Прикладная информатика в экономике

Another mechanism that fulfils a similar role to a firewall is a proxy server. This is a server that stands at the point of interface or gateway between an organisation"s system and the public network. It can therefore operate similar filtering processes as firewall methodologies, but it will tend to operate in the opposite direction. The firewall tries to prevent undesirable material getting in, whilst the proxy server tries to keep internal users from bringing in undesirable material.

Firewalls and proxy servers will generally slow down transmission rates. Some firewalls - for example, a number of those sitting on government email servers -simply avoid this problem by banning the transmission, one way or another, of any attached file of a certain type at all. This gains security at the expense of forfeiting one of the key benefits of email.

As with the potential exposure of commercial anti-malware software not being comprehensively adopted throughout an organisation, a firewall has the potential for "holes" - that is, parts of the overall local network that operate without the firewall protection but still interact with the rest of the network. This can happen for many reasons. One may be that a system has been upgraded piecemeal to a point where it is believed (in error) that all workstations are on a particular system or have a given set of settings, and then the firewall that is introduced works on machines in virtue of those settings or systems. But an individual workstation may have been overlooked, an individual user may have chosen not to do whatever was necessary to trigger the upgrading, or there might simply be a technical error where the central electronic record for workstations is corrupted or deficient in some other way, leaving some machines "off the list" so to speak.

A further complication with all methods of internal protection is that the "internal network" is not entirely self-contained. The steady growth of people working at home, or away from the office, means that people are using laptops and PCs that may connect to the local network intermediately (for example, via an email connection through a third party internet service provider such as MSN or AOL) or indirectly (via work stored on a disk or handheld device and then loaded into the workplace machine at a later date). It is often the case that well firewalled networks end up importing major items of malicious software because staff laptops are not so well protected. Yet a further problem here is that even when working in the office, someone may be using a telephone line that stands outside the general network. It is common for very senior managers to have a line that is separate from the main switchboard that is used for highly confidential calls. The growth of "airport" and other remote modem devices means that the manager might then be able to use this line to access the internet completely independently of the organisation"s firewalling technologies, creating an exposure that may at a later date facilitate the introduction of malware packages into the main system.

In short, then, malware infection can be protected by software designed to "disinfect" once they have been "caught," or by firewall or similar technologies designed to prevent initial introduction to a system or network. In practice, however, there are significant drawbacks with both of these.

Above all, though, the principal weak link is when there is a lack of recognition by users of the importance of protection against this type of exposure, a theme we shall come back to in later areas.

Personal data protection

Many corporate systems will contain a great deal of personal information, about clients and about staff. In many countries, there is significant legislation requiring that the data held is only used in very specifically defined ways, and that it is not on open inspection. Quite apart from the legislative requirement, it is clearly good practice not to allow all and sundry look at the disciplinary records of members of staff, for example, or to have the private addresses of customers open to public inspection.

A standard way of protecting this information is by password protection of files or servers. Most corporate local networks will also use password protection for individual email accounts, for access to a particular user account, for use of the network, or even for any level of access to a workstation. One result of this is that people may hold some items of confidential information independently of any corporate database. This in itself may create exposure that an organisation may not even realise it has.

There are three permanent problems with passwords in general (these comments apply also to the use of passwords as an external protection method):

· People find it difficult to remember passwords, so given the choice they often pick something memorable for them, such as the name of their pet hamster, or their date of birth. Someone who knows just a little bit about an individual might then have a fair chance of guessing their password.

· When passwords are set centrally, or the system sets parameters on password choice (such as the prohibition of recognisable words, or the requirement to include numeric as well as alphabetic characters into a password), then it becomes difficult for the average user to remember. The majority of individuals using computer systems are likely to have multiple passwords to remember (such as e-store or internet discussion groups, banking security pin codes, ISP recognition data sets). The volume of security information that a consumer may have to remember creates a great temptation to write some of it down. For a company employee to do this is to create a fresh form of exposure, based on the risk that the written password is seen by the wrong person.

· Passwords need to be regularly reviewed to remain secure. Hackers use programs that will not only generate huge numbers of random character strings that might act as passwords, but then will attempt to use these to gain entry to a secure network. The longer the period of time that a particular string is extant, the greater the likelihood that it will be captured by one of these programs and used, to gain entry. Also, the longer a password is used, the greater the chance that someone else may discover it. Unfortunately, the more frequently passwords are changed, the more likely it is that people will want to write them down to remember them.

