Pain Point Facilitation and Prioritization Exercise Jim Hietala

Question for Pain Point Discussion: For each of these segments, what are the obstacles or pain points that prevent us from: defining what “good commercial products” are in that segment identifying and acquiring products that meet those definitions?

Pain Points Discussion Starter Network Security Devices (e.g. firewall, NIPS, AV/spam gateways) Centralized Security Services (e.g. IAM, SIEM, log management) Cloud/SaaS Delivered Security Services (e.g. Managed VA/ scan, cloud A/V, spam) Vendors: Cost to develop, test, certify/accredit, deliver Timeframe to develop, test, certify/accredit, deliver Limited market for certified products given time to test required Uncertain market for “highly secure” vs. “highly functional”   Customers: Lack of interoperability Supply chain security assurance Cost of secure, certified products Lack of software assurance, all types of software Lack of guidance on secure architectures Perimeter security model breaking down Lack of guidance on effective infosec management Threat/response, point solution nature of market Secure Platforms (e.g. SELinux, Trusted Solaris, TPM, Separation Kernel, et al) Acquisition: Globalization: R&D, manufacturing, software/hardware design (assurance of entire chain) Revised Common Criteria – Security certification standardization Approach to complexity where needed/can be eliminated Root cause analysis to feed policy updates Standardization (configurations and work with vendors before stipulating) System Assurance guidelines High Assurance – when will it be mandated? Swim-lanes and authorities across government Export control/ITAR, etc. Sensible policies for acquisition: scalable to program and place in architecture Redundant interoperability testing (and regimes) –need to overhaul certification policies Endpoint Security Software (e.g. A/V, F/W, anti-spam)

Contacts: Dave Lounsbury, VP, Collaboration Services d.lounsbury@opengroup.org Jim Hietala, VP, Security j.hietala@opengroup.org Sally Long, Project Management s.long@opengroup.org Joe Bergmann, Director, RTES Forum j.bergmann@opengroup.org Administrative: Diane MacDonald d.macdonald@opengroup.org

Thank you for your participation! We look forward to seeing you in Seattle