Secure ICT Architectures for Efficient Detection and Response

Abstract

The starting point of the present paper is the ongoing transformation of the Information and Communication Technology (ICT) environment and the consequences of this transformation for the choice and realisation of optimal strategies to protect ICT assets against malicious use. Current defence strategies emphasise preventive countermeasures and recovery, devoting less effort to detection and immediate response. This strategy may provide adequate protection for static environments, with fairly well defined actors, borders and trust domains. However, the above assumptions prove invalid in the evolving dynamic environment, exhibiting complex and rapidly changing configurations and trust relationships.

An architectural framework is needed, which can provide stronger support for detection of and efficient response to attacks and is less dependent on preventive, perimeter protection. The core of the concept is tight integration and interaction between applications, protection mechanisms and system management. This change of defence strategy is needed in order to meet security requirements posed by actors in the emerging dynamic ICT environment. The subsequent analysis and discussion will identify the main characteristics of the proposed architecture.

The second part of the paper is devoted to some key issues of trust establishment in open environments, necessary for trust in seamless, pervasive services. An attempt is made to identify experiences from the field of electronic signature infrastructures, which may be applicable to validate trustworthiness of service providers in the wider ICT context. The last section provides suggestions for future work.