Jericho Forum Achievements

Steve WhitlockBoard of Management, Jericho Forum®

Activities

Role: Define problem and raise awareness

Papers Conferences & Events Relationships

http://www.jerichoforum.org/

Vision Statement

To enable success in today's business environment, which is dependant upon the ability to collaborate and do business, by enabling the secure flow of data over the Internet, principally through:– Universal standards for cross-organizational security processes

and services – Products that conform to open security standards and profiles – Assurance processes that, when used in one organization, can

be trusted by others

Note: The Jericho Forum is business-driven, but recognizes that the issues it tackles affect all types of organization and individuals. Issues such as privacy and civil liberty can be just as important as the needs of the corporate.

Mission Statement

Jericho Forum members will, as a group, influence and impact solutions that will enable secure and cost-effective business collaboration over the Internet by:– Defining the problem and directions for solutions – Communicating the collective vision – Challenging constraints and creating an environment for

innovation – Demonstrating the market needs – Influencing future products and standards

Note: The Jericho Forum does not intend to become a security standards development group, but will encourage established relevant standards groups to extend existing standards and produce new standards where there are gaps to fill.

Publications

General Papers Vision White Paper Business Case for Deperimeterization Jericho Forum Commandments

NewslettersBrochureFAQPress article references

Position Papers

Inherently Secure Communications– Protocols– Endpoint Security

Architecture Voice over IP Wireless Internet Filtering and Reporting

More Position Papers

Enterprise Information Protection & Control (DRM) Trust & Cooperation Federated Identity Information Access Policy Management Principles for Managing Data Privacy IT Audit Data / Information Management Collaboration Oriented Architectures (COA)

Position Papers in Development

Encryption & Encapsulation Regulation: Compliance & Certification Network Security & QoS Mobile Management

An Introduction to the Commandments

The principles:Our benchmark by which concepts, solutions, standards and systems can be assessed and measured

Fundamentals (3) Surviving in a hostile world (2) The need for trust (2) Identity, management and federation (1) Access to data (3)

Fundamentals

1. The scope and level of protection must be specific and appropriate to the asset at

risk

Business demands that security enables business agility and is cost effective.

Whereas boundary firewalls may continue to provide basic network protection, individual systems and data will need to be capable of protecting themselves.

In general, it’s easier to protect an asset the closer protection is provided.

Fundamentals

2. Security mechanisms must be pervasive, simple, scalable and easy to manage

Unnecessary complexity is a threat to good security.

Coherent security principles are required which span all tiers of the architecture.

Security mechanisms must scale: – from small objects to large objects.

To be both simple and scalable, interoperable security “building blocks” need to be capable of being combined to provide the required security mechanisms.

Fundamentals

3. Assume context at your peril

Security solutions designed for one environment may not be transferable to work in another: – thus it is important to understand the limitations

of any security solution. Problems, limitations and issues can come from a

variety of sources, including: – Geographic– Legal– Technical– Acceptability of risk, etc.

Surviving in a hostile world

4. Devices and applications must communicate using open, secure protocols.

5. All devices must be capable of maintaining their security policy on an untrusted network.

The need for trust

6. All people, processes, technology must have declared and transparent levels of trust for any transaction to take place.

7. Mutual trust assurance levels must be determinable.

Identity, Management and Federation

8. Authentication, authorisation and accountability must interoperate / exchange outside of your locus / area of control.

Access to data

9. Access to data should be controlled by security attributes of the data itself.

10. Data privacy (and security of any asset of sufficiently high value) requires a segregation of duties/privileges.

11. By default, data must be appropriately secured both in storage and in transit.

Paper available from the Jericho Forum

The Jericho Forum “Commandments” are freely available from the Jericho Forum Website

http://www.jerichoforum.org

VoIP

Flawed assumption that voice & data sharing same infrastructure is acceptable– because internal network is secure (isn’t it?)

Therefore little or no security built-in Internal VoIP

– Security entirely dependent on internal network– Very poor authentication

External VoIP– Some proprietary security, even Skype– Still poor authentication– BUT, new insecurities

VoIP Insecurity

Wannabe VoIP Security Moron Cries VoIP Isn’t Safe

Friday, August 31st, 2007 @ 8:38 am | News An idiot named Paul Simmonds (a member of Jericho Forum’s

board of management) says: VoIP is not yet ready for use in businesses. “We don’t consider VoIP to be enterprise-ready,” Simmonds said.

