q & a 9 Infosecurity Today September/October 2006 Former White House CIO Carlos Solari recently joined Lucent Technologies. He has 25 years experience in American government and private industry positions, including 13 years as an officer in the US Army, and more than six years as a senior executive with the FBI. Brian McKenna [email protected] Security technology fundamentally flawed, says ex White House CIO F rom 2002 to 2005 he was the Chief Information Officer for the Executive Office of the US President.There he was responsible for the implementation of a complete computing modernization, with IT security a central part of the work. He took time out on a recent trip to London to talk to Brian McKenna for Infosecurity Today. You spoke at the recent Gartner IT security summit in Washington about trust based security, in the context of the convergence of IT, telecoms and digital media. What were you putting across at that event? Essentially a critique of the current approach of bolting on security after the fact.This also entails not dealing with the security of highly complex networks.The idea is born from the no- tion that in order to really apply security to the systems we have today you need to build it in from the inside. And how do you apply that without the use of a standard that you can use to be consistent across the industry? Trust based solutions have to be built on standards, such as the X.805 standard that Bell Labs and Lucent profes- sional services advocate. The point here is to ensure that any device in a network has been de- signed to a reference-able measure of security.You also have to have the ability to determine its state of health by some mechanism by which it can ‘check to its good mirror’. If you do that in a comprehensive way,and pass the information on to a central management console, you can provide an ability to adjudicate whether a device has been modified from its authorized state. All that sounds great, but, at least at a certain level of abstraction, it sounds like, say, a Cisco story on NAC (Network Admission Control). It is similar to the NAC and Microsoft’s NAP.But those approach- es are resident more at the configura- tion level, where somebody builds an image and deploys a device in con- formance with that image. Our mod- el goes down deeper – how do we know that the device, the OS and so on are built to some level of security if you don’t have standards? Today there are just too many things to try to manage securely. The basic messages should be: build secure and stay secure through device attestation. Are there lessons from your experience at the White House that you think are of more general applicability? Well, that experience illustrated well the core problem. Despite applying the best security tools we could at the White House, I never really felt that we were actually in front of the problem, but were instead always chasing the problem.We were not constrained by budgets, but, you see, no amount of spending money on the current approach is really going to solve the problem.Fundamentally, we cannot say that we can defend networks today.And I felt that I had to go back out into private industry to figure out how to solve the problem in a more fundamental way. There are three legs to it: we need to prevent, detect, and respond.We are dealing with the problem at the end points — the LAN or the devices. But we need to bring into play the ability to apply preventive measures inside the cloud. At Bell Labs we are working on how to resolve DoS attacks in the cloud, for example.And there is some work being done in detecting the propagation of a worm in the cloud through traffic analysis. So you will see research emerging from our labs that tackles security in this more basic kind of way. • Lucent’s Carlos Solari: build security from the inside

Security technology fundamentally flawed, says ex White House CIO

Download PDF Report

Upload
brian-mckenna
View
215
Download
2

Embed Size (px)

Citation preview

Page 1: Security technology fundamentally flawed, says ex White House CIO

Info

security To

day

September/O

ctober 2006

Former White House CIO Carlos Solari recently joined Lucent Technologies. Hehas 25 years experience in American government and private industry positions,including 13 years as an officer in the US Army, and more than six years as asenior executive with the FBI.

Brian [email protected]

Security technologyfundamentallyflawed, says exWhite House CIO

From 2002 to 2005 he was the ChiefInformation Officer for the Executive

Office of the US President.There he wasresponsible for the implementation of acomplete computing modernization,withIT security a central part of the work.

He took time out on a recent trip toLondon to talk to Brian McKenna forInfosecurity Today.

You spoke at the recent Gartner IT se-curity summit in Washington abouttrust based security, in the context ofthe convergence of IT, telecoms anddigital media. What were you puttingacross at that event?Essentially a critique of the current ap-proach of bolting on security after thefact.This also entails not dealing withthe security of highly complex net-works.The idea is born from the no-tion that in order to really apply secu-rity to the systems we have today youneed to build it in from the inside.

And how do you apply that withoutthe use of a standard that you can useto be consistent across the industry?Trust based solutions have to be builton standards, such as the X.805 stan-dard that Bell Labs and Lucent profes-sional services advocate.

The point here is to ensure that anydevice in a network has been de-signed to a reference-able measure ofsecurity.You also have to have the abil-ity to determine its state of health bysome mechanism by which it can‘check to its good mirror’.

If you do that in a comprehensiveway, and pass the information on to acentral management console, youcan provide an ability to adjudicatewhether a device has been modifiedfrom its authorized state.

All that sounds great, but, at least ata certain level of abstraction, itsounds like, say, a Cisco story on NAC(Network Admission Control).It is similar to the NAC andMicrosoft’s NAP. But those approach-es are resident more at the configura-tion level, where somebody builds animage and deploys a device in con-formance with that image. Our mod-el goes down deeper – how do weknow that the device, the OS and soon are built to some level of securityif you don’t have standards?

Today there are just too manythings to try to manage securely.The basic messages should be: build

secure and stay secure through device attestation.

Are there lessons from your experience at the White House thatyou think are of more general applicability?Well, that experience illustrated wellthe core problem. Despite applyingthe best security tools we could atthe White House, I never really feltthat we were actually in front of theproblem, but were instead alwayschasing the problem.We were notconstrained by budgets, but, you see,no amount of spending money onthe current approach is really goingto solve the problem. Fundamentally,we cannot say that we can defendnetworks today.And I felt that I hadto go back out into private industryto figure out how to solve the prob-lem in a more fundamental way.

There are three legs to it: we needto prevent, detect, and respond.We aredealing with the problem at the endpoints — the LAN or the devices. Butwe need to bring into play the abilityto apply preventive measures insidethe cloud.

At Bell Labs we are working onhow to resolve DoS attacks in thecloud, for example.And there issome work being done in detectingthe propagation of a worm in thecloud through traffic analysis. Soyou will see research emerging fromour labs that tackles security in thismore basic kind of way. •

Lucent’s Carlos Solari: build securityfrom the inside

mailto:[email protected]