Toward Systemically Secure IT Architectures

Toward Systemically Secure IT Architectures

by Glenn Brunette
February, 2006

The convergence and availability of greater numbers of computers, mobile phones, PDAs, and other devices are fueling new opportunities and new styles of sharing, participation, and commerce. Traditional organizational and network boundaries continue to blur and fade as organizations find new ways of engaging their customers, partners, suppliers, and employees. Furthermore, the delivery of services is becoming more streamlined, as associations among components and data become more dynamic in response to "just in time" business decisions. Unprecedented levels of access and sharing are fast becoming the norm and helping to fuel what is being called "the Participation Age."

Security risk accompanies all of the benefits that these opportunities offer — risk that cannot and must not be ignored. Attacks on IT resources can now be executed on a global basis, using the Internet or other communications networks, at speed and on a scale previously unknown. News of identity theft, industrial espionage, and the ever-present insider threat is rapidly increasing. While many of the common attack methods have largely not changed over the last ten years, their impact has been amplified as a result of a significantly increased number of potential targets, increased levels of dependence and connectivity among targets, and heightened levels of attack automation, making the attacks easier to configure and execute on a global scale.

This Sun BluePrints OnLine article addresses the need for strong security guarantees in increasingly dynamic and flexible information technology (IT) environments. The Sun Systemic Security approach applies time-tested security principles, architectural patterns, and iterative refinement policies to weave security controls and assurances more systemically throughout an IT environment. Using a pattern-based approach and a focus on iterative refinement, organizations can transform their existing legacy deployments into resilient architectures that meet not only their security, privacy, and compliance needs, but also satisfy other business goals, such as increased agility, flexibility, efficiency, and availability. In fact, this approach can be used to help drive the adoption of new service and utility-based compute architectures.