Compaq 108164-003 - ProLiant - 800 White Paper page 10

W P
HITE APER
(cont.)
. .
. .
. .
. . U
N D E R S T A N D I N G
. .
. .
Compaq has laid out a security framework that provides a common set of easily understood terms
. .
. .
with which to discuss security and to plan the deployment of security solutions. Computing security
. .
can be understood in terms of three inter-related dimensions (see Figure 5).
. .
. .
. .
. .
. .
. .
. .
. .
. .
1
. .
Security Objectives
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
First, a complete security solution is defined by a set of security objectives. Second, products and
. .
. .
technologies divide security solutions into categories that make it easy for enterprises to understand
. .
the types of solutions they are deploying. Lastly, platforms define the types of resources the
. .
. .
solution is attempting to protect (those serving single users on the device, those serving groups of
. .
internal network users, or those serving users across the Externet). Using these terms, Compaq's
. .
. .
enterprise customers can better understand the market for security products and easily map out the
. .
.
solutions they require
. .
. .
. .
Defining the objectives of security (see Table 1) is a critical step for IT managers because these
. .
objectives clarify the boundaries of a complete solution and enable managers to classify the diverse
. .
. .
performance of today's security products. A complete enterprise security solution will integrate
. .
products that meet these objectives across all platforms.
. .
. .
. .
. .
TABLE 1: DEFINING THE OBJECTIVES OF SECURITY
. .
. .
Objective Definitions
. .
. .
Ensuring true identity equals apparent identity; users and systems are protected from parties who
. .
Identifications &
. .
impersonate other users and systems
Authentication
. .
. .
. .
Ensuring parties have access to only those resources they are authorized to use; information,
. .
Authorization/Access
applications, and other system resources are protected from unauthorized access, use or distribution
. .
Control
. .
. .
. .
Ensuring sensitive data is understandable only to appropriate parties; information is protected from
. .
Privacy
unauthorized monitoring, access distribution, use, and name association
. .
. .
Ensuring data/resources, information, and computing environment is protected from unauthorized
. .
Integrity
. .
manipulation and alteration
. .
. .
Ensuring accurate, verifiable activity and transaction information is monitored and recorded; companies
. .
Accountability
and individuals are protected from repudiation, or misrepresentation of actions or transactions
. .
. .
10
S
E C U R I T Y
— Security Dimensions —
Computing Security
2
Security Products/Technologies
Figure 5
3
Security Platforms