1.3 The need for a general framework

Whether you want to have an adaptive security system in place depends on a number of factors:

• cost of acquisition
• cost of maintenance
• ease of use
• effectiveness

Clearly these requirements are correlated. It is extremely likely that systems that are hard to use will be expensive in terms of training and maintenance hours. This in turn leads to a reluctant attitude towards keeping security up-to-date and this will most certainly make it less effective against new threats and attacks.

A structured approach to the design of adaptive security systems can ease a lot of the pain and contribute to the development of configurable, cost-efficient and effective security. Our structured approach relies on object-based technology: modular building blocks with open standardized interfaces that allow for easy integration.

This would enable providers of security systems to hide the internal working of their products -- thus keeping a competitive advantage over other products -- yet enable these to interoperate with other proprietary software. The customer that wants to implement a security system could rely on it to work with other security products, as long as they are developed to communicate through standardized interfaces. This protects the client's investment and reduces his dependency on a single vendor. This would increase competition amongst suppliers as customers are not forced to stick to one single supplier once they bought the software. Increased competition generally increases quality while keeping prices low. Moreover, such an implementation could possibly allow for gradual expansion as the organization's needs to cover various aspects of security grow.

On the suppliers side, standardized interfaces allow vendors to concentrate on the actual working of the product rather than the predefined interfaces, reducing cost of research and development in that area. Products could be evaluated to see if they actually conform to the standards.

In order to create a framework for standardization we need to identify the building blocks that make up an active security system.