Industry: Think about security in new ways
Connecting state and local government leaders
Bill Gates and his chief research and strategy officer Craig Mundie described a new model of security in which the enterprise is becoming less dependable.
SAN FRANCISCO ' Microsoft chairman Bill Gates and his chief research and strategy officer Craig Mundie today described a new model of security for an IT world in which not only has the perimeter disappeared, but in which the enterprise is becoming less dependable.
In a world in which more types of mobile devices are networked to critical resources, more attention needs to be paid to securing information, Gates and Mundie said in their opening keynote talk at the RSA security conference.
'These things are not in an administered world,' Mundie said. This is changing the way security must be thought of, he said. 'We need to move to defining these things by policy, not topology.'
As a result, this is putting the responsibility for security on operating system and application developers such as Microsoft and their partners, rather than on standalone security companies. This shift lead RSA president Art Coviello to predict a major shift in his industry during his talk.
'The value of security as a standalone solution is decreasing,' Coviello said. 'This transformation will bring an end to the standalone security industry in two or three years.'
Coviello's views might be colored by RSA's move from a standalone security company to being the security division of EMC.
Security companies will not go away, he said, but will be absorbed into the broader industry as security is integrated into other products.
Gates, a regular speaker at the RSA conference, made his last appearance at the gathering as Microsoft chairman, before moving to running his foundation full time. He, Mundie and Coviello spoke before a standing-room-only crowd of about 4,000 Tuesday morning. The conference is expected to draw about 15,000.
The focus of this year's conference is on privacy and information security, something Coviello said the industry has not done well.
'We haven't focused on information security at all,' he said. The focus until now has been on the perimeter, which the Internet and the proliferation of mobile networked devices has for all practical purposes eliminated.
Gates said Microsoft began shifting to the new realities of security five years ago, with his memo on trustworthy computing. The new Vista operating system and Office 2007 are the first major products that have gone through the company's new lifecycle development process. The use of IPv6 and the integration of IPSec into the products should help improve security.
IPSec essentially 'define[s] the authorities being granted at each end of the connection,' Mundie said. This enables the process of controlling how resources are accessed and used based on the policy for each user, rather than by network segment. Although the technology to do this exists, 'what we've been missing is the ease of administration,' Mundie said.
Some progress in easing the administrative burden of policy-based security will be demonstrated in the new Longhorn Server, to be released later this year. It will collapse some 4,000 rules that originally were needed to establish policy-based controls to about 40, Mundie said. But that still is not good enough. 'We're not really there yet,' he said.
Gates described an IT world in which authentication is moved from passwords to digital certificates on smart cards. But, said Mundie, 'we have not given people good tools for managing all of these identities' represented by credentials.
One of the answers Microsoft is offering to promote a move to certificate-based authentication is CardSpace in Vista, which gives a graphical user interface for a user's certificates.
'People are going to have to acclimate to it,' Mundie said.
Coviello said the future of security is a risk management tool that enables business processes rather than blocks activity. Risk management means that security in the future will have to be flexible and adaptive rather than perfect.
'The pursuit of perfect security is a waste of time and resources,' he said. It is not achievable, and not always needed.
NEXT STORY: It's all about the privacy