As well, there are short-term issues with password-protected entry to data sets. Individuals may have data on a screen and be called away suddenly to a meeting, leaving the "secure" information visible to who ever happens to pass by their desk. Even when someone is at their desk, open plan offices make it easy for one person to catch a glimpse when walking past someone working at their desk. The risk that that someone is intent on acting inappropriately with the information, or that they can actually see something sensitive may be small, but it is present and therefore creates an additional exposure for the organisation.

Of course, each new development in technology increases the potential protections - the use of webcams, for instance, can be harnessed to iris recognition software, so that a screen saver could only be turned off by the person responsible for the desktop appliance. Voice recognition software has a similar potential, both of these are used extensively in other applications of personal identification - such as airport security.

Human factors in internal exposure

The preceding forms of exposure represent mixtures of human and technical weakness. The following are primarily human and user related matters, rather than ones involving system design.

Commercial confidentiality

Needless to say, any company using computers even to a minimal degree will hold information therein that they would like to keep to themselves. Commercial confidentiality is perceived to be a central feature of the competitive advantage for most organisations. It is not always quite as true as some of them believe. Most really new developments have been leaked to the press, or the technology has been communicated via research papers, or "beta" versions have already been tried out by members of staff, or simply competitors have guessed what is happening (because they too may be working on similar lines). But all the same, the timing and the nature of a new development can be crucial to its success. In addition, information relating to the weaknesses or problems of an organisation is likely to be highly sensitive, in some cases open knowledge could lead to clients cancelling orders, suppliers demanding immediate payment of invoices (with all the attendant problems this creates for cash flow), for example.

Commercial information is thus extremely precious, and its dissemination can be a major blow to an organisation. Many of the protections outlined in this chapter (firewalling, encryption, passwords) will help to maintain commercial confidentiality. There remain the same kinds of technical and human problems with these remedies. In addition, however, there are other potential problems with confidential information and internet or email usage.

The simplest problem is sheer failure by individuals to perceive the commercial importance of an item of information. Many years ago, one of the authors of this book worked in a major communications organisation, and used to produce a regular newsletter for computer users. On one occasion, he chose to run an article about what seemed to him to be a harmless but interesting aspect of internal computer usage. His divisional manager (two levels up) just happened to see the edition before it was disseminated, and realised that a major project involving several millions of pounds sterling might be prejudiced if this information were made public. The author simply was not in a position to recognise the sensitivity of the article.

Other potential weaknesses involve the way in which information may be disseminated. Usually a web page takes a little bit of time to produce, several people within an organisation get to see it before it is uploaded, and therefore the oversight of one person is counterbalanced by the perceptions of others, and sheer accidental release of information is thereby reduced. Emails, however, which form an important subsidiary to much web-based trading (for example, confirming sales or delivery addresses, sending passwords, and so on) as well as other aspects of e-business, can all too easily involve slips of disclosure. For example, "reply" buttons are often right next to "reply to all" buttons, so that a slip of a finger or mouse can mean that many people see what was intended for only one. Or sometimes a reader does not scroll all the way down a message and forwards on information that is not intended (this is especially prevalent when emails include a long list of the replies bouncing back and forth between individuals, so that eventually a user forgets what exactly they said four emails ago - but it is there nonetheless for any fresh eye to see).

Contractual commitment

In common with any other form of communication, web page or email statements can form part of a legally binding contract. Again, whilst this is less likely to be overlooked in the more lengthy process of putting together a web page, it can be easily overlooked with an email. It is also important to recognise that different statements can have different import, culturally or legally, in different countries. By definition, the internet is global, which means that an organisation should at the very least bear in mind the different kinds of interpretation that may be made about statements about goods or services offered. This has led to somewhat farcical situations where companies fearful of potential litigation based on staff sending ill thought out or unauthorised emails now insert long disclaimer notices, usually far larger than the text of the message itself.

There is also a degree of ambiguity about the legal jurisdiction concerning a statement made on the internet. Generally it may be assumed that the country in which the company is based or in which the web page originated will be the legal system under which any claim might be heard, but this is not quite as simple as it looks. A multinational organisation, with an intranet that stretches across many countries, for example, may have a website where the contributions were made in different places, which relate to different countries, may specify services or goods specific to different countries, and where the source files themselves are held at different places on servers in different countries.

