Although the previous section hopefully contributes to putting network robustness into a new perspective, by adding some rarely discussed yet eminently practical considerations to the debate, it is mainly intended as a background to a more detailed presentation of our approach to adaptive IT security.
Relatively few research efforts in this field explicitly acknowledge the necessity to switch to some sort of decentralised management of defensive measures in order to cope with changing networking practices. The most advanced papers in that respect would be those by Ioannidis et al [12] about distributed firewall, and by Zhang and Janakiraman [13] which describes the Indra intrusion detection system. However, even those pioneering works fall short of taking into account some key aspects of variable network topology. In practice, both protocols rely on positive detection and successful localisation/identification of the security breach. In addition, the distributed firewall does not really address the problem of harmful behaviour from an authenticated access point. On the contrary, Indra is an extremely aggressive IDS that does not appear to have any tolerance for transient unauthorised activity, which is potentially very dangerous in a highly dynamic environment (false positive). Far from discarding these previous attempts though, the adaptive network perimeter presented in this chapter is actually building on their respective strengths while simultaneously trying to correct their weaknesses. Indeed, in our view, the key to successful distributed defence resides in replacing any form of explicit threat notification (even decentralised) with...
TABLE OF CONTENTS 
