it:ad:6a:home

IT:AD:6A

* (UP)

* See also:

Summary

IT:AD:5A is well known security term, derived from the Air Force, but misses a couple of key concerns: Auditing and Appropriate filtering out attributes depending on authorisation.

IT:AD:7A supercedes this principle.

The goal is to provide access to systems and their data.

* Anytime (ie: afterhours, and reduce downtimes). * Anywhere (ie: from within and outside of corporate firewalls)

  • Meets Accessible Values, And Accessibility Qualities

* Anyhow (ie: any device, that does not require special plugins, client certs, etc.) * Anyone (ie: available to any system or person – anonymous or identified – but will be filtered Appropriately based on Authorisation)

  • Meets Protective Qualities

* Appropriate (ie: provide filtered projections which strip out sensitive data)

  • Implements Clemency Values
  • Meets Resilience Qualities

* Audited (ie: all – including Views – operations are audited, as well as monitored and automatically alert as required).

  • Meets Accountable Values,
  • Meets Accountability Qualities

Note that IT:AD:5A's Authorisation is dropped in favour of Appropriate. Although Authorisation is maybe more common – possibly due to its ease of implementation – it remains a crude binary state (you are either have the required role or not). Whereas an Appropriate response can be more nuanced: it might always provides an query response regardless of role, but project more or less Attributes based on an authorisation assessment.

For example:


!includeurl http://skysigal.com/_media/resources/configuration/plantuml/minimalist.txt

class Person {
ID : Guid
PublicMoniker: text
DisplayName: text
FirstName: text
LastName: text
NationalID: text
DOB : date
Enrolled:bool
}

class "Public API Projection 1" as P1 {
ID : Guid
PublicMoniker: text
DisplayName: text
NationalID: text
DOB(): int
}

note bottom of P1
Core and sensitive
data is shared
with other certified
agencies
endnote



class "Public API Projection 2" as P2 {
ID : Guid
PublicMoniker: text
DisplayName: text
DOB(): int
}

note bottom of P2
Core data -- excluding
sensitive bits --
is shared with
other agencies
and authorised
users
endnote


class "Public API Projection 3" as P3 {
DOB(): int
Enrolled:bool
}

note bottom of P3
No sensitive data is
shared
endnote


Person -- P1
Person -- P2
Person -- P3