|
First he presented the Information Security Principles, which consist of the Confidentiality, the information is available only to those with a right to know; the Integrity, the information is accurate, valid and reliable; the Availability, the information is available when it is needed; the Accountability, all actions can be attributed to an accountable individual; the Provenance, the origin and history of a data item is well defined and known; and the Assurance, reasoned confidence in the reliability of security assumptions and controls.
The SuperData Centres seen through a security lens
They need for example the technical environment, networks - high-speed internal and external. Often these lay beyond commercial network security mechanisms in both scope and speed. The have massive data central and distributed, on-line and off-line storage. They lay beyond conventional protection approaches due to the distributed nature of users, differences in operating systems and versions, differences in administrative structures. In technology they are leading edge, have research/prototype, little prior art, known-good work.
In the management environment there is a collegial "high trust" loyalty to the profession, loyalty to local institution, impatient with bureaucracy and process, and high visibility (attractive target for thrill seekers).
The physical environment is characterised by a relatively open access (compared with commercial or classified government environments).
Risk Assessment Process
Koch then described a risk assessment process based on NIST (the Risk Management Guide for Information Technology Systems, Special Publication 800-30) in detail, which consists of the following steps:
- System Characterisation
- Threat Identification
- Vulnerability Identification
- Control Analysis
- Likelihood Determination
- Impact Analysis
- Risk Determination
- Control Recommendations
- Results Documentation
In the end he summarised the approaches to a secure data centre. Security is a process and not just technology. The SuperData Centres push security technology beyond the state of the art, and require analysis based on first principles, and a deep awareness of the security process. The Security, to a defined degree, can be achieved for SuperData Centres. A Secure SuperData Centre knows what it cares about, and why. It has reasonable and appropriate safeguards in the administrative, technical and physical arena. It protects itself against reasonably anticipated threats or hazards. It has confidence in data integrity and confidentiality. Additionally it has confidence that it ensures adequate availability and knows why it knows all of these. |
