1. Securing Information Systems in an Uncertain World Enterprise Level Security (Invited Paper)
- Author
-
William R. Simpson
- Subjects
digital signatures ,public key infrastructure ,attributes ,Access Control ,identity management systems ,high assurance ,cryptography ,enterprise ,authentication ,claims ,Information technology ,T58.5-58.64 ,Communication. Mass media ,P87-96 - Abstract
Increasing threat intrusions to enterprise computing systems have led to a formulation of guarded enterprise systems. The approach was to put in place steel gates and prevent hostile entities from entering the enterprise domain. The current complexity level has made the fortress approach to security implemented throughout the defense, banking, and other high trust industries unworkable. The alternative security approach presented in this paper is the result of a concentrated fourteen year program of pilots and research. Its distributed approach has no need for passwords or accounts and derives from a set of tenets that form the basic security model requirements. At each step in the process it determines identities and claims for access and privileges. These techniques are resilient, secure, extensible, and scalable. They are currently being implemented for a major enterprise, and are a candidate for other enterprise security approaches. This paper discusses the Enterprise Level Security architecture, a web-based security architecture designed to select and incorporate technology into a cohesive set of policies and rules for an enterprise information system. The paper discusses the history, theoretical underpinnings, implementation decisions, current status, and future plans for expansion of capabilities and scale.
- Published
- 2016