|
Executive Perspective
An Executive Perspective on Viruses, Spam and Sarbanes-Oxley
Jonathan Schwartz
Executive Vice President, Software Group
Sun Microsystems, Inc.
Monday, Mar 1, 5:00 PM PST
When's the last time you made a prank phone call from your
wireless phone?
Or made a fake withdrawal from your ATM machine? Odds are,
you never have.
Here's why: It's because the carriers, on whose networks
your phone is
used, and the banks, on whose networks your ATM is operated,
go to great
lengths to know exactly who you are. They've used
multi-factor
authentication, coupling a password with the physical
presentation of an ATM
card in the banking scenario, or a Java Card SIM
(subscriber
information module) in the mobile handset example. And
strong authentication
has this funny impact on mischief. It prevents mischief from
even happening.
Now just ask yourself: How much confidence do you have
about who (or what)
is running on your corporate network? Chances are it's
nowhere near the
same level of confidence as the banks and wireless
companies. And unless you
find an alternative to the company that brought you the most
vulnerable
environment on the network today, you're in for an IT flu
season that may
never end. If the technical issues of loose control of
networks are not
enough to scare you, the additional pain of corporate
reporting and
accountability in the new regulatory environment should be.
If you thought
viruses alone were bad, the Sarbanes-Oxley Amendment now
requires an
unprecedented level of knowledge and surety surrounding who
has access to
what.
So in the ever increasing war on viruses, and in advance of
legislative
mandates, what can you learn from the financial institutions
and mobile
carriers that operate some of the safest, yet most open,
networks around?
First, it's time to implement multi-factor authentication.
With smartcard
readers shipped on most of the industry's PCs, and Java
Card support being
bundled into most PCs shipped by Dell, Hewlett Packard, and
a slew of
others, now's the time to understand how the world's most
popular smartcard
platform can help you secure your data and services. Just as
it secures the
mobile telephony industry, the US Government's Department of
Defense, and a
host of financial institutions.
Second, simplicity matters. You can't use your phone without
its SIM. You
can't use an ATM machine without your card. You shouldn't be
able to use
your PC without inserting your smartcard (whose authenticity
can be strongly
validated by a trust authority, such as a bank). A simple
integrated
smartcard offers far more reliable security than almost
anything else
-because it's simple. And therefore likely to be used, and
not bypassed.
And if you require smart card authentication, you'll
be able to instruct your email application to only show you
email from
individuals and employees who've presented a valid card, as
well. Just
imagine, spam would disappear instantly. As would phisher
frauds.
Authenticate the content, and viruses would vanish, too.
Third, taking those steps puts you way ahead of the game in
responding to
government mandates. Where do most security violations
emanate? From the
orphaned accounts of former employees, or from current
employees out to do
harm. Not black hat hackers. Your own systems and employees.
Think about it
- how long does it take you to issue the parade of new
accounts required by
a new employee? Probably longer than you spend
de-provisioning someone who
just left the company, and with no greater accuracy. Why?
Because you do it
manually, system by system.
And how can Sun Microsystems help?
We're the company that architected the Java platform and the
Solaris
operating platform, both on the assumption that we live in a
world that can be a
hostile place.
We engineered security in from the start - eliminating
buffer overflows in
Java, and integrating strong authentication at the outset
with the Java Card.
Spanning more than a billion instances, from smart cards to
home audio
equipment, handsets to supercomputers, the Java platform is
the most
comprehensive network execution environment ever invented.
And having been
built by and for the telecommunications industry, Solaris
has its roots in
the same belief system.
Sun Microsystems also recently introduced the world's most
secure
alternative to the Microsoft Windows platform, the Java
Desktop System. At a
tenth the price of Microsoft's products, you'll find a
breadth of security
infrastructure - from centralized management of application
features (the
best way to limit macro execution is to turn them off for
most employees),
to Java Card integration, and an inherent inability to run
Windows viruses.
Finally, and most importantly, we're a public company that
has to comply
with the same legislative mandates as our customers. We use
our own
infrastructure, from the market's leading directory and
identity
technologies, to the industry's most secure and efficient
access
provisioning technology. These authentication capabilities
can help
customers start to address government reporting
requirements, while keeping
MyDoom, and every other network intruder, well beyond arm's
length.
Network security can never be about building a bigger moat
and firewall.
Defensive security measures can only go so far. Going on
offense,
proactively authenticating and provisioning users and
services, is the only
way forward to defeat spam and viruses, and ultimately help
manage your
fiduciary obligations.
 Back to top
|
|
