I've been trying to come up with a list of attributes that a security solution needs to have to be complete and sufficient. The idea is to develop a set of attributes that can be used when analyzing security to see if it fulfills the needs of the situation. Obviously, risk management is the most important aspect of security analysis, but if we can distil a complex design into a small set of attributes that appropriate solutions generally would have then we could use that to analyze how good our solution is. This would be helpful when analyzing security solutions, be they security features in an operating system, an architectural design of a network, a physical security infrastructure, or any other type of security solution. The attributes also need to be a parsimonious set. Attributes of a solution need to be less complicated than the solution itself to be useful for analysis, otherwise why abstract the solution into its attributes?
I wrote these down a while ago and have been hoping I could refine them by doing what I always do - mull them over mentally for a while. However, I can't seem to come up with anything better, so I thought I would open up the thinking to the community and see if anyone else has any better ideas.
How about affordable? If small organizations with extremely limited budgets cannot afford the solution, then it is of no use to them. And they need it the most precisely because they have fewer resources and any downtime might bring the end of the organization.
There are only 500 companies in the Fortune 500, but hundreds of thousands of organizations at the other end of the spectrum who are desperate for inexpensive and robust solutions!
Not sure where this fits.. but a solution needs to be 'delegat-able'.. such that parts can be delegated to members of the team in a manner that only those parts/rights/modules, etc that are deemed needed for that person/team member to perform the task are given to them.
But is that part of adaptable?
I like Lazy and Robust for security. Typically, security systems are delivering a policy, and if a policy is going to work, it has to be Lazy and Robust.
Lazy -- it's easier to obey than to ignore or bypass
Robust -- whatever the current compliance status is, application of the solution will tend to improve it over time
Is that too pessimistic?
This is great, sounds just like the requirements of an accounting system. Although one of the requirements is missing, Relevancy. It isn’t surprising though that the same requirements would exist; you are effectively doing the same thing. In accounting you have a system that is required to know everything about business transactions and effectively report to management and external sources the information that is relevant to them. This is the same basic requirement for a security system. I had never really thought about the two this way (until I saw this list). Additionally an accounting and a security system can have other requirements, like enable faster responses to changing… security threats or economic environments. Hmm, way more similarities then I have room for in a comment… I’ll post a better write up later joshmaher.wordpress.com
PingBack from http://www.secure-software-engineering.com/2008/03/02/required-attributes-of-security-solutions/