node12.html

(Partial) solutions to security problems

Next: Economic importance Up: Computer, network and information Previous: Security objectives Contents

(Partial) solutions to security problems

Presently there are a number of well-established methods and tools that contribute to IT-security in design and implementation:

Cryptography is a body of mathematical methods for encoding messages for the purpose of making them unreadable for outsiders except for the legitimate receiver or for the purpose of adding proof of authenticity or integrity. Cryptoanalysis is concerned with breaking the encryption provided by cryptography. Collectively cryptoanalysis and cryptography are called cryptology.
Security policy models describe succinctly the protection properties that a system must have, especially how security properties are linked to security objectives.
Software engineering is concerned with the design and implementation of software systems. Within this setting SENTINELS concentrates on the design of system security.
Formal methods are concerned with formal mathematical specification and analysis of software and hardware systems; SENTINELS particularly focuses on the specification, validation and verification of security properties and protocols.
Smart cards are tamper resistant small computers, which are often used to carry secret personal information.
Biometrics provide a capability to link the physical identity of a person to a digital identity.
Risk analysis is the process of analyzing potential losses from a given hazard using knowledge about aspects that are understood, and judgments about aspects that are not well understood.

The increasing vulnerability and dependability of industrial and other (safety) critical processes of ICT requires increased research into the field of ICT safety and security.

The list above provides solutions, though in most cases only partial solutions to solving security problems. To provide more complete solutions is a significant problem. An even bigger problem is that there is no single, comprehensive framework or design methodology that helps the security engineer to design and build an adequately secure system. This is a severe obstacle to building secure systems. It is one of the ambitions of the SENTINELS program to contribute to the creation of such a comprehensive framework for secure systems engineering. Considering that security impinges on every aspect of system design, the realization of this ambition is a long-term goal, extending over 10 years or more. This comprehensive framework should be sufficiently flexible and open to be applicable in concrete situations and to address individual needs and requirements.

Next: Economic importance Up: Computer, network and information Previous: Security objectives Contents