Whenever we control system users access by assigning (or holding back) permissions, we are effectively 'certifying' their IT security status. If we don't have a single document (literally a certificate) that describes the sum of all of a particular persons 'permissions', we have the equivalent recorded in various systems. System User Access Control could then be otherwise described as System User Certification. As system users are as much components of the IT environment as applications or hardware, it would be fair to say that System User Certification could be called a type of Component Security Certification.
So far then we've tentatively accepted that we can use a new name to describe a thing that we are already familiar with; does this improve our System User Certification process? I have to admit that the 'benefit' mostly flows the other way. I am hoping to give some 'respectability to the concept of 'Component Security Certification' and to suggest that certifying Computer Applications and Computer Hardware as 'security compliant' is as important as certifying System Users.
Well so far perhaps that doesn't sound too radical, although certifying that a printer is 'security compliant' might be a novel concept to some. Others will note that we already have protocols for ensuring that applications are built to standards (which include security standards), and security-sensitive hardware such as routers are configured with security 'in mind'. What I am talking about is a universal process that ensures that all hardware and software are put through a process of certification of compliance with our security expectations, ensuring that none are bypassed because 'we didn't appreciate in advance their significance'. Ninety percent of office 'hardware' will not have any security implications and can then be certified 'clean' straight away. So what's the advantage in doing that (apart from satisfying some super-bureaucratic itch)? Well consider the printer again.
Eight years ago the first reports of printers being 'hacked' into came to light. This was a result of a change in 'capability' in printers, now being network enabled. Obviously large multifunction printer/copiers/faxes in offices have introduced another 'capability'. This capability opens up the interesting possibility of programming the machine to fax everything that is printed or copied to an external location. Wouldn't someone notice? Possibly not, most large printers are in storerooms or open areas (eg nobody sitting beside them) and most people wouldn't have a clue what they are doing most of the time. Then there's another capability, the ability to place hidden codes on everything printed on a certain machine that enables 'investigators' to track that material back to that machine. You might ask how that is a security risk; well generally it's not, but if you ever want to make use of that 'information' to support a case (say data theft) that has gone to court you might find that your case collapses if the court doesn't like the fact that you didn't tell folk about the photocopiers traceability capability. Oh, and of course if you didn't know about the capability (because you'd never gone through the considered process of certifying the equipment) you would never have been able to take advantage of it.
What are the other advantage of certification, apart from ensuring everything is 'roped in' at some stage and considered. Well, a 'certificate' implies some kind of form (real or virtual) that means that we can incorporate a checklist which helps us (and particularly others) maintain a consistent standard of checking (or share the task). The 'form' is also a touchstone for auditors, and an anchor for change control processes.
Ok, if we accept that System Users, Equipment, and Applications should (or could be) certified, is it reasonable to propose that we apply the same approach to Agreements, Contracts, Services and Environments. For instance, if you employ a contractor to work in a secure area you probably already do a security background check on them (so they are in fact 'certified'), but if you send equipment off to be repaired (under a contract) what do you do to ensure that there's nothing on the machine that is 'sensitive'. Well you can ensure that the service agreement with the repairer includes a provision that imposes a DUTY on the folk shipping the thing off to repair to CHECK it first. You might also include some provision for liability if anything from the machine 'leaks' beyond the service centre should we have been so negligent as to send any there in the first place. Would we have overlooked this without Component Security Certification there to remind us? Possibly not. As to environment, if you have three phase power do you know which circuit is supplying power to your servers and what is to stop electricians turning them off without warning you? Do you know whether there are any sewer or water mains in the ceiling above your computer room? A formal certification process should lead you through consideration of all of these things.
Finally, getting back to the System User Certification. Perhaps there is some value we can add to that process after all. If you consider granting access as a process of certification, are you reminded that there may be cases where grant of access should depend upon the person being able to demonstrate competence at some level, or have some qualification. If you have a computer system that has significant health or financial consequences, should you 'let people loose' on it without going through a formal process of training and subsequent certification of their competence. Just a thought... and that is the primary aim of Certification, to suggest to people to 'stop and think for a moment' about what's happening around them.
Comments