Challenges	  for	  making	  scalable	  security	  management	  for	  informa5on	  and	  communica5on	  infrastructure	
Prof.	  Dr.	  Suguru	  Yamaguchi	  Graduate	  School	  of	  Informa5on	  Science,	  	  Nara	  Ins5tute	  of	  Science	  and	  Technology,	  Japan	Overview	
• Management	  of	  informa5on	  security	  has	  No.1	  priority	  in	  opera5on	  of	  informa5on	  infrastructure	  for	  various	  organiza5ons	  in	  both	  public	  and	  private	  sectors.	  Adding	  more	  components	  such	  as	  mobile	  devices	  and	  cloud	  compu5ng	  clusters	  has	  made	  the	  more	  complicated	  reality	  for	  infrastructure	  management	  tasks.	  Introducing	  various	  technology	  and	  engineering	  for	  improving	  the	  scalability	  on	  informa5on	  security	  management	  is	  highly	  required	  today,	  otherwise,	  management	  tasks	  overﬂows	  with	  various	  security	  management,	  especially	  for	  data	  security	  management	  in	  huge	  space	  of	  storages.	  	  In	  this	  invited	  talk,	  the	  speaker	  summarizes	  the	  current	  situa5on	  on	  rapidly	  changing	  aspect	  of	  informa5on	  infrastructure,	  and	  overviews	  technical	  requirement	  on	  security	  management	  for	  today.	  	  The	  speaker	  also	  introduces	  his	  challenges	  on	  such	  scalability	  improvements	  for	  security	  management	  tasks.	

Social	  Infrastructure	  and	  ICT	3	

Connected	  World	  &	  Shared	  Responsibility	
Plant	  Management	

Power	  Supply	Traﬃc	  mgmt.	

Automobile	

Home	  Appliances	

The	  Internet	  IC	  Card	  Cellular	  Phone	

RFID	  Individuals	

Avia5ons	Finance	  Services	
Medical	  Service	

Online	  banking	

Ticket	  Reserva5ons	
ATM	  4	Where	  we	  are	  heading?	
• Widely	  ICT	  deployment	  to	  social	  infrastructures.	  
• We	  are	  living	  in	  “Connected	  world”	  where	  more	  informa5on	  are	  exchanged	  and	  processed	  among	  vast	  number	  of	  computers	  and	  ICT	  devices.	  	  • True	  ICT	  society	  – Covers	  our	  whole	  globe.	  
– Knowledge	  based	  economy.	  
– Global	  op5miza5on.	  
– High	  mobility	  of	  users,	  informa5on	  processing	  and	  assets.	  

5	Roles	  of	  Informa5on	  Systems	
• Informa5on	  storage	  &	  repository	  • Process	  reuse	  with	  economic	  eﬃciency	  • Handling	  “money”	  • Parallel	  process	  to	  manage	  many	  devices	  (e.g.	  sensor	  networks)	  • “Business	  Enabler”	  – Implement	  their	  business	  model	  on	  informa5on	  systems.	  
• Agile	  development	  for	  quick	  more	  turnover.	  	  – Direct	  improvement	  on	  economic	  eﬃciency	  through	  integra5on	  and	  interconnec5on	  of	  the	  systems.	  
– New	  style	  of	  “value	  crea5on”	  	  6	

Could	  Compu5ng	
• Massive	  compu5ng	  resource	  shared	  through	  “virtualiza5on”	  with	  many	  other	  customers.	  
– Mobility	  of	  Compu5ng	  – Data	  in	  Huge	  storage	  shared	  – On-­‐demand	  assignment	  of	  resources	  and	  its	  op5miza5on.	  

7	High	  Spec	  Mobile	  Device	  available	  TODAY	• Powerful	  Processing	  Power（CPU,	  memory）	  • Huge	  Storage（HDD,	  SSD,	  etc.）	  • Full-­‐spec	  Networking	  （WiFi,	  IPv6/v4)	  • No	  big	  changes	  with	  laptop	  PC	  – Needs	  system	  management	  and	  integra5on.	

8	

Global	  Distribu5on	  of	  func5ons	  (ex.)	

