Rand Report R609 was commissioned by US department of defense in 1967, published in 1970 and is considered seminal work in area of Information Security. Rand Report is relevant now in 2012. Rand Report points that securing computer is not enough and it is necessary to secure data as well.

The French have a saying – ‘Plus ca change, plus c’est la meme chose’. What this means minus the italics and in plain good old English, is ‘The more things change, the more they stay same’. One does not want to get into a detailed discussion around that saying. Let us get to brass tacks, in context of the subject of this article – Rand Report R 609.

In October 1967 a task force was organized by the Advanced Research Projects Agency, USA to recommend computer security safeguards that would protect classified information in multi-access, resource-sharing computer systems. The report of the task Force was published by The Rand Corporation in February 1970 for Department of Defense in USA. This is Rand Report R 609.

What is remarkable that Rand Report R 609 made recommendations that would be applicable even today in 2012. Hence the reference to the French proverb – the more things change, the more they stay same. Computers, Internet, Telecommunication have come a long way since 1970. However Rand Report R 609, is as valid in today’s era of tablets as much as it was in era of huge mainframes.

Rand Report R 609 is so seminal a work in area of information security, that academic courses in information security, often regard this as starting point in history of information security. Of course, in this era of google.com Rand Report R 609 can be easily downloaded from say http://www.rand.org/pubs/reports/R609-1/index2.html

Rand Report R 609 pointed that due to networking, existing computer security procedures were not adequate to protect information. Hence Rand Report R 609 initiated a move from safety of hardware to protection of information itself. Rand Report R 609 recommended the following:

Securing the data.
Limiting unauthorized access to Data.
Involving personnel from multiple levels in matters of information security.
They say that those who do not learn from history are condemned to repeat it. Indeed since we are in this proverb-a-minute phase, let us try this one for size – by Albert Einstein – “There are two things infinite – size of universe and humanity’s stupidity and I am not sure about former.”

Even though Rand Report R 609 recommended a move from securing computer to securing data itself, not much has changed in 40 years. Information security continues to be heavily skewed in favour of securing infrastructure instead of information.

And this intransigence has extracted a price. The world continues to lose around US $1 trillion worth of information every year due to data breaches. This is happening despite ever increasing spending on information security estimated by Gartner at around US $ 60 billion last year.

And the best studies and recommendations coming out in 2012 are saying exactly the same thing that Rand Report R 609 said 40 years ago – that we need to move from infrastructure centric security to information centric security.

Of course the words have changed a little bit. While Rand Report R 609 used the word computer, today’s studies use the word ‘infrastructure’. While Rand Report R 609 used the word ‘data’, studies commissioned in recent years use the word ‘information’. But essentially the advice given by most modern security advisors is same as that in Rand Report R 609 – “Move to Information Centric Security from Infrastructure Centric Security”

Rand Report R 609 identified the core problem as “resource sharing computers”. That rings more of a bell in today’s networked and connected world with ubiquitous Internet and mobile telephony. Indeed Rand Report R 609 demarcated security problems for “open systems” and “closed systems”, the later, a very secure environment in terms of access to computing resource, an almost nonexistent state in today’s computing environment.

Very interestingly, Rand Report R 609 laid foundations, of what is called these days as Information Rights Management, or Enterprise Digital Rights Management or Document Rights Management etc. Without using exactly those words, Rand Report emphasized the need to regulate usage rights on information as opposed to infrastructure.

For instance, here is verbatim what Rand Report actually said – ‘In resource sharing computer system, access to the system itself and access to the information contained in the system must be separately controlled.

Thus Rand Report R 609 clearly differentiates between access to system and access to information. Indeed it says so in so many words – “The fact that a user is granted access to a system does not imply authorization to access classified files of data and programs contained in that system.”

Indeed, Rand Report R609 explicitly discusses differing levels of access without mincing words – “The fact that a user is granted access to a system does not imply authorization to access classified files of data and programs contained in that system. For example, he may be authorized to perform only online computation, but not on-line file processing.”

There could be no better spokesperson for acute need for usage rights management than Rand Report R 609. Here is verbatim what Rand Report R 609 says about differentiated level of usage rights – “For example, even though a given user might qualify for access to a particular file in terms of proper clearance and need-to-know, he might be granted access to read it but denied the right to change the file because this privilege is reserved to a designated file manager.”

Rand Report R 609 was released towards the end of “Swinging Sixties” – a time of Beatles, Woodstock and yes, Hippies. Many people do not take a great linking to those drug hazed days. But there was some wisdom amoungst those misfits – “War, what is it good for? Absolutely Nothin!”

Rand Report R 609 is more relevant in 2012, than ever. Advances in networking, computing, telecommunications have not made Rand Report R609 redundant. ‘Au Contraire,’ as the French say. On the contrary advances in networking, computing and telecommunications have made Rand Report R 609 imperative.

Consider BYOD – Bring Your Own Device, paradigm. How on earth would you be able to completely secure every device in world? You can’t but resort to some sort of protection to Information itself, as opposed to keeping Infrastructure safe.

Rand Report R 609 basically, emphasizes information centric security in addition to infrastructure centric security. In no place does Rand Report R609, negate infrastructure centric security. But Rand Report R609, points out that only infrastructure centric security is just not good enough.

Rand Report R609 was sparked by resource sharing computer systems. Now speak of resource sharing computer systems in era of cloud computing. Is there anything not shared in these times of cloud. Can we afford to bury Rand Report in cloudy times?

Rand Report R 609 almost coincided, with birth of networking, even the pre natal and baby days of Internet. One does not know what the future of Internet is, but it may be safe to say, that Internet has matured by 2012. And with every device ubiquitously on Internet, what with 3G, tablets, Wi fi and all, there is no device that is not connected to other device, and that brings with it, its own set of risks.

You can never ever secure a device completely, totally and entirely in such times. Hence some sort of information centric security, as recommended by Rand Report R609 is almost a must.

Outsourcing may not be to liking of Obama, but outsourcing is here to stay. And if you want to keep out the metaphorical Osama, out of your outsourcing, you need to secure Information itself, when it moves out of your perimeter, as required by exigencies of outsourcing.

Hence usage rights management, as clearly defined by Rand Report R 609 is almost a must, if organizations are to leverage the cost benefits of outsourcing. One can only ignore Rand Report R609, at one’s own peril.

Rand Report R609, Bravo!

Prabhakar Deshpande, Product Evangelist, Seclore Technology.