1. Collaboration Oriented Architecture COA Position Paper An Overview
Adrian Seccombe Board of Management, Jericho Forum®
CISO & Snr Enterprise Information Architect, Eli Lilly

2. Questions at the end, please!?
Apart from points of clarification.

3. Backgrounder Technically an Open Group Forum
Founded by CISO’s of multinational companies in January 2004 to respond to… De-Perimeterisation
Today: 42 Member Companies and growing
Mission Act as a catalyst to accelerate the achievement of the collective vision, by:
Defining the problem space
Communicating the collective vision
Challenging constraints and creating an environment for innovation
Demonstrating the market
Influencing future products, services, and standards

4. Security Forum Standards Dev Work Types Needs Principles Strategy
Desired Future State
Work Types
Needs
Principles
Strategy
Position Papers
Police
and Gov’t
Agencies
Customers
Security Forum
White Papers
Patterns
Use Cases
Standards
Dev
Suppliers
Guidelines
Standards
Solutions
Customers
Standards and Solutions
Suppliers

5. Backgrounder De-Perimeterisation The journey so far…
Defined the issue, and created noise around …
We don’t apologise for the controversy!
Created the Commandments, there are 11!
Created a generic Roadmap
Trademarked: Jericho Forum
Created Inherently Secure Communications Paper
Published the COA Position Paper
De-Perimeterisation

6. Why the COA Position Paper?
We had defined the Problem…
We had developed a set of “Principles” in the Commandments…
We had created a roadmap (Though not rich with content)
We realised we needed to provide more details around the Solution….
Deperimeterisation
COA

7. COA: The Papers Framework
Introduction
Problem
Why Should I Care?
Components of COA
Recommended Solution/Response
Conclusion
The Way Forward

8. Introduction
Aim: To provide a guiding framework that enables Secure Information Sharing in a Collaborative environment.
Aligned to the Jericho Forum Commandments 4-8 pertaining to
Surviving in a Hostile World
Need for Trust
Identity Management and Federation

9. Problem
Traditional approaches to architecting security solutions are aimed at securing organizational borders, and the network, reinforcing a ‘perimeterised’ perspective. This is contrary to the future business needs of most organisations.

10. A Lilly segway We are changing from a FIPCo to a FIPNet.
Fully Integrated Pharmaceutical Company
Fully Integrated Pharmaceutical Network
Collaboration will be a core capability.

11. Why Should I care? De-perimeterisation is happening NOW!
COA is the framework that will allow appropriately architected business-driven solutions to be developed and delivered.
Adopting COA allows the added value of de-perimeterisation while mitigating the additional risks to your organizations.

12. Secure! Trustworthy! Reliable! Components of COA An Architects’ View
Principles
- Known parties
- Assurance
- Trust
- Risk
- Compliance
- Legal, Regulatory, Contractual
- Privacy
Technologies
- End Point Security/Assurance
Secure Communications
Secure Protocols
Secure Data/Information
Content Monitoring
Content Protection
Secure!
Processes
People
Risk
Information
Devices
Enterprise
Trustworthy!
Reliable!
Services
- Federated Identity
- Policy Management
- Data/Information Management
- Classification
- Audit
Solution Attributes
Usability/Manageability
Availability
Efficiency/Performance
Effectiveness
Agility
Expand this section, to add more content
An Architects’ View

13. Recommended Solution/Response
A section that describes how existing standards, protocols and frameworks should be used and supplemented with additional standards, tools, and services to deliver COA…
COBIT
SAML
ITIL
ISO 27001/2
TOGAF
SOA

14. Conclusion
Implementing COA builds upon existing standards and practises to enable effective and secure collaboration
COA provides a high level pattern to allow legacy applications to be re-architected to be collaboration oriented.
It takes a different mindset, and new services, both in the cloud and around the data.

15. The way forward The COA position paper sketches the skeleton
We need to collectively refine / develop the standards, tools and services in more detailed papers
Many of which can, and should be taken up by the Security Forum and ultimately service providers
Example : Inherently Secure Communications Standard Trust / Classification Framework….