The Internet protocol (IP) is open, offering ubiquitous access to BT systems and data for BT people and BT's customers. It is this very openness which presents tremendous opportunities for eCommerce. The downside, however, is that IP exposes BT to harmful attacks. The purpose of the iTrust Programme is to provide cost-effective protection to BT systems and data. It is a large programme involving the implementation of several software packages. There is a phased approach to implementation. BT is currently splitting itself into separate lines of business (LoBs) and there will be legal and regulatory controls over who has access to what information - as well as commercial implications. Some customers of one LoB may also be the direct competitors of another LoB. In addition, there are substantial technology integration challenges to be faced, both in building up new systems, and infrastructure, yet at the same time decoupling systems, where it is appropriate, to fit into the LoB model. The iTrust infrastructure is shaping up well to these challenges, although as with many things in this complex technological world, implementation must be seen as a journey, not necessarily something that has a clear and distinct end. The vision is known, as is what has to be done to reach it. Getting there, however, will be influenced by changes in the business, new technologies, ability or desire to integrate legacy systems and, of course, the risk profile.

Now that the security standard XML Signature has completed its standards track and XML Encryption is following close behind, the security protocols and software to use them can be created. XML Signature is a sophisticated, generic standard for creating digital signatures in an XML format, optimised for signing XML data. As there are many business formats and standards that already use XML for representing data, there is a ready market in which XML Signature can be applied. However, the major commercial use may be to secure Web services. There are already a number of proposed security service standards that aim to fill this niche. This chapter explores how new security mechanisms will be employed for new Web technologies. It contains an investigation of Web services, showing how XML is being used for the next generation of distributed architectures and eCommerce projects. The current building blocks of a public key infrastructure are analysed with an intention to see whether XML can create improvements. The new XML security standards, such as the security assertion markup language and XML Key Management Specification, show how XML Signature and XML Encryption can be used to create sophisticated new security services and protocols. This chapter aims to determine how these new mechanisms could operate with familiar protocols, such as the secure sockets layer, to create an overall security infrastructure, usable in an Internet environment.

This chapter presents the history, to date, of the PKI, and has also shown some of the proposed ways forward for its evolution.

Creating, distributing and storing documents electronically has been providing greater convenience, higher speeds and increased economy for businesses and people since the advent of the personal computer. Electronic documents can be created more easily than their paper-based equivalents, transmitted around relevant parties quickly, and can be modified easily. Furthermore, electronic documents can be stored and backed up at a fraction of the cost and space of physical ones. However, one drawback has been that they have been a little too easy to copy or edit. There was no way to tell original electronic documentation from a copy, or who created it, or even whether it had been altered. This made the system rather unsuitable for auditable records, such as financial details, contracts, etc. Powerful mathematical techniques, based on cryptography, provided a solution to this, by providing protection and evidence of who created what, and whether anything had been altered. However, it is only recently that legislation has caught up with technology.

A prerequisite for many commercially attractive services is the deployment of a secure infrastructure protecting the interests of all the parties. For many of the mobile operators and service providers the PKI model is of particular interest, offering the authentication, integrity, non-repudiation and confidentiality requirements demanded by many application providers. Financial institutions, for example, need to offer their customers the ability to bank on-line or trade in shares using their mobile devices, while retaining the same level of transaction security available in the 'wired world'. Currently under GSM, there are two common approaches to providing value added services on top of bearer services - via SIM Toolkit (STK) or via the use of wireless application protocol (WAP). There are already a number of STK-based PKI solutions available from vendors today, but while they may offer early-to-market advantage, they are typically proprietary, 'walled-garden' solutions. The remainder of this chapter focuses on WAP, and discusses the WAP Forum's standards-based approach to implementing a wireless PKI - an initiative that is proving attractive to many operators.

The phenomenal growth of the Internet continues apace. IP networks are cheap, highly flexible, endlessly upgradable, and ubiquitous. Everyone uses them; nobody can now afford not to. Businesses have been quick to recognise the value of the Internet as a source of information, and as a new medium for communicating with customers. However, they have been slightly more reluctant to use the Internet as a means of interconnecting their own internal networks, despite the obvious cost savings offered. Accustomed for so long to being isolated from the outside world by firewalls, and to the connection of remote sites using private networks, the idea of trusting private packets to a public transport medium like the Internet has been slow to catch on. Although virtual private network (VPN) technologies, which allow the creation of secure overlays on untrusted networks, have been in existence for some years, it is only recently that implementations and standards have reached a level of maturity appropriate to the commercial world.

BT's Information Assurance Programme (IAP) aims to improve the state of preparedness to counter the emerging threat of malicious electronic-based attacks on our critical assets by protagonists with a high level of capability. As such it is directed to understand, identify and minimise the risk to our own enterprise and our customers' enterprises from the threat posed by the deliberate, unauthorised and systematic attack on critical information activities. Such attacks would be designed to exploit information, deny or affect service to authorised users, or to acquire, modify or corrupt data, and will be executed by capable, resourced and motivated perpetrators. Reaction to such attacks applies equally to BT's networks, the services it supports, and to its customers and the services they contract from BT, together with considerations of the communications infrastructure within the UK. This chapter will explain in more detail how the IAP operates and the benefits that it provides to BT and its customers. Detection and reaction processes to attacks are essential and the IAP is building upon the internal expertise in this area and BT's computer emergency response team (CERT).

With the exponential growth of networked systems and applications such as eCommerce, the demand for effective computer security is increasing. At the same time, the number and seriousness of security problems reported over the past couple of years indicates that organisations are more vulnerable than ever. In many of the reported cases, user behaviour enabled or facilitated the security breach. The security research community which hitherto largely ignored the human factor now acknowledges that security is only as good as it's weakest link, and people are the weakest link in the chain.