I have to say that I think last week’s open meeting of the Jericho Forum was the best one yet. I’d like to claim some small credit for that, since I led the first morning’s discussion session on Client Security in a Deperimeterized World (my my slides), but the reality of it was that we had a room full of smart, eloquent people consistently challenged themselves and each other to extend and refine their thinking. Ian Dobson, the forum’s Director, asked for “stimulating” and I told him that I was aiming for “lively.” I think I succeeded and the momentum carried over into the the rest of the sessions as well as the breaks, meals, and drinks.

The official notes aren’t out yet, but the key take-aways that I observed from the participants were. Please correct any mis-perceptions or items I overlooked in the comments. I wasn’t able to take notes since I was busy working the room.

1. Users do not feel that loss of control/functionality for enhanced protection of (corporate) information/resources is an acceptable trade-off. They still want to have their cake and eat it too.
2. People are not sold on DRM. People almost universally felt that it’s still extremely immature and will only be applicable for limited use cases for some time to come. Still, people are not giving up on it, but rather taking a wait-and-see approach There was agreement that data needs to be able to “defend itself” and we can’t count on the client to provide a secure environment, including TPM. There was also some discussion (but no clear agreement) as to how much this is a People Problem and how much is a Technology Problem, and where the point of diminishing returns on efforts to tackle either problem will eventually settle.
3. NAC is not the answer. If anything, it’s the anti-deperimeterization.
4. Microsoft-y protocols are sill hard (Domain traffic, NetBIOS, etc). Some of the MS people disputed this, but about half of the MS people in attendance agreed that, even if it’s possible (with lots of ISA servers & effort), protecting the traffic is still too hard for general IT use.

In general, I’m seeing a growing awareness of deperimeterization in both the IT and business worlds today. With growing frequency, when I talk to people about their information security issues, they’re now aware that those issues are often related to the eroding perimeter, they just didn’t know it had a name. This is a big change from a year ago, when most people I spoke with still weren’t even aware there was a problem.

[…] Finally, if you haven’t seen it already, our friend Chandler posts (Belated) Notes from the Jericho Forum. […]

Pity there’s no audio to go with those slides. :)

BTW, I looked around and could not find any direct contact information for you. Please drop me an email.

Rgs,
Craig Dore
(covertc AT covertcreations.removethis.com)