Publicity

The risks of bad publicity are less pronounced with websites than they are with sloppy use of email. Emails in which people use obscene language, for example, or which include jokes or unflattering comments about a colleagues, may well get into the wrong hands or, by accident or even design, are spread around the internet. Such cases immediately create a liability not just on the direct perpetrators, but also on the employer. For example, under English law the employer would be expected to take reasonable steps to protect all staff against sexual or racial abuse, and this would certainly extend to cover sexual discussion of a colleague over the internet. For instance, in a recent case of this kind, a leading financial trader was required to leave their job immediately after disseminating an email not even written by him describing a sexual act carried out by a colleague.

But publicity is also created through the efficiency and effectiveness of the website itself. A customer will form a poor view of a company whose website is difficult to load, or has technical errors (such as links to non-existent pages, or pages that have not been properly checked and lines overwrite each other, or there are images that cannot be displayed). As will be discussed later, one major mistake here is that many organisations overestimate the capacities of the browsers and systems of their clients and customers, so that a page that seems to work well when tested out on their own machines performs far less well with lower grade hardware or software. In some cases, a page may simply fail to load properly, or leave out significant areas of content. The exhortation of website developers in the early days was to test out pages on as wide a range of browsers as possible, and still to leave a text version of the page accessible just in case.

Some website designers have taken a leaf from the kinds of quality test used by popular music companies - the so-called "car radio" style test. This is where a deliberate choice is made to test out the product on the least suitable apparatus (in this context, such a test might be to see how the site performed on an old PC running on an obsolete operating system, with an early version of a browser, and using a slow telephone line). The assumption is that if the product works well then, it should work well in any context.

In general, the style and appropriateness of the content of a web page is a major marketing factor, as discussed in a later chapter. The more wide the testing of a site against different browsers, different operating systems, different hardware, different speed telecommunications lines, the more likely the site is to be appropriately received by the target audience.

A further level of exposure to publicity risk is the possibility of theft of a website or website name. An acquaintance of one of the authors of this book had a website that was "stolen" briefly. The name of the site needed to be renewed, and the individual, rather inefficiently, did this on the last date before it ran out. This resulted in the site coming off public view for a day or two whilst the payment was processed (in itself an undesirable feature). But when it came back, the site had been swapped for another that was running pornography! It appears that the pornographer was trawling sites that were down or seemed to be dormant and then switching their server"s details, so that a visitor would be routed to the porno site rather than the real one. A little rewriting of server details on the web registration was all that was needed to restore the status quo, but it did result in some embarrassment with a couple of clients! Another source of publicity problems here comes when a website address suggests one body although it is really used by another. Individuals have, for example, registered names of celebrities or famous brand names, and then run legal but damaging content on those sites, so that the celebrity or corporation is almost forced to purchase the site in order to suppress it. (This has been outlawed in several countries, but if it is legal somewhere, then it can be done by registration in that country.) This underlines the potential vulnerability of websites to publicity damage.

We can see from these examples, that there is a degree of ambiguity about the internal/external division when it comes to internet related exposure. This will remain a thematic issue with the rest of this discussion. As stated at the start of this chapter, much of the exposure is due less to system design than the way that people use or abuse systems. This underlines a theme of this chapter, that human resource management is at least as important in the management of an e-business as computing technicalities.

External exposure

The prime forms of external exposure stem from malware infection and the breaking into people"s computers or to their telecommunication links remotely (hacking, as it has come to be known). Again, the main source of such exposure is at least as much down to human factors as it is to system design or technical flaws.

The varieties of hacking and the mind of the hacker

The common perception of hackers is that their prime motives are either greed or malevolence - that is, that either the hacking is going on to facilitate criminal gain such as theft or embezzlement, or it is intended wilfully to damage the organisation or, indeed, the global market (or capitalist) economy itself. This is a great oversimplification of the situation, however, and unless one gets some idea of the motives of the different groups of hackers around, one will not be able to deal with them appropriately.

It is important, though, before embarking on this discussion, to emphasise that hacking is almost always a criminal act in itself, just as breaking and entering. As we shall see below, not every hacker has criminal or even malicious intent - just as not everyone who breaks into a property has malicious intent. But the very act, nevertheless, is criminal (apart from white hat hacking - see Box 4.1 on p. 80.)

Having said that, we should bear in mind the different reasons why someone might choose to hack into a system (which of course will say something about what they are likely to do once they have got in). These include:

· Play: Some computer enthusiasts (many of them adolescent boys - sometimes described rather condescendingly as "script kiddies") enjoy simply the challenge of trying to get in to a closed system; there have been several cases where a "script kiddie" has managed to gain entry to top secret computer systems (including the Pentagon"s) only to have no use for the information to which they then had access.