Our	  VMs	Our	  storages	

Our	  management	
ASEAN	  Our	  Customers	
9	Exper5se	  we	  know	  very	  well	“What	  is	  manageable	  should	  be	  measureable.”	  	  • Works	  based	  on	  “hypothesis	  tes5ng.”	  • Ra5onality	  in	  management	  tasks	  (and	  investment)	  • Transi5on	  from	  Qualita5ve	  Analysis	  to	  Quan5ta5ve	  Evalua5on	

10	

Scien5ﬁc	  Approach	  in	  Security	  Management	○	  Incremental	  &	  con5nuous	  improvement	  on	  informa5on	  systems	  ○	  Measurement,	  iden5fying	  problems,	  veriﬁca5on	  ○	  Changes	  of	  “system”	  itself	

Measurement	Analysis	

Mgmt.	  tasks	  performed	Problem	  iden5ﬁca5on	

Business	  IT	  placorm	  11	Good	  Scalability	  highly	  required	

Input	  from	  managed	  devices	  (their	  status	  info.)	

?	

Business	  IT	  placorm	  Output	  to	  managed	  devices	  (tasks	  for	  maintenance)	

12	

Overhead of management	

Scalable,	  Sustainable	  and	  Resilient	  Management	Course	  of	  collapse	#	  of	  components	  to	  be	  managed.	

Acceptable?	  
e.g.	  O(n)=log	ideal	(ini5al	  cost)	

# of Components in Info. Sys.	
13	

Cost of management	

TCO	  &	  Cloud	  Compu5ng	

(ini5al	  cost)	

Without	  Cloud	  Service	With	  Cloud	  Service	(SME)	

(Large	  ﬁrms)	Number of Components	
14	

Cost of management	

TCO	  &	  BYOD	
With	  BYOD	

Without	  BYOD	

(ini5al	  cost)	

Number of Components	
15	

Cost of management	

TCO	  &	  Risk	  Diversiﬁca5on	Now	  &	  the	  future	

Before	(ini5al	  cost)	

Number of Components	
16	

Economics	  of	  Cyber	  Crimes,	  Today	Risk	

Eﬀort	

Reward	17	Economics	  of	  Cyber	  Crimes,	  Tomorrow	?	

Risk	

Eﬀort	

Reward	18	No	  Silver	  Bullet.	  
No	  Free	  Lunch.	

19	

Solu5ons	
• “Security	  by	  Design”	  – Beier	  design	  of	  informa5on	  systems	  that	  work	  ﬁne	  with	  good	  security	  func5ons.	  
– Addi5onal	  security	  func5ons	  tends	  to	  be	  not	  enough	  for	  protec5ng	  systems.	  

• More	  on	  Informa5on	  Lifecycle	  management	  – Giving	  more	  tools	  for	  every	  stage	  of	  “informa5on	  lifecycle”	  – Especially	  protec5on	  measures	  using	  powerful	  encryp5on	  placorms.	  
• For	  conﬁden5ality,	  integrity	  and	  authen5ca5on	  purposes.	  

• Automa5on	  on	  Management	  tasks	  – Cost-­‐eﬀec5ve	  use	  of	  human	  resource	  – “We	  should	  do	  what	  men	  only	  can	  do.”	  • Educa5on	  and	  awareness	  raising	  – Long	  term	  solu5on,	  though.	

Informa5on	  System	  Lifecycle	
Design	  of	  the	  system	• Iden5fying	  requirements,	  Analysis,	  BCP、…	

Evalua5on	

Development	

In	  opera5on	
21	Informa5on	  Lifecycle	

Create	Use	Store	
Transfer	
Publish	

Delete	22	Automa5on	  on	  Security	  Management	
• “We	  should	  do	  what	  men	  only	  can	  do.”	  • We	  can	  not	  make	  everything	  automated,	  but	  we	  are	  now	  using	  less	  automa5on	  on	  security	  management	  tasks.	  
– Monitoring	  using	  IDS	  for	  anomaly	  detec5ons.	  
– System	  registra5on	  for	  management	  and	  resource	  assignment	  purposes.	  

• Using	  more	  engineering,	  some5me	  we	  need	  to	  apply	  technology	  for	  the	  other	  domain.	  
– Signal	  processing,	  Robo5cs,	  etc.	

Summary	• Informa5on	  systems	  in	  our	  society	  now	  supports	  various	  roles	  as	  our	  cri5cal	  infrastructure.	  
– “Business	  enabler”	  – ICT	  system	  in	  cri5cal	  infrastructures	  • Security	  is	  No.1	  priority,	  but	  we	  need	  to	  change	  our	  approach	  to	  implement	  to	  the	  informa5on	  systems.	  
– Good	  scalability	  – “Security	  by	  Design”	  – Automa5on.