Security Forum

1
Security Forum

• Security and Boundaryless Information Flow

Jet Propulsion Laboratory California Institute of
Technology 4800 Oak Grove Drive Pasadena,
California 91109-8099 J. Steven Jenkins,
Ph.D. Principal Engineer 1 818
354-6055 steven.jenkins_at_jpl.nasa.gov
2
Security in the Architecture
Boundaryless Information Flow Reference
Architecture
Architecture Forum
Directory
Security
SystemMgmt.
Information Mgmt.
Messaging
Workflow Mgmt.
Mobility
User Interface Ontology
Transaction Mgmt.
Enterprise Management Forum
Messaging
Security Forum
Directory Interoperability Forum
Mobile Management Forum
Service QoS Task Force
Consistent Performance RealTime Embedded
Systems
3
Security Forum Vision

• Security is about achieving business objectives
  within applicable law and policy
• Managing risk
• Not merely preventing bad things
• Security creates protected systems with
  controlled perimeters
• A controlled perimeter is boundaryless where
  (and only where) it needs to be
• Security design is necessarily pervasive

4
Pursuing the Vision Education

• Materials for non-experts in security
• Managers Guide to Information Security and
  related guides
• Relating security to business objectives
• Helping business people relate to experts
• Saving Private Data video and white paper
• Illustrating a security incident in multiple
  simultaneous contexts financial, legal, public
  relations, and technical

5
Pursuing the Vision Collaboration

• With experts on Active Loss Prevention
• Integrating business, legal, and insurance
  aspects of information system security
• Definition and measurement of IT-related risk
• With experts on Architecture
• Using the Family of Architectures concept to
  incorporate security into Boundaryless
  Information Flow Reference Architecture
• Deepening and broadening the description of the
  Security Clan in the family

6
Pursuing the Vision Collaboration

• With experts from the bioinformatics industry on
  problems of mutual interest
• Ongoing discussions with Interoperable
  Informatics Infrastructure Consortium (I3C)
• A good source of vertical industry case studies
  for security forum work
• Patient record security and privacy
• Regulatory requirements for audit and digital
  signatures
• Secure messaging

7
Pursuing the Vision Plans

• Security Architectures will continue to be a
  primary focus for Security Forum work, uniting
  into a common framework
• Active Loss Prevention
• Industry Collaboration