Military Communications and Information Technology: A Trusted ...

44 Military Communications and Information Technology...
Through standardization, access to ‘best practice’ is possible, and wide use of a public
standard is an endorsement of that technology. Even if the details of a system’s
technical operation is known, it cannot be compromised due to the strength of,
and confidence in, protection mechanisms within the system. This can lead to
system owners adopting a more sensible risk posture; instead of trying to develop
costly, custom-made security solutions, a posture of adopting open standards
and technologies may result in more thought being given to appropriate levels
of security – resulting in a move to a ‘risk balanced’ approach, which is based on
careful analysis of the threat, rather than a ‘protect against everything’ mentality
which is financially inefficient and increasingly more difficult to justify. Openness
as a posture may also be a deterrent to some attackers as it demonstrates confidence
in your protection mechanisms. Particular security mechanisms can be adopted
to deter would-be attackers, for example if an attacker knows they will be traced
then they may be less likely to attack.
Whilst there are clear benefits from using standardized and interoperable security
mechanisms, public disclosure of a security mechanism is still seen as a risk
to security: attackers are given an awareness of how the system works, without
requiring the effort involved in reverse-engineering which decreases the skill level
needed for basic attack attempts. There is also a concern that successful attacks
against a public standard may not be disclosed.
Whilst a more open and standards-based approach to security can enable
interoperability, the increased information disclosure has a risk of making
it easier to identify attack vectors against a system and reducing the level of skill
needed to attack a system. Moving from a small number of trusted suppliers
to a potentially global market for providing security mechanisms will result
in a wider range of available technical options, but may also require a different
stance to be taken with respect to trust in sourcing components and provenance
of software and hardware.
D. Technical case studies: MOSA, GVA and LOSA
This paper will now outline the MOD case studies which refined the principles
for developing open systems which have been stated above.
MOSA has delivered a technical architecture, an enterprise model and a migration
strategy and has progressed issues such as the management of Intellectual
Property Rights (IPR), designing for modular test and acceptance and designing
for modular certification and accreditation.
MOSA aimed to provide a standardized structure for flexibly assembling
combat system components to provide an overall combat capability using looselycoupled,
non-proprietary, published interfaces. The fundamental characteristic
of MOSA is that combat systems will be constructed of replaceable modules i.e.
components will be upgradeable and interchangeable.