Managing Information Security in Large Defence Procurements: the Royal Air Force Lits Experience

This paper describes the practical experiences of the authors subsequent to the 1993 Symposium and overlays the procurement process that took place for the development of the first tranche of the Royal Air Force’s Logistics Information Technology System from a COMPUSEC perspective. It explains some of the problems encountered by the Security Team during the selection of a Prime Systems Integrator and developer and then describes what actions were taken to minimize the associated security risks. It is believed that many of these management problems and difficulties we have faced and resolved hold equally true for all secure IT system developments. Many of the lessons we have learned are relevant to the management of all secure system procurements where a contractor is used, irrespective of size.