Integrated IT security: Air-traffic management case study

In this paper, we present a case study about integrated security management in a complex air-traffic management IT environment. Air-traffic management IT systems help air-traffic control personnel to monitor and control the movements of planes in a certain air space. A consortium of European IT companies and air traffic control organisations are currently developing and deploying the next generation of such an air-traffic management system which integrates many more heterogeneous data sources using an open application integration platform. The concepts and technologies described apply to all industry sectors that have to deal with a complex, heterogeneous (e.g. legacy), networked IT environment. The main part of this paper presents the innovative, model-driven OpenPMF security framework that is used to secure such complex IT environments. OpenPMF allows specifying, enforcing, and administering a uniform, coherent, organisation-wide security policy in a central location for almost any distributed systems platform and security technology. Together with a secure CORBA Components application development and integration platform, it forms a comprehensive platform called SecureMiddleware. OpenPMF and SecureMiddleware are available as open source software.