The Open Group Security Forum with Jim Heitala & Sean Mullen

Yeah, the Forum has been run quite well for a number of years. I want to carry that on. I also want to expand in some new areas of security, especially with cloud security, virtualization. There's a lot of areas, especially in the virtualization layer, that we can have standards. Four or five years ago we would be saying it's safe to go to the cloud, safe to go to a virtualization model, but now with the technology we're putting in the virtualization, we can bring security technology and features that weren't possible in the old monolithic computer systems. The problem is those security technologies have gone into the virtualization layer but there's no standards around it, so it's difficult to manage. The security technology is great but the burden of managing those security technologies is high. If we have standards on those, then we can create management that's homogenized across all the different virtualization platforms. Now we've got a good autonomic security solution that covers it from the virtualization layer up through the OS and applications, and that's one of the directions I want to take the Forum.

There is a time commitment depending on your level of involvement, but there's a return on that also. When I'm doing my day job, architecting security products, I've been able to stay laser focused on the technologies I need to bring to market, but my aperture and understanding is much broader across the enterprise. I think those rewards have come back, they've been reflected in the products that we've released. PowerSC is an example that looks at dependable, simple, return on investment across the enterprise. It's not these little siloed security features; it's much broader than that. That's what The Open Group has returned to me for my investment of time driving these standards and participating in these conversations.

That's been a great opportunity for us to take some of the initiatives that we've had within the Security Forum, like the Risk Management Taxonomy, and bringing that and inserting that into the next TOGAF. This is important because all of these different disciplines stay focused and drive in their direction and that's good, but this gives us the opportunity to merge the two and have a stronger TOGAF Next with the latest and best security technologies that we've been developing on our side.

This has been a real success. This is something where the major Unixes got together: HP-UX, Solaris, Linux represented there, and of course AIX. It was a problem with RBAC, role based access control. We all had our RBAC versions, they were very similar but there was a management issue. So we were able to come out with some basic roles and define those. One of the rewarding experiences is working with our competitors, especially HP-UX and Solaris, really understanding their technology but coming together for a common solution that benefits all of our customers. You go into almost any large enterprise, they're going to have a variety of Unixes and Linux, and this helps them manage it in a similar manner.

Yeah, that was one of the first standards I worked on. OSML is the Open Group Automatic Compliance Expert Markup Language. It's mainly about authoring compliance in an XML form. Every time my left foot hits the ground there's a new regulatory compliance out there with their own definition of how to configure systems, how to do security. OSML allows them at a very high level to say, for example, 'I want my password length 8'. They don't have to understand the technology underneath the device. It could be a mobile device, it could be an AIX system, it could be a network device. When that XML is pushed down to that device, it's the one that is OSML aware and it knows how to interpret that into an actionable command. It writes that actionable command back into the XML and then executes the command to configure it and puts the result back in the XML. So now the XML file is actually all of your artifacts for reporting that the device is indeed compliant. It also has remediation. Many of our customers have to be SOX compliant, PCI compliant on the same device. This is a way to blend those two and remediate and have a compliance that's automatically authored to meet both compliances. We'll be working with NIST later this week around SCAP to see how we can insert and merge OSML with SCAP. That work has been ongoing and we meet later this week.

The easiest way is probably just to go to the opengroup.org website. I would encourage everybody to do this because you'll have a broader view of what it is to be a security architect. It'll help you grow personally in your career. Additionally, it'll help your products that you're developing or whatever you're doing in your organization. It'll give you a better understanding of the different areas that you need to do for your job. Basically, you come to The Open Group, you find out what benefits you and your job, and that's the forum you insert yourself in and become active. Additionally, you start looking at the other forums and again that broadens your aperture and understanding of enterprise architecture, security, real-time embedded systems. It's all here.