Chapter 24

1. Chapter 24 Conclusions

2. How security is done • Security 10 years ago we thought security was physical security • Today we think computer security • 10 years ago computer security was confidentiality, integrity, availability • Now it is reversing

3. World security • During the cold war we knew our enemy • Computer security know their enemies • I just protected my network from outside influences and made sure the proper controls were in place to handle fraud • Today we do not know our enemies • The computer security specialist does not know their enemies

4. System integration • Business are opening their systems and integrating them world wide. • There is no outsider and insider the lines are blurred • Systems now evolve and accumulate features without limit

5. Corporate culture • People were committed to a company. • Many worked for the same company for life. • Today’s workers are much more transient • Often taking important knowledge with them destroying “corporate memory” • Design • Past mistakes

6. Security engineer • Must understand many disciplines • Cryptology, access control, information flow, networking, management, accounting, finance, business processes • Manage technology in face of constantly changing business environment • Effectively communicate issues • Keep up to date • Understand attacks • Understand tools • Legal and policy issues

7. Places • http://www.sse-cmm.org/index.html • http://www.nsa.gov/ia/government/isse.cfm?MenuID=10.3.2 • http://www.issea.org/ • http://www.ewa-iit.com/content.asp?sectionID=8 • http://www.kct.com/it_solutions/security.asp • http://slashdot.org/books/02/02/28/163234.shtml?tid=172

8. Articles • Security engineering positions • Security Engineering skills

9. Class • Is it what you expected? • Is it what you need? • What is missing? • What is good? • What needs improvement? • What would you change? • What should stay the same?