HP ProLiant 4500 Compaq Enterprise Security Framework - Page 10

WHITE PAPER (cont.) ... UNDERSTANDING SECURITY Compaq has laid out a security framework that provides a common set of easily understood terms with which to discuss security and to plan the deployment of security solutions. Computing security can be understood in terms of three inter-related dimensions (see Figure 5). - Security Dimensions - 1 Security Objectives 3 Security Platforms Computing Security 2 Security Products/Technologies Figure 5 First, a complete security solution is defined by a set of security objectives. Second, products and technologies divide security solutions into categories that make it easy for enterprises to understand the types of solutions they are deploying. Lastly, platforms define the types of resources the solution is attempting to protect (those serving single users on the device, those serving groups of internal network users, or those serving users across the Externet). Using these terms, Compaq's enterprise customers can better understand the market for security products and easily map out the solutions they require. Defining the objectives of security (see Table 1) is a critical step for IT managers because these objectives clarify the boundaries of a complete solution and enable managers to classify the diverse performance of today's security products. A complete enterprise security solution will integrate products that meet these objectives across all platforms. TABLE 1: DEFINING THE OBJECTIVES OF SECURITY Objective Definitions Identifications & Authentication Ensuring true identity equals apparent identity; users and systems are protected from parties who impersonate other users and systems Authorization/Access Control Ensuring parties have access to only those resources they are authorized to use; information, applications, and other system resources are protected from unauthorized access, use or distribution Privacy Integrity Accountability Ensuring sensitive data is understandable only to appropriate parties; information is protected from unauthorized monitoring, access distribution, use, and name association Ensuring data/resources, information, and computing environment is protected from unauthorized manipulation and alteration Ensuring accurate, verifiable activity and transaction information is monitored and recorded; companies and individuals are protected from repudiation, or misrepresentation of actions or transactions 10