Internet Society ICOMM16, 15 Sep 2016

Previous Meeting

⏯

youtube image

►

From YouTube: Intercommunity 2016 - Trust Framework

Description

You can read our Trust Framework online on our website https://www.internetsociety.org/doc/policy-framework-open-and-trusted-internet

A

Hello,, my name is olaf kolkman., I'm the chief internet technology officer at the internet society.

A

today, I'd like to talk about trust.

A

Trust is going to be one of the topics at intercommunity today., and I would like to provide a little bit.

A

Of a few background thoughts so that you can go off and discuss trust among yourselves.

A

Trust is a complex theme..

A

It is a perception of your environment.

A

And when we say we wanna create trust in the internet,.

A

We actually want to foster confidence in the internet so that people have a fairly rational reason to trust the internet.

A

When we talk about trust in the internet,, that's a very complex set of problems that we're looking at.

A

So,, what we're trying to do is provide a framework.

A

In which we can talk about several pieces, that at least.

A

From the internet society's perspective, we're interested.

A

The four pieces are trusted: networks, technologies.

A

For trust, user trust, and a trusted ecosystem.

A

Let's go over them., they sort of map to the internet, architecture.

A

The layered internet architecture.

A

Trusted networks are about how the communication.

A

Between endpoints get established.

A

The internet is a network of networks.

A

the endpoints,. The end networks do not necessarily collaborate with each other.

A

However,, they have a bunch of expectations and they trust the traffic to flow from a to b.

A

We have to make sure that that capability of the internet,.

A

Of network operators that have no bilateral relation,.

A

Flowing traffic between them and thereby establishing.

A

End to end experience, remains to exist.

A

The things that we need to do for that is look at things like routing security,, dns, security.,.

A

It's typically the realm of network operators,.

A

When we talk about trusted networks.

A

The networks themselves don't provide confidentiality.

A

If somebody looks at the package that pass by on the internet,, they can read into them.

A

That's fairly true., so there's a sort of a service layer that we need in order to establish confidentiality,.

A

And integrity, and authenticity.

A

a layer that provides encryption.

A

And the ability for strangers that have never met each other before to have some sort of identification.

A

Make sure that you're talking to the party that you intend to talk to.

A

Thinking about infrastructures like the pki,, the public key infrastructure.

A

It's the infrastructure that makes sure that there is this little blue padlock in your web browser.

A

But I'm also thinking about encryption technologies and protocols like tls, the thing that encrypts your.

A

Web traffic, when you talk to your bank.

A

We call that sort of middleware, that functionality that applications rely on,. We call.

A

That the technologies for trust.

A

That's another aspect which we are interested.

A

Third, is user, trust and user's trust is a very broad area.

A

Think about it of the end points of the network,.

A

Where the applications take place., the applications run on machines.. We need to trust the machines..

A

The applications themselves must be trusted.

A

We have to make sure that we're not dealing with malware, for instance.

A

We want to make sure that the people who operate the applications don't do things that we don't like.

A

For instance, business that collect a lot of data about us,.

A

Need to deal with that data in a.

A

If not legal sense,, also in a ethical sense.

A

They have to make sure that the data that they collect is not leaked.

A

A

and finally, trusted ecosystem.

A

All of the internet operates, not in a vacuum.

A

It operates in a wide collective of interests.

A

We have to make sure that the decisions made.

A

In that wide collective of interests are made in transparent ways and according to a set of principles.

A

Whereby all the stakeholders are involved and the technical.

A

Capabilities of the internet are not harmed.

A

In general,, we take an approach to work.

A

All the trust and security issues in these different layers.

A

Through an approach that we call, collaborative security.,.

A

The internet is built on collaboration.

A

and it is important that when we work with security,.

A

We don't break the internet as a whole.

A

And that, if we think about security, that we take the internet as a whole into account.

A

Fostering confidence is an important part of that collaborative security, approach.

A

We have to take into account that whenever we do something.

A

With security,, we don't break its fundamental values.

A

That is,, we make sure that human rights are protected,.

A

But we also make sure that the fundamental properties of the internet like end to end,, like permissions innovations,, like the ability.

A

To connect to it, the ability to extend it,.

A

The ability of collaboration is not negatively influenced.

A

So it's a combination of thinking about different layers,.

A

Which, hopefully, makes it easier to not boil the ocean of trust.

A

And an approach, a mindset around how you deal with trust.

A

And security issues in the internet.

A

With this I hope I gave you a few handles.

A

This might be a baseline for your discussion.

A

And actually, I'm interested in some.

A

Of your examples, around collaborative security.

A

And,, when we think about collaborative security,, it's not enough that people collaborate.

A

What is important with collaborative security is that they take into account the wider ecosystem.

A

That they don't only protect their assets,, but while they protect their assets,, they are also protecting the bigger internet.

A

A virus scanner is a good example of that.

A

you, as an end. User, make an investment.

A

That not only protects your computer,, but also prevents your computer to become a bot.

A

In a bot net attack against the rest of the internet.

A

So that's just an example.. I would like to invite you to come up with a few more examples. and I hope that we hear back from you during our global session.. Thank you very much..