Modeling Security Workshop

Invited Talk: Neil Cooke, University of Surrey

This presentation examines the Information Assurance (IA) challenge in software engineering from a National Technical Authority (NTA) perspective on accreditation, evaluation and IA research. Most countries have NTAs that support IA in government and set standards for products and systems used in government. The UK NTA is a significant organisation of about 500 people and is based in Cheltenham. The classical model for security is to consider functional requirements, identify the threat in terms of data value, loss impacts, mechanisms of threat, opportunity and then to identify mitigations and residual risks that have then to be managed.

The move from the communications age to the information age is changing the shape of the whole IA world. The problem space and functional complexity is expanding at a rate that challenges Moore's Law. It is no longer possible to evaluate solely by examining the security critical aspects because they do not exist as physical elements any more; they are virtualised across the whole system. In this environment to maintain Assurance & Evaluation capability for Confidentiality, Integrity and Availability there must be increased use of higher-level concepts, modelling and automated toolsets. Whole system modelling is fast becoming the method of choice for the evaluation and test of IA critical systems.

Neil Cooke. BSc(Hons), Computer & Control Systems, Lanchester Polytechnic, Coventry, UK, 1981 (now University of Coventry); Chartered Engineer 1987; Fellow of the Institute of Engineering Technology 2005. The speaker has 18 years of experience in the field of information assurance engineering for the UK government's National Technical Authority for Information Assurance. Prior to this he was an avionics and marine systems engineer, specialising in navigation systems, control systems and platform sensors. The speaker is currently studying part time for a PhD at the University of Surrey. The research subject area is context sensitive filtering of emails.