node6.html

Introduction

Next: Computer, network and information Up: sentinels-030827 Previous: Budget and management Contents

Introduction

Prominent reports by government think tanks highlight the importance of good security for the ``digitale delta'' [25,37]. Security is a pervasive aspect of information systems, like performance or cost. The old adage that the security of a system is as strong as the security of the weakest link applies also in computing. An information system has technical but also other aspects, such as organizational and legal aspects. For example, security is of no value unless users are able to trust the security arrangements that are in place. Therefore, security cannot be approached from a technical perspective alone and the research in security is essentially multidisciplinary.

No one expects our cities to be 100% crime-free, but we do expect to carry out our daily activities with a degree of security that is reasonably high. Similarly, our distributed information systems and networks should be made attack-resistant, by a combination of technical, organizational and legal measures. This SENTINELS program will concentrate on improving the technical aspects of the security of our computing systems through scientific research, in close collaboration between academia and industry, without losing sight of the organizational and legal implications.

Security requires an integrated approach, as is acknowledged in the 2003-2004 Workprogram Draft for the 6th FP [11]. It emphasizes ``[...] integrated approaches, architectures and technologies for security and mobility, virtual identity management, privacy enhancing both at application level and at infrastructure level''. Therefore, the Workprogram continues, it is required that ``[...] integrated interdisciplinary approaches and ensuing technologies [are developed] for the provision of dependable network and information systems that underpin our economy and our society.''

An information system must satisfy often-conflicting requirements, of cost, performance, flexibility, security. For example, the more secure a system is made, the less flexible and harder to use it tends to be. Traditionally, security has been investigated in areas such as databases, operating systems and in networks. In a global ICT infrastructure this is no longer appropriate: instead security must be integrated at all levels. Therefore, security in information systems requires an integral approach with a focus on the (technically oriented) system level [2].

Computer, network and information security is of enormous economic importance. Quoting Mary Pat McCarthy, KPMG's global chair of information, communications, and entertainment practice from an article in Investor's Business Daily (08/08/01) page A8:

Computer security lapses cost firms billions of dollars. Billions of dollars can be saved if companies spend more money on implementing preventive measures against computer security breaches rather than repair them after they have been exploited.

Not only loss of revenue is a driving factor to improve the security of our critical infrastructures. Quoting from a report by the US Committee on Information Systems Trustworthiness [14]:

The nation's security and economy rely on infrastructures for communication, finance, energy distribution, and transportation - all increasingly dependent on networked information systems. When these networked information systems perform badly or do not work at all, they put life, liberty, and property at risk.

For the Netherlands, not only the national aspects, but also the international cross-border aspects of information security are of the utmost importance.

In the Netherlands applied security expertise is widespread in the sectors most concerned, like finance, telecommunications, government security agencies, etc. However there are four important developments that merit urgent attention:

an increasing connectivity to the Internet.
a growing exchange of information between all kinds of IT systems.
an increasing linking of distributed ICT-applications.
a growing interdependence of ICT which requires increased trust and availability.

The security issues that currently appear in the above sectors will, in the near future, appear in many more common situations, like energy production and supply systems, water and food production and supply, the health service, transport and logistics, the emergency services, etc. This requires greater and wider security awareness and expertise, which cannot simply be bought abroad. It must be developed locally, at various levels. This is what the current program aspires to achieve.

Next: Computer, network and information Up: sentinels-030827 Previous: Budget and management Contents