1. Pain Point Facilitation and Prioritization Exercise
Jim Hietala

2. Question for Pain Point Discussion:
For each of these segments, what are the obstacles or pain points that prevent us from:
defining what “good commercial products” are in that segment
identifying and acquiring products that meet those definitions?

3. Pain Points Discussion Starter
Network Security
Devices
(e.g. firewall, NIPS, AV/spam gateways)
Centralized
Security Services
(e.g. IAM, SIEM,
log management)
Cloud/SaaS Delivered
Security Services
(e.g. Managed VA/ scan,
cloud A/V, spam)
Vendors:
Cost to develop, test, certify/accredit, deliver
Timeframe to develop, test, certify/accredit, deliver
Limited market for certified products given time to test
required
Uncertain market for “highly secure” vs. “highly
functional”
Customers:
Lack of interoperability
Supply chain security assurance
Cost of secure, certified products
Lack of software assurance, all types of
software
Lack of guidance on secure architectures
Perimeter security model breaking down
Lack of guidance on effective infosec
management
Threat/response, point solution nature of
market
Secure
Platforms
(e.g. SELinux, Trusted Solaris, TPM, Separation Kernel,
et al)
Acquisition:
Globalization: R&D, manufacturing, software/hardware design
(assurance of entire chain)
Revised Common Criteria – Security certification standardization
Approach to complexity where needed/can be eliminated
Root cause analysis to feed policy updates
Standardization (configurations and work with vendors before stipulating)
System Assurance guidelines
High Assurance – when will it be mandated?
Swim-lanes and authorities across government
Export control/ITAR, etc.
Sensible policies for acquisition: scalable to program and place in architecture
Redundant interoperability testing (and regimes) –need to overhaul certification policies
Endpoint
Security
Software
(e.g. A/V, F/W,
anti-spam)

4. Contacts:
Dave Lounsbury, VP, Collaboration Services Jim Hietala, VP, Security Sally Long, Project Management Joe Bergmann, Director, RTES Forum Administrative: Diane MacDonald

5. Thank you for your participation!
We look forward to seeing you in Seattle