Security capability reference model for goal-based gap analysis

#This invention generally relates to technologies for effective use of system security capabilities, and for detecting and correcting gaps between security policy and deployment realities.

#Government regulations and industry standards drive security requirements in computing system environments for the protection of the resources and information they store. Unauthorized use of the resources, such as transmission and store-and-forward capabilities, can aid in illegal and malevolent activities, with loss of potential revenue to the equipment owner. Unauthorized access to data stored by the computing systems can lead to identity theft, fraud, and even loss of physical security of high-stakes facilities such as nuclear power plants, government buildings, chemical processing operations, etc.

#Today, there are many regulations and standards with which businesses and other entities need to comply. For example: (a) United States Title 21, Code of Federal Regulations (CFR), section 11 for the U.S. Food and Drug Administration (FDA) outlines how pharmaceutical manufacturers submit electronic records to the FDA. A key aspect of the electronic record is an affixed digital signature. (b) The German Bundesdatenschutzgesetz, or “Federal Data Protection Act” demands strong controls from enterprises regarding how to collect, process and release personally identifiable information (PII). It particularly outlines protection requirements (access control and encryption). (c) The United Kingdom's Data Protection Act of 1984, among other things, requires that PII is not propagated or transmitted outside European Union (EU) boundaries unless the owner has explicitly agreed to that. (d) U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) mandates some specific usage of encryption for storing private personal health information (PHI).

#The description set forth herein is illustrated by the several drawings.

#FIG. 1 provides an informal visualization of a security capability reference model according to the present invention.

#FIG. 2 illustrates a security capability reference model according to the present invention.

#The inventors of the present and the related invention have recognized problems not yet recognized by those skilled in the relevant arts regarding gaps between security policy, computing system security capabilities, and the actual security implementations of a particular computing enterprise.

#Bearing in mind the regulatory and standards-driven security requirements as discussed in the Background section of this disclosure, the present inventors further consider the following realities of current state-of-the art computing systems.

#First, there are many existing software capabilities addressing the security requirements to one degree or another. The currently available security capabilities addressing these requirements are available according to different technologies such as: (a) firewalls; (b) Lightweight Directory Access Protocol (LDAP) technologies (e.g., Tivoli Directory Server™, Apache DS™, etc.); (c) encryption technologies and protocols (e.g., TrueCrypt™, secure sockets layer (SSL), etc.); and (d) Data Masking (e.g., IBM's Optim Test Data Management™).