Proceedings in pdf format. - Sociotechnical Systems Engineering ...

NECESSITY OF NEW LAYERED APPROACH TO NETWORK SECURITYDmitry KryukovRiga Technical UniversityE-mail dmitrijs.krjukovs@riga.lvKEYWORDSLayered approach, network security, security model.ABSTRACTSecurity solutions for networks typically appear assingle products or protocols that correspond to a single orfew layers of the OSI network reference model (protocolstack). The result is a wide variety of protocols andproducts, which provide solutions to very specificproblems and environments.In this paper, defense-in-depth strategy is analyzedand it’s introduced the need for layered architecture forsecure networks. Adoption of a layered approach leads tomany advantages in secure network design: modularity,flexibility, ease of standardization, etc.INTRODUCTIONSystem and network security is a key technology tothe development and wide deployment of applicationsand services in the information society. Security ismission critical at various levels: computing systems(servers and clients), network, and applications.Although network security is a critical requirement inemerging networks, there is a significant lack ofmethodologies that define easy-to-adopt rules and stepsto build secure networks.NETWORK DESIGNNetwork design is a well-understood process, despitethe arguments for and against the various protocols andapproaches. There are many approaches to securenetworks, such as proposed by Cisco (Cisco 2005),Nortel (White Paper 2006) and others which describehow to raise level of security using some technologiesand products in combination with secure architecture.Some of approaches concentrate mostly on networkarchitecture issues from telecommunications perspective,some have offset to IT solutions. But the thing thatmajority of approaches have in common – they mostlyare based on some ISO Open Systems Interconnect (OSI)Reference model’s layer hardening and their serviceprovision is based mostly on their own products.Mostly all approaches have commercial nature anduse brand and in some cases proprietary solutions such asspecific protocols and appliances. Such approach tonetwork security leads to situation when it consideredthat secure network is nothing more than securearchitecture and management plus up-to-date andcarefully patched software.NETWORK SECURITY ARCHITECTURESERVICESVarious forms of security-enhancing technologieshave received research attention. Security hastraditionally been defined in terms of the threecornerstones of security: confidentiality, integrity, andavailability. While confidentiality has been the focus ofprevious technical solutions, it is the balance between allthree dimensions that is required. Neglecting to addresseither one of the cornerstones will result in inadequatesecurity. On the other hand, a state of security assurancecan be achieved if all of the cornerstones have beenaddressed. In addition to confidentiality, integrity, andavailability, ISO 7498-2 identifies a range of types ofsecurity services and mechanisms. The standard definesfive security services:• Confidentiality: information will be keptsecret, with access limited to appropriatepersons;• Integrity: information will not be accidentallyor maliciously altered or destroyed;• Authentication: identity verification of anyentity;• Non-repudiation: communicating peer cannotdeny (later) participation in a communicationexchange;• Authorization and Availability: assuringinformation and communication services will beready for use for authorized parties whenexpected.The standard thus adds the dimension of accesscontrol as well as the notion of non-repudiation.Access control has always received ample interest in thesecurity domain. Non-repudiation has becomeAnnual Proceedings of Vidzeme University College “ICTE in Regional Development”, 2006127