1. Trust Relationships
Meeting Notes
September 26, 2003
Dartmouth College

2. Concepts Trust Risk Liability
I am going to draw a bit from experience from having been in charge of Info Security at Barclays Capital.

3. Explicit Trust (contractual relationship) Defined agreement
Known bounds
Understood ramifications if broken or abrogated
Verifiable
Example (financial) Terms on wire transaction
(higher-ed) Network usage policy
Very different motivations

4. Trust
Implicit Trust
Reputation based
Unclear bounds
Degree can change over time
Difficult to verify
Example (financial) FX, bonds
(higher-ed) Most interactions

5. Trust in Computing is Getting Scarce...
Hypothesis: Users feel they can’t trust their hosts with IT services and the service providers can’t trust the users’ hosts.
Mail: Viruses, Spam, Scams
Operating Systems: Vulnerabilities and Exploits
Ephemeral Vendor Relationships
The Source of Programs
Quality of Applications/Coding
P2P
... but Risk is still plentiful.
Trust: Firm reliance on the integrity, ability, or character of a person or thing.

6. Risk
Investment Banks and Risk
Regular program of risk assessment and management.
Defining assurance: information security practice, technology and audit was needed to mitigate risk sufficiently.
Higher-Education and Information Risk
Typically “defined” by IT organizations
Generally no risk analysis is performed
Not usually categorized by asset type
Q. Can higher education get its head around Information Risk Management?
Let me start by saying that I didn’t get into applied computing to sell insurance. IT shouldn’t be in the business of advising a company or a University how much they should buy or what to insure. That’s a Risk Management issue. Let’s make them do their job.

7. Liability
Regulatory Compliance
Civil Judgments

8. Why Work on Information Risk Management?
Unknown and un-quantified risks don’t go away
IT Professionals aren’t actuaries for digital assets
Rise in the Complexity of Required Controls
HIPAA
TEACH
Tracking DRM and IP
Forensics
Challenges coming to network authentication schemes and practices

9. Middleware Architecture
Must be flexible to adapt to institutional policies that don’t exist yet.
Powerful broker of institutional trust and interoperability.
Should be applied in response to risk and audit requirements.
The broader the adoption, the greater the risk.

10. Roles: Risk, Info. Security and Internal Audit
Risk Management
Quantifies risk
Underwrites institution
Information Security
Responds to risk assessment with technology and practice
Provides Audit Trail
Real-Time Trust Broker
Internal Audit
Assesses information security response to risk and policy
Verifies basis of trust
Fosters confidence

11. Actions: Security Analyst Watch
Engage Risk Management in Dialogue on Assessment
Contribute to the Creation of Clear Policies
Help Risk and Audit Understand Technology
A word about identity
“Ownership” of Institutional Identity and Root CA’s
User, Service, Host Identity
(end part I)

12. Trust and Authorization
Audit’s Shaping of the Authority Registry
Institutional identity has an owner thanks to HIPAA
Risk Management and assessment at Stanford
RBAC will need a representation of academic roles