instance, out of the back of a cargo van.

Not only are attackers constantly blowing open security cracks in perimeter security, but enterprises themselves are also willingly, and often unwittingly, contributing to the perimeter's disintegration.

For example, virtual private networks frequently tunnel through the perimeter, which often provides all-or-nothing access to network resources. Web Services, which are starting to finally fulfill the early hype, are meant to interconnect business processes and often reach into the core of an enterprise network. Factor in the mass of mobile devices, wireless networks, portable media storage and off-site data archival, and it's not outlandish to suggest that there really isn't a perimeter at all. Instead, enterprises need a "jawbreaker" model in which the network is "hard" all the way through to the center.

Drivers Behind the Jawbreaker
Unfortunately the traditional perimeter model doesn't just fail to provide adequate security. It's also far too expensive and inefficient to deploy, given today's far-flung workforce. Enterprises have to manage an exploding number of network connections for employees working at home, traveling and staffing remote offices, not to mention the connections they've built to the networks of partners, outsourcers, and customers.

Enterprises need a unified management approach to the identities of users, their rights and roles, and ultimately the enforcement of those rights. The search for a unified approach has led many security experts to believe that security will soon be deperimeterized.

In a deperimeterized world, every user is "remote," whether he's on the corporate campus or in a coffeehouse halfway around the world. Instead of building a perimeter around the network, in a deperimeterized architecture there's a virtual perimeter around every user or internal system that establishes "islands" of trust that securely exchange information.

The Jericho Forum (www.opengroup.org/jericho), a security organization recently founded by corporate CIOs, is taking a stab at defining the requirements for both the short-term and long-term transition to a deperimeterized world - a unified world with an inherently less expensive, more consistent approach to identification, authentication and authorization. By and large, its vision doesn't require the development of brand new, whiz-bang technologies, but rather strings together existing technologies into a unified whole.

The Jericho Forum's vision is no pipe dream. It's already underway. Computer manufacturers like Dell, Hewlett-Packard, IBM, and Fujitsu have all made trusted platform module (TPM) technology a standard feature in their enterprise-class laptops, enabling users to securely lock away in hardware the secret digital keys that are crucial to encrypted communications. These keys let users securely encrypt and decrypt information with their laptops, and give administrators the ability to verify not only that a user is safe, but also that the user's machine is safe.

Dell, for one, has gone a step farther and has put smart-card technology in its laptops so network administrators can assign a digital identity to each user instead of relying on the notoriously insecure usernames and passwords.

Pervasive Encryption
So a world in which every user is a secure "island" raises important questions like how one know who's actually "on" each island?

The foundation of a deperimeterized security architecture is knowing whether users and their machines are who and what they should be. Enterprises will have to use strong methods of authentication such as smart cards, USB tokens and ultimately biometrics to validate users and embedded digital identities to recognize devices such as laptops, phones and even peripherals.

It also begs the question: How will these islands communicate securely with one another?

At the end of the day, the only sure way to enforce confidentiality is though encryption. No enterprise in its right mind would ever send sensitive data across the Internet without encrypting it first. That mindset is now starting to be applied to all networks. There are well-established means for securing data as it travels "outside" the traditional perimeter, means that can be re-applied in a deperimeterized world. SSL, virtual private networks, and Web Services will all be used to link up the islands protecting data "inside" as it moves between cubicles or campuses.

You also have to ask: How will enterprises protect sensitive data and the processes that use them once they've arrived on the islands?

The reality is that pockets of stored data are virtually everywhere and that much of this data is sensitive in nature. In a deperimeterized world, the situation is probably going to get worse. There is a "data at rest" problem that goes well beyond backup tapes. There will be need to be the islands responsible for protecting the data on the island - whether the data is stored in a database, file system, tape drive, or the laptop's hard drive. In some cases, tightly integrated access controls may suffice but, once again, encryption will often be used to provide a last line of defense. If all else fails, a thief's efforts will be in vain - he may have access to data, but because it's encrypted, he won't see anything except gobbledygook.

Clearly, encryption plays a pivotal role in a deperimeterized security environment. But as encryption penetrates deeper into enterprise operations, enterprises will need to deploy new systems to manage - cost-effectively - the exploding number of private keys on which pervasive cryptographic security will depend. There will have to be a mechanism for recovering lost data and separating duties.

It's a big challenge, but once deperimeterization becomes a reality, the payoff will be enormous. Not only will the headlines about security breaches recede but enterprises will be able to expand their networks efficiently and securely to include remote employees, new branches, partners, customers, and outsourcers.

It's only a matter of time before the walls fall down. The question is whether there will be systems and policies available that can raise the security bar sufficiently to cope. Life in a deperimeterized world might be a liberating experience and should certainly be less costly in the long run.

The security industry still has plenty of work to do. What seems clear is that the using cryptography will become more widespread, often under the covers, but nonetheless a fundamental component behind strong authentication and enterprise-wide data protection.

Published Dec. 23, 2005 — Reads 322
Copyright © 2006 SYS-CON Media. All Rights Reserved