2007 Issue 2 - Raytheon

Feature
Information Assurance:
A Holistic
Approach
Post-9/11, it became apparent that creating
a physical “ring of steel” around chosen
environments where security was the cornerstone
for safety and security was counterproductive.
It did not restore confidence in
our economy, our industries or our citizens.
A realization grew quickly that what was
needed was the ability to authenticate a
person claims, while still maintaining confidentiality.
These claims include 1) a person’s
identity, 2) their permission to be at a certain
place at a certain time,
and 3) their authorization to
perform certain activities.
This is not necessarily physically
bound — it is both
real and virtual.
Information Assurance (IA)
is the “process” by which
we protect and defend our
information and information
systems in order to
ensure confidentially,
integrity, availability and
accountability. IA also
extends to restoration,
with protect, detect,
monitoring and reacting
capabilities. Even if
you don’t understand
what this means, it is
still changing your
world.
Just as we experience in real life,
accountability closes the loop on any holistic
approach to IA. The access control environment
must allow an audit loop to be
established with someone responsible for
the activity in the loop. Hence, the holistic
principle of IA becomes confidentiality,
integrity, availability, accountability and
restoration. This means that IA becomes a
people-directed activity, with clear links of
responsibility to the individual through
association by identification.
As the real world becomes more and more
digitized, so does the need for irrefutable
authentication of people involved with
permission to be in that digital environment.
Authentication — or the ability to prove in
20 2007 ISSUE 2 RAYTHEON TECHNOLOGY TODAY
a non-repudiation approach that you are
who you say you are — then became integrated
with all other daily processes. At
that point, IA reflected the issues that safeguard
daily life. This is an important point
because it means that IA is, in fact, the way
we view digital life, and not a “bolt” in the
way information security, engineering security,
or operations security has been in the
past. In fact, IA is an integrated approach
to security, incorporating policy, technology
and security (personal, physical and environmental)
components, and must be
“baked” into the “process.”
Accordingly, real-life issues such as privacy
are justifiable ones for IA. Indeed, it will
become the principal issue to overcome:
the ability to prove your identity and that
you are entitled to the list of permissions
associated to you and the information you
access or distribute. This suggests that the IA
world is one of permissions (not rules or law).
As society embraces the net-centric world,
it is becoming overwhelmed with information.
We experience the knowledge age
(the application of information) as a society
hungry for information (some productive
and other destructive), so much so that
entire programs have been built around
achieving greater efficiency to access and
process knowledge.
I believe what 9/11 taught us is that people
matter. People must be identified in a nonrepudiatable
manner to allow society to
continue to operate in a safe and secure
way. Therefore, IA is not just about technology,
information or even infrastructures; it is
about protecting our most valued asset —
our homeland, citizens and way of life.
Raytheon is and has always been a customer-focused
organization. While everyone
else rushed to the IA “gold mine,”
Raytheon has been more vigilant, waiting
for others to catch up and really understand
what the issues are — truly adding
value to our clients’ mission-critical requirements.
So whether it is our clients’ highly
classified operating environment, a commercial
business, protecting our employees
at home and work, or our own business
operations, we practice what we preach.
We take pride in our holistic information
assurance program, and we enjoy a privilege
that we do not take for granted: being considered
your partners in transformation. •
Stephen R. Haynes
stephen_r_haynes@raytheon.com
PROFILE: STEVE HAYNES
Steve Haynes
is an entrepreneurial,broadbased
thought
leader specializing
in
Information
Assurance, an
integrated
approach to
security. Haynes
has extensive
hands-on
experience in
the strategic and tactical implementation of
e-commerce, e-government and e-business related
products and services. “With security, it’s no
longer about assessing or even managing the
risk,” said Haynes, “it’s about governing the risk.”
His 15 years of exemplary service in the security
field, coupled with 20 years in the credit card
industry, has earned him the respect of his
industry. “I take pride and pleasure in serving
my clients and focusing on their enterprisewide
mission critical needs.”
Noted for his visionary leadership and proactive
problem-solving approach, Haynes’s holistic
focus is on the process of protecting and defending
information and information systems. “My
goal is to make clients successful by providing
what we have learned and help them become
thought leaders in the Information Assurance
industry. This will enable them to meet their
mission-critical goals and objectives. That’s what
will keep them coming back again and again.”
An Information Assurance instructor at the
National Defense University, Haynes is periodically
asked to assist the U.S. government by
engaging in strategic joint agency tasks/initiatives.
He is also on retainer to the Executive
Office of the President and has been an advisor
to three presidential administrations and
numerous senior levels of management on a
regular basis. He is called upon to define overall
corporate strategic positioning and tactical
implementation to enhance corporate level
value and provide business advantage. A leader
by example, Haynes empowers resources to act
with speed, simplicity and self-confidence.
“My great grandfather used to say, ‘It’s not
enough to do things right, it’s as important to
do the right thing.’ And at Raytheon, we strive
to serve our clients with holistic solutions that
work — the first time, every time.”