Security concepts for consideration (11 AM on d3)

1. Security concepts for consideration (11 AM on d3) Peter Johnston Plant Exports

2. Internet security! • The internet is a public network. • There are security issues when the internet is used for connecting remote computers together. • Security management needs to address: • Controlling access • Stopping malicious attacks • Maintaining the integrity of the information being transmitted • Solutions?

3. Innovation?

4. Vision: International Assurance Network Events/Exceptions Issuing NPPO notifies issued certificates Notify Receiving NPPO pulls certificates Pull Certificates Acknowledge Events/Exceptions Advantages: No polling (push-me, pull-you) Source/authenticity of certificate data is guaranteed No need for tight system-to-system integration Peer-to-peer internet-based architecture, no need for central hub

5. Solution Option“International Assurance Network” • There must be a common understanding of the certification data elements (official assurance) to be exchanged (e.g. ISPM12) • Focus on XML certification data rather than digitised certificates. • Forcus on transporting XML certification date rather than end-to-end system functionality. • Authentication of source and security of assurance data are paramount.

6. Solution Option (cont’d)“International Assurance Network” • Globally standardised transaction types • Simple message types (RESTful i.e. HTTP put, post, get, delete actions) • Loose coupling rather that tight coupling • Open standards-based technology components • Peer-to-peer internet-based architecture rather than cusomised point-to-point or central hub

7. Point-to-point vs. Peer-to-peer

8. Vision: International Assurance Network Global Community of Exporting and Importing NPPOs

9. Thank-you • Peter Johnston • +64 4 894 0519 • Peter.johnston@maf.govt.nz • Import & Export Standards • MAF • PO Box 2526 Wellington New Zealand