Abstract :
We present a new model to conduct security evaluation of remote assets with dedicated profiles. An alternative approach to risk management in information assurance (IA) and a related protocol for remote evaluation of information assets is presented here. Application of this protocol ensures long-term risk management, hence efficient proactive lifecycle protection of critical information systems. Due to its generic and interoperable structure based on the modern Web technologies, the protocol can be applied to risk assessment and evaluation of a multitude type of systems. The protocol consists of a secure communication architecture associated with each asset a security profile, and software services and agents that communicate over the Internet and other open networks. The secure communication architecture uses a secure exchange protocol incorporating the fast elliptic curve cryptography. Interoperable, continuous, inexpensive, time- and location-neutral, and minimum resource usage are some of its advantages. With this new notion, we also aim at inspiring developers and researchers to develop value-added security evaluation tools, techniques and procedures
Keywords :
cryptography; information systems; open systems; protocols; risk management; software agents; Internet; Web technologies; fast elliptic curve cryptography; information assets; information assurance; information systems; open networks; proactive approach; proactive lifecycle protection; remote IT security evaluation scheme; remote assets; risk management; secure communication architecture; secure exchange protocol; security profile; software agents; software services; value-added security evaluation tools; Communication system security; Computer architecture; Cryptographic protocols; IP networks; Information security; Intelligent agent; Management information systems; Protection; Risk management; Web and internet services; Proactive IA; Verification and validation of security; remote assessment; risk analysis and security management; security evaluation; security protocol.;
