Zombie killer advice

Suresh Madhavan, a member of my Cyber Privateer Fantasy League team, just sent me some thoughts on the RIGHT way corporations should attack email and file security. If you click on the above link and then to his bio, you'll see he was a roommate of Stephen Hawking and is an off-the-charts genius. His company, PointCross, delivers…well…unbreakable security. Here are two cogent paragraphs that deserve some serious attention:

Most publicly traded companies and those dealing with sensitive technology and intellectual property will admit privately that they are not just being hacked by outside attacks but also from within. Some will report hundreds of attacks from on any given day - and not all are from malware, either. The IT approach of putting up more defensive barriers is also getting a lot of push back from the business users who want to increasingly access their content from remote mobile devices, including phones and tablets, using any network that is available. Ideas like separating data into separate infrastructure as commonly suggested is not going to work if we take a longer view of security, compliance, and convenience.

The proven principles and decades of experience with defense security classification of information should be applied for a sustainably secure information environment. To accomplish unbreakable security a very highly granular RBAC (Role Based Access Control)—well beyond what is available in typical enterprise applications and data bases and well beyond the guidelines of NIST—is required. ACLs (Access Control Lists) are a major weakness in security systems. Instead, classifying information based on business sensitivities and providing mapping to business and project roles is far more scalable and secure. Current implementations of RBAC just don't cut it. The separation of information must not rely on separate infrastructure - far from it, it must use a virtualized, abstracted data representation above and beyond what the traditional RDBMS databases can provide. Information—whether structure data or unstructured content—must be stored and transmitted with a self-declarative wrapper that carries encrypted information about the payload. Existing facilities for encryption, DRM, PKI are all well and good and they will continue to be exploited. But it is how information is classified—how it is stored, how it can be searched and the authorization rules mapping a user's right to view those results—require some extraordinary technology above and beyond the limited, slow, RDBMS world. It is very possible to control and manage a secure enterprise information network even when malware and malicious people lurk within the network. What it requires is a lot of common sense and less IT widgeting.

If you read between the lines, it just might dawn on you that Mr. Madhavan has cracked the Zombi killer code. Which I why he's on my Cyber Privateer Fantasy League team.