Ensuring the trust fabric of the knowledge capital society

As networks evolve, traditional views about security must change, creating new security paradigms that protect not only the integrity of knowledge capital but also the reputation and privacy of its users.

The advent of IP networking is opening up huge possibilities and opportunities for businesses. Having a flexible, much more open architecture on which to combine voice and data communications is removing a lot of the traditional limits to business imposed by device boundaries and perimeters.

And as people come to terms with the scale of transformational changes that are occurring, there will likely be a complete shift in emphasis of the applicable information-enabled business models, as well as of the technology architectures that will support such models.

This has resulted in a complete transformation in business and technology approaches. The leading network IT service providers are now able to provide large scale unbounded networks that can virtualise the orchestration of networked communities, where the traditional restraints and boundaries of legacy networking no longer apply. In fact, in this new, fluid and connectionless model, often referred to as the cloud, the users will act as network nodes.  They will constantly exchange and act upon knowledge capital - the business information that is the bedrock of commerce.

Protecting the integrity of knowledge capital is imperative. In this new business model, traditional views about security must change, thus creating new security paradigms where the emphasis moves away beyond the devices, operating systems and applications and more and more toward the user.

What is required is not more security technology and solutions per se, but instead the creation of a trust fabric that will protect not only the integrity of the knowledge capital but also the reputation and privacy of its users.

Networking transformations

Within the constant revolution that is occurring in the IT and communications industry, there are many transformational activities happening simultaneously. The mass availability of high bandwidth and device proliferation means that there are billons of devices such as phones, BlackBerrys and laptops in the market. This is a transformational change, culturally, socially and economically.

Equally so is the emergence of Internet protocol (IP). In addition to supporting converged voice and data communications over the same channel, IP networks are evolving from grids of connected devices to the more fluid and connectionless mode of the cloud. Such connectionless networks open up all kinds of possibilities. In a world in which all value is informational, having a much more flexible, much more open architecture at the network level destroys all of the proxies for control of yesteryear, such as having a specific business domain and an IT domain plus device boundaries.

Unlike in the old days, where connections were made by plugging together servers and devices, and network traffic carefully routed, the new model offers the potential to create virtual domains.  Networking is now about being able to see through the applications and devices and get right through to the user.

In terms of the classic OSI stack, most organisations are beginning to reconfigure their IT management around three key areas: network and devices; applications and information; and governance risk and compliance (which is really the business process element). Nowadays the emphasis is on the information itself, rather than an application layer in the stack, as we work in a world in which information often represents most of a firm’s business value.

Thanks to IP, the network layer has become considerably enriched, due to the connectionless aspect, but also through the provision of voice and data over the same channel. Device plug-ins are easier; switching services on is easier. What was previously application-layer richness—such as how you join people together and how you connect people with information—is now shifting to the network layer. A lot of software companies are realising this, leading to a focus on cross-application infrastructures, middleware, and new business models such as web advertising.

The individual as network node

Everyone acknowledges that what’s left as the focus is information, but information is of no value unless it is accessed or exchanged between individuals. Individuals drive knowledge capital. Networks are brokering this exchange, and individuals themselves are becoming the new network nodes.

Suddenly business is all about collaboration over increasingly open networks. With this new model security is paramount. Protecting the information is vital, but this has to be within the context of opening up access to the user. Therefore, the user is a vital distribution mechanism. 

The so called concept of ‘security in the cloud’ is driven by this shift, with users emerging from the cloud as points of control. As users do so, governance models must change to hold individuals accountable. For example, the role of forensics is to see right inside the devices and through to the users to establish evidential weight and information provenance and see what particular person did a particular thing.

Establishing a trust fabric

These highly extendable networks need to maintain a balancing act of openness and flexibility on the one hand, and accountability and control on the other. A trust fabric must be established in order to ensure that this balance exists. The edge must be flexible, but the middle accountable. This is where areas such as Public Key Infrastructures (PKI) come into play, allowing networked trust models to be extended and managed in an automated and cost-effective way.

There are challenges in making this happen. Enabling the extended enterprise is a huge undertaking.  Many underestimate the difficulty of facilitating true collaboration in a logical space or web space. Collaboration in the physical world happens in a somewhat ponderous way; you arrange meetings and get people together to sit in a room and set up a project etc.

In the world of the web, the friction is much lower.  The potential of accelerating the value of knowledge capital through collaboration is high, but the task of making that happen—recognising that it will involve voice and data convergence and ensuring the ebb and flow of human conversation as intuitively it does in the physical world—requires high bandwidth and intuitive user interfaces, supported by the ability to enable seamless switching between channels.

It also demands a security infrastructure that is unobtrusive but highly effective. It is vital to establish and guarantee the provenance of who is at the virtual table and the knowledge capital that they are presenting.  You can’t see who is ‘there’. There is a subtle undercurrent of establishing trust but trust has to come from a number of different mechanisms.

Old fashioned hard core PKI is part of this, but so too is the nature of the user interfaces and how you draw people together and how you select people. One great example could be the deployment of reputation models such as those used by eBay and Linked In.  Making collaboration happen in a way that reflects the knowledge capital vision will require a trust fabric that will work as a result of changes to social, cultural and user interface changes and these will take time to mature.  

Challenges of ensuring effective protection

But in the present, it is becoming increasingly important to protect the information layer. It’s all very well saying that knowledge capital is becoming the core value, but all kinds of incidents will occur unless you properly manage the information layer. So in these new web-application-enabled information architectures, protecting information assets will be a much bigger challenge.

Moving above the application layer and intelligently making information available, but also protecting its value, is going to be the next big challenge. This is why constantly testing the boundary between web and applications is vital, using penetration testing that checks whether the application infrastructure is robust enough.

Another concern is how to ensure that the knowledge capital can ensure the delivery of a business promise. The ebb and flow of knowledge capital opens the potential for all sorts of nefarious activities. There comes a point when you have to ask whether you got what you were supposed to get, or did it all go to where it was supposed to go to. When trust goes bad, which it will do, you have to be able to quickly establish how it happened and who was responsible. Because information is so intangible, and the logical world is such a fast moving and frictionless place, forensics becomes of vital importance within the trust fabric.


It’s possible to think intelligently now about the transition from traditional legacy to increasingly unbounded web-enabled architectures rather than making the quantum leap from one to the other.

Most organisations are putting a web front-end on key legacy applications and are also opening up access to key business assets through a variety of mechanisms, such as driving mobility, or offering web services access to information. In themselves, these things are individually contributing tactical business value as they are cost and information-efficient. They are also building-blocks to the future of business which must increasingly benefit from driving knowledge capital across extended business models through IP architectures.

Read more on IT strategy