IST 2006 – 22/11/2006 Aljosa Pasic Atos Origin Security, Dependability and Trust in Service Infrastructures

IST 2006, 22/11/ Index  Service Oriented World  Where is the problem?  Examples  Security dimensions in Service Oriented World  ESFORS and NESSI  Research topics  Conclusion

IST 2006, 22/11/ Service Oriented World Applications will need to utilise shared and co-owned services out of different domains of control that require to obey separate security policies and ask for diverse security and dependability qualities

IST 2006, 22/11/ Coming problems  For industry: Demand for Secure software is much higher than available security expertise  For research/technology: New complex scenarios (e.g. ambient intelligence) introduce security issues not addressed by conventional engineering processes  For market consultants: Security properties difficult to measure and it is also difficult to evaluate their “compositional effects”  For users: Security segmentation and market definitions are blurring: “service infrastructure” covers network infrastructure, perimeter, desktop, server and application security  For auditors and lawyers: Who is accountable and liable for what?  For society: Trust becomes a “key enabler” for service provision and use  For everyone: How much should we spend on security?

IST 2006, 22/11/ Example: Secure “Crossroads” Hi, I am a software service Hi, I am a really naughty crossroad Cross - Platform, Cross - device, Cross - domain, Cross - Protocol …

IST 2006, 22/11/ Example: Secure “Crossroads” Platform A, Credentials B … Device A, Protocol B …, Device A, Protocol B …, Platform B, Credentials A … Domain C, policy C S2M security Dynamic Adaptation “Factor 5“ Access and identity Shared understanding

IST 2006, 22/11/ Security Dimensions in Service Infrastructures Secure Services Securing Services Security as a service

IST 2006, 22/11/ ESFORS and NESSI WG TSD NESSI SC SB NWG TSD ESFORS European Security Forum for Web Services, ESFORS European Technology Platform: Networked European Software & service Initiative, NESSI

IST 2006, 22/11/ Objectives  Address the security and dependability requirements, challenges and priorities of emerging service oriented software applications  Bridge two communities: the software engineering (services, GRID) community and the security community  Support the NESSI vision and respond to security challenges  Address long-term research on trust, security and dependability in software and services

IST 2006, 22/11/ NESSI TSD in SRA Vol3. 1.Widespread and large-scale deployment of Privacy Enhancing Technologies (PETs) 2.Strong identity management 3.Security mechanisms for service 4.Trust & dependability management and assurance 5.Trusted certification tools for services 6.Openness as a foundation for systems security 7.Holistic Management of Trust 8.Engineering security throughout the whole lifecycle of Service oriented systems 9.Security of the human-computer interface ______________________________________ 10. Inherently Stable and Safe Architectures (together with SOI NWG)

IST 2006, 22/11/ Current activity within research topic groups 1.Security mechanisms for services 2.Trust and dependability 1. Trust analysis, management and monitoring 2. Dependability assessment and monitoring 3.Security and Dependability engineering 4.Dependable architectures 5.Identity considerations 6.Multidisciplinary and integrated approach to TSD 7.Security of the human-computer interface 8.Privacy considerations 9.Certification, auditing and assurance 10.Openness as a foundation for systems security

IST 2006, 22/11/ Mapping challenges, scenarios and research topics Scenario A Scenario B Scenario C Decrease Gap … More sec. knowledge More Trusted components More trusted relations Handle complexity Dynamic & ad-hoc Cross-x Context dependent Decision Making User involvement Perception and psychology Economics of security Social mechanisms

IST 2006, 22/11/ Conclusions  It is not “business as usual”: we need many stakeholders in order to deal with trust, security and dependability in service oriented software applications  We have the responsibility to build secure software & services that MATCH people´s expectations and notions of trust (and also “trust just a little bit”).  Long-term research on trust, security and dependability in software and services should address components, mechanisms and processes, not all of them have technical nature  A large group of interested parties already started with the discussions within NESSI WG  Join us for the networking session 23/11, room 207 at 11:00

IST 2006, 22/11/ Contact for more information Aljosa Pasic Trust, Dependability and Security cannot be “ bolted on ”, it should be “ woven in ”.