Trust Relationships Meeting Notes September 26, 2003 Dartmouth College

Concepts Trust Risk Liability I am going to draw a bit from experience from having been in charge of Info Security at Barclays Capital.

Explicit Trust (contractual relationship) Defined agreement Known bounds Understood ramifications if broken or abrogated Verifiable Example (financial) Terms on wire transaction (higher-ed) Network usage policy Very different motivations

Trust Implicit Trust Reputation based Unclear bounds Degree can change over time Difficult to verify Example (financial) FX, bonds (higher-ed) Most interactions

Trust in Computing is Getting Scarce... Hypothesis: Users feel they can’t trust their hosts with IT services and the service providers can’t trust the users’ hosts. Mail: Viruses, Spam, Scams Operating Systems: Vulnerabilities and Exploits Ephemeral Vendor Relationships The Source of Programs Quality of Applications/Coding P2P ... but Risk is still plentiful. Trust: Firm reliance on the integrity, ability, or character of a person or thing.

Risk Investment Banks and Risk Regular program of risk assessment and management. Defining assurance: information security practice, technology and audit was needed to mitigate risk sufficiently. Higher-Education and Information Risk Typically “defined” by IT organizations Generally no risk analysis is performed Not usually categorized by asset type Q. Can higher education get its head around Information Risk Management? Let me start by saying that I didn’t get into applied computing to sell insurance. IT shouldn’t be in the business of advising a company or a University how much they should buy or what to insure. That’s a Risk Management issue. Let’s make them do their job.

Liability Regulatory Compliance Civil Judgments

Why Work on Information Risk Management? Unknown and un-quantified risks don’t go away IT Professionals aren’t actuaries for digital assets Rise in the Complexity of Required Controls HIPAA TEACH Tracking DRM and IP Forensics Challenges coming to network authentication schemes and practices

Middleware Architecture Must be flexible to adapt to institutional policies that don’t exist yet. Powerful broker of institutional trust and interoperability. Should be applied in response to risk and audit requirements. The broader the adoption, the greater the risk.

Roles: Risk, Info. Security and Internal Audit Risk Management Quantifies risk Underwrites institution Information Security Responds to risk assessment with technology and practice Provides Audit Trail Real-Time Trust Broker Internal Audit Assesses information security response to risk and policy Verifies basis of trust Fosters confidence

Actions: Security Analyst Watch Engage Risk Management in Dialogue on Assessment Contribute to the Creation of Clear Policies Help Risk and Audit Understand Technology A word about identity “Ownership” of Institutional Identity and Root CA’s User, Service, Host Identity (end part I)

Trust and Authorization Audit’s Shaping of the Authority Registry Institutional identity has an owner thanks to HIPAA Risk Management and assessment at Stanford RBAC will need a representation of academic roles