Virtual enterprises and the enterprise security architecture

The emergence of internetworked systems has given corporations and government agencies the opportunity to share information in unprecedented fashion. This sharing can be distributed across several enterprises. In effect, actual enterprises with shared interests can form virtual enterprises. There are significant security implications in this. An enterprise must not only protect the confidentiality and integrity of its own information; it must also protect the information of the virtual enterprises to which it belongs. We suggest that this can be considered as new security paradigm-the virtual enterprise security paradigm-which has a significant impact on security policy, architecture and mechanisms, and leads to an enterprise security architecture that is consistent with the trend toward client-server systems and is suitable for the emerging, internetworked environments now found in both the government and private sectors. In this paper, we describe the common themes and solution principles that led to this new view of computing and security. We then discuss the policy and architectural issues associated with the paradigm. We finish by drawing some tentative conclusions about the paradigm.