Proceedings of 8th European Assembly on telework (Telework2001)

81Security and usability tend to be contradictory requirements. When making systems more secure,we are normally also making them less usable. E-work is something that should work on the terms<strong>of</strong> the ordinary user, that is, be usable to everybody. Combining security and usability is a majorchallenge <strong>of</strong> our times.5. Secure E-work – a visionInternetworking will continue to develop and spread to new areas <strong>of</strong> application. Economies <strong>of</strong>scale will drive virtually all applications to use the main-stream IP technology. With mobility,quality <strong>of</strong> service, and security as basic service <strong>of</strong> the next generation Internet, we will have aglobal generic platform to base E-work on.IPSEC and public key infrastructure will effectively protect against unauthorized disclosure andmodification <strong>of</strong> network traffic. Sufficient redundancy in the network will protect agains denial <strong>of</strong>service. All this can be achieved with inexpensive standard solutions that will continue to comedown in price.So, the technological platform for secure E-work is forming and the networking aspects <strong>of</strong> securitycan be solved. However, when we are dealing with people and complex information flows, there isno simple standard solution to the security <strong>of</strong> the entire system. A lot <strong>of</strong> work is required to definethe core business processes with their associated information flows and security requirements.Security needs to be designed into these processes. Standard security mechanisms need to beapplied to make sure that the information systems used do not compromise the security <strong>of</strong>information flows.There are no known methods for proving the security <strong>of</strong> entire processes. We need to buildcontinuous monitoring and feed-back into our processes. Also, auditing by an outside party (notresponsible for implementing or running the systems) is necessary.We have, hopefully, reached a stage, where the ever increasing processing power and othertechnological achievements will be made serve people. Usability <strong>of</strong> any information systemsalready is a major challenge. Combining security with usability is even more difficult. The maingoal <strong>of</strong> systems design should not be to optimize the use <strong>of</strong> ever cheaper computing resourcesbut to make the work <strong>of</strong> people increasingly efficient and pleasant. This is an interesting interdisciplinaryreasearch area that can only be expected to grow in importance.The weakest link <strong>of</strong> security will continue to be people and their attitudes. Time after time, themain cause for major security breaches turns out to be the unauthorized behavior <strong>of</strong> authorizedpeople in their daily tasks. While technical measures and secure scalable technical platforms arenecessary for the success <strong>of</strong> E-work, they cannot compensate for shortcomings in the non-technicalaspects <strong>of</strong> security. Security needs to be defined, designed, and built into work processes. Peopleneed to be well instructed, trained an motivated. There also needs to be monitoring and feed-backas well as independent auditing. This requires commitment <strong>of</strong> entire organizations starting fromtheir top management. The possibilities <strong>of</strong>fered by E-work are such, that the time and effort should,on the leng term, prove to be well spent.