Next step for Open 802.1X: Non-PC devices
In addition to PCs, there are plenty of other devices that communicate over the Internet Protocol--and all of them need network security.
Just before Interop in May, the OpenSEA Alliance, a new industry group focused on open software solutions for networking and security, was announced. The OpenSEA Alliance plans to develop a robust, multiplatform and widely available open 802.1X supplicant with the goal of emulating the successful Mozilla Firefox model.
Just what is an 802.1X supplicant? It's a piece of client code that authenticates an endpoint (i.e. PC or laptop) to a network and thus enhances security.
The OpenSEA Alliance is not alone in the PC space. Microsoft bundles an 802.1X supplicant in Windows XP and Vista. Juniper Networks got into this business when it acquired Funk Software and Cisco Systems did the same by purchasing Meetinghouse Network Access Security.
While the PC space is well covered, there is a new network-security frontier out there that remains barren. What about Internet Protocol phones? What about mobile devices? What about network-based appliances like printers? All of these systems communicate over IP, so it would be nice to know their identity before giving them carte blanche to chat over our pipes.
My suggestion is as follows: make the OpenSEA Alliance 802.1X supplicant the standard for non-PC network devices. Let's eschew the typical cycle of proprietary technologies, multiple standards bodies, and mental gymnastics for once and simply get to an open end-game where the next billion network devices are all instrumented in a common way. If we agree on this up front, we can expand IP communications and improve security at the same time. What a concept!
Who would benefit from such a radical idea? We technology users do. Universities love this idea because they are wired to the teeth. This would provide another layer of security. The New York Stock Exchange is the world's largest wireless implementation where traders use specialized devices, not PCs. I've talked to some folks there and they love the idea of accelerating standards-based technologies.
Health care institutions are adding all kinds of non-PC wireless devices as well. A standard 802.1X implementation would help here with thorny issues around identity and security as they relate to compliance with the Health Insurance Portability and Accountability Act.
Authentication, identity and security are difficult issues, but in my mind the technology industry makes things way harder than they need to be. By standardizing non-PC devices on the OpenSEA Alliance 802.1X supplicant, we can side step these issues for once. I just hope Apple, Avaya, HP, Motorola, Nokia, Nortel, Palm and Symbol--as well as all kinds of specialized-device makers--share a similar desire.