Survivability as a Complementary Operational Security Model for IT Services (position paper)

In this paper, we argue that for big IT systems protection alone is an insufficient and a difficult-to-handle operational security model. We briefly discuss and compare alternative models and sketch a framework for a security policy based on survivability. We present our architecture for IT service security enforcement based on the survivability principle. Based on our prototype experience, we advocate profound changes in how IT services are delivered.