BIG smile….. excuse some of the links.. short posts already on this topic!

Erm, transitive trust, whether from the macro organisational layer, host to host, API to API, function to function, memory etc… node(person2device)2->network->2node(2device2person)
org(node2node)->network->2org(2node2node)

http://bsdosx.blogspot.com/2007/05/infosec-whats-fuss.html

Most of the time we all forget the major ‘transitive trust’ issue around people and identity:
http://bsdosx.blogspot.com/2007/06/symbiosis.html

Kim Cameron… fair play.

Albeit vendor says ‘trust me’… From the company who brought you… do you trust monocultures?

Question: How can market forces and/or regulation drive secure code, do I trust your code, it’s far too complex and abstract? Do I trust someone else to certify the trust in your code? We are seeing increased economic incentive for secure code/services, but also increased incentive for sentient attackers to defeat “secure” code as nodes/services are resources that can facilitate financial gain or feed the global power game via intelligence.

My answer is “time based” and at some point you have to trust someone or something. Assume human/machine compromise, now what’s the best you can hope for.

Cisco Trust Agent 2.0 and NAC ( erm’ what was wrong with 1.0 ?) http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5707/ps5923/product_data_sheet0900aecd80119868.html