Anon (http://www.infiltrated.net/?p=10)

Secure “Out of the Box”

Challenge is secure VoIP without boundaries Therefore…

– All components must be secure out of box– Must be capable of withstanding attack– “Phones” must be remotely & securely maintained– Must have strong (flexible) mutual authentication– “Phones” must filter/ignore extraneous protocols– Protocol must allow for “phone” security mgt– Must allow for (flexible) data encryption– Must allow for IP stack identification & protection

VoIP Business Requirements

Return on Investment for;– Specific Computer to Telephony Integration– Greenfield site / refresh– Toll-bypass via the WAN / Internet– Distributed workforce– Integrated home/mobile workers

Rarely a Return on Investment for;– Rip & replace existing office phone systems– More expensive (and complex) end devices– Patch process for all system components

VoIP vs. Jericho Forum Principles

1 Specific & appropriate to the asset at risk If all low risk 2 Security, simple, scalable & manageable Not in Corp. 3 Assume context at your peril Pots vs VoIP 4 Open & secure protocols. No 5 Maintain security policy on un-trusted net. Web, TFTP etc. 6 Transparent trust None 7 Mutual trust assurance levels None 8 Authentication outside of locus of control None 9 Access by security attributes of the data None 10 Data privacy requires segregation of duties None 11 Data appropriately secured No

Paper available from the Jericho Forum

The Jericho Forum Position Paper “VoIP in a de-perimeterized world” is freely available from the Jericho Forum website

http://www.jerichoforum.org

Inherently Secure Communications

In the real world nearly every enterprise;– Uses computers regularly connected to the

Internet; Web connections, E-mail, IM etc.– Employing wireless communications internally– The majority of their users connecting to

services outside the enterprise perimeter In this de-perimeterised world the use of

inherently secure protocols is essential to provide protection from the insecure data transport environment.

Inherently Secure Protocol Characteristics

Not a general purpose tunnel An application level protocol that protects the

client / server association– Integrity– Confidentiality– Endpoint authentication

Examples– Outlook – RPC / TLS– AS2 – EDI / TLS– RDP / TLS, SMB / TLS pending– MS Direct Access replacing Remote Access

Paper available from the Jericho Forum

The Jericho Forum Position Paper “The need for Inherently Secure Protocols” is freely available from the Jericho Forum website

http://www.jerichoforum.org

Wireless (Wi-Fi)

1. Companies should regard wireless security on the air-interface as a stop-gap measure until inherently secure protocols are widely available

2. The use of 802.1x integration to corporate authentication mechanisms should be the out-of the box default for all Wi-Fi infrastructure

3. Companies should adopt an “any-IP address, anytime, anywhere” (what Europeans refer to as a “Martini-model”) approach to remote and wireless connectivity.

4. Provision of full roaming mobility solutions that allow seamless transition between connection providers

Paper available from the Jericho Forum

The Jericho Forum Position Paper “Wireless in a de-perimeterised world”

is freely available from the Jericho Forum website

http://www.jerichoforum.org

Web Access – The Issues

Filters in the “Cloud” Single Corporate Access Policy

– Regardless of location – Regardless of connectivity method– With multiple egress methods

Need to protect all web access from malicious content– Mobile users especially at risk

Paper available from the Jericho Forum

The Jericho Forum Position Paper “Internet Filtering & Reporting” is freely available from the Jericho Forum website(Make sure you get Version 1.1)

http://www.jerichoforum.org

Data Control & Protection

Digital Rights Management has historically focused exclusively on copy protection of entertainment content.

‘Enterprise’ DRM as an extension of PKI technology now generally available as point solutions.– Microsoft, Adobe, EMC, Oracle, etc.– Copy ‘protection’, non-repudiation, strong authentication &

authorisation.– ‘Labelling’ is a traditional computer security preoccupation.

Business problems to solve need articulating.– The wider problem is enforcement of agreements, undertakings

and contracts; implies data plus associated ‘intelligence’ should be bound together.

Almost complete absence of standards.

Limitations with Current Systems

No enterprise to enterprise capability An Enterprise to Enterprise Capability

Needs:– Standard, published API for manipulating

information– Standard associated information container– Standard protocols for communicating between

client, server and rights management servers.

Paper available soon fromthe Jericho Forum

The Jericho Forum Position Paper on “DRM” is currently being prepared by Jericho forum members

http://www.jerichoforum.org

End Point Security

NAC generally relies on a connection– Protocols do not make a connection in the same

way as a device Trust is variable

– Trust has a temporal component– Trust has a user integrity (& integrity strength)– Trust has a system integrity

Two approaches;– Truly secure sandbox (system mistrust)– System integrity checking

End Point Security

Standard are required so that agents placed on devices can interoperate, and a device only requires a single agent. – This allows agents to expand onto a wide variety of

devices such as phones, PDA’s, network devices and all PC’s not just WinTel PC’s.

Standards are required for bi-directionally secure sandboxes. – This probably is a good subject for academic study.

Collaboration is required to develop a secure protocol such that agents can securely be validated by the system with which it is trying to communicate.

Paper available soon fromthe Jericho Forum

The Jericho Forum Position Paper on “End Point Security” is freely available from the Jericho Forum website

http://www.jerichoforum.org

Conferences & Events

Annual Conference, London, April 2005, 6, 7, 8 Regional Conferences

– 2005: Cincinnati, US; Sydney, AUS– 2006: Schaumberg, US; Seattle, US– 2007: NYC, US– 2008: San Francisco, US; Planned for NYC, US

~8 Members meetings per year, greater London

Relationships

Monthly NetWork World Column Analyst Community Vendor Community Other Industry Bodies Universities Open Group Security & Identity Management

Forums

Cabinet OfficeForeign & Commonwealth Office

Some of our members