Decomposition of the Security Requirements for Connected Information Domains

The introduction of network enabled capabilities (NEC) changed the way defence organisations look at their IT infrastructure. Finding the right balance between security and duty-to-share has proven to be a difficult challenge. The situations are complex and may lead to high security requirements that eventually result in unmanageable implementations or the premature demise of the project. This impedes the capability to re-use components and promotes stovepipe solutions. We describe a structured approach for analysing the security of interconnections among information domains that need to exchange information. This leads to a better balance between the security requirements and the duty-to-share. The interconnection is decomposed into smaller parts each addressing a subset of the complexity. We identify manageable steps toward an implementation by separating the aspects responsibility, security policy and classfication level