· Computer enthusiasts and purists: There are many computer enthusiasts who use hacking as a means to develop their own skills and understanding, and also in some cases as a means of identifying systemic weaknesses; there are many discussion groups and loose collections of individuals who share ideas and experiences about hacking publicly; one group that called itself "the cult of the dead cow" in the late 1990s had many contributions from individuals claiming that hacking was the only way they could get major software companies (Microsoft was the prime candidate in most cases) to pay attention to the weaknesses they had uncovered - possibly some of these might have been a cover-up for people with more malign intent, but on the face of it at least there was evidence that some hackers were motivated by interest and a desire to see systems made more effective².

· Commercial competition: As indicated in the discussion of email, it is rare in the modern era that any new commercial development is entirely secret. However, there are other aspects of commercial operations that may have a significant degree of confidentiality about them - records of complaints, legal proceedings settled out of court, personnel files and financial records perhaps above all. All of these and more can be valuable ammunition for an aggressive competitor or litigator, and thus hacking can be a useful but unethical vehicle for industrial espionage.

· International warfare: During the armed conflicts in south-east Europe in the 1990s, there were at least two cases of major malicious programs that appeared to have been launched from within combatant countries, believed to have been intended to cause some kind of damage, or at least difficulty, to the main countries providing military assistance to the UN. In addition, any entry into a country"s military computer systems (such as the hacking into the Pentagon mentioned above) is clearly a major national security breach with potentially catastrophic implications.

· Anti-corporation: Some people (they even have a name for this - hacktivism) hack into the systems of a particular corporation as a means of getting back at them, perhaps an employee who was fired, perhaps a customer who received poor service, perhaps a member of the public who suffered a severe loss (for example, having an accident as a result of using a certain firm"s kitchen equipment) and has a grudge against the firm. Of these, the resentful employee is potentially the most dangerous, as they may know not simply their own route into a system, but the basic architecture of a system, and where they could cause most damage.

· Anti-capitalism: The concept of the market, or capitalist, economy has been criticised since even before the time of Karl Marx; nevertheless, there remain some whose critical views of this approach lead them to undertake direct action in opposition to capitalism. Many of these are intent mainly on undermining the self-confidence of the contemporary market economy, but there are some who believe (wisely or not) that they can destroy - or perhaps punish - those who profit from capitalism as an ideology. For these (another type of hacktivist) hacking provides a particularly ironic source of activity, seeing as it is a central part of modern capitalism.

· Criminality: Last, but by no means least, are those with a simple criminal intent to defraud and steal for whom entry to a computer system may provide the crucial information they need to carry out the crime - bank account details are an obvious example.

The most important aspect of the list given above is that the criminology of all these groups is quite different (remember, by the way, that even in the harmless cases it is still criminal). For different kinds of motive different kinds of protection are appropriate, some of which may lie in long term re-education rather than in simple "prevent, detect and punish" style approaches. Box 4.1 illustrates this.

We can see in Box 4.1 a broad categorisation of hacking, though the bulleted list given earlier identifies a range of more specific motives that can be operating when people hack into systems. The key issue, though, is that different motives imply different kinds of hacking behaviour, which themselves require different kinds of reaction. For example, many (though maybe not all) anti-capitalist

protesters are most concerned to have a place where they can voice their views and express their difference of opinion. Not all will want to "smash" the ruling class - some may merely want to reform the current approaches to business that large corporations demonstrate. A heavy handed legal and policing style reaction to their activity can be counterproductive, as it may turn people who are mildly against your corporation into those who positively detest you.

The appropriate reaction here may, then, not be a simple systems response of tightening up loopholes (though that always should be done anyway) or of evoking due processes of law, so much as an educative one of trying to provide opportunities for the protested to engage in a more positive dialogue. For example, setting up a discussion zone where protesters can make their points and managers can make responses to them. This is not possible for every organisation - it takes a great deal of time and considerable diplomacy, and can distract from the business of business. But for the large multinational (who are the usual targets of anti-capitalist protesters), it might be that this kind of approach may yield longer-term benefits than a heavy handed legal response. It certainly would be good PR, if nothing else. Of course, it only works if the organisation thinks that it can genuinely defend its position. If managers know that their organisation is acting unethically, for example, then they will be unlikely to go down this route. But then, they should not be in business at all if they cannot defend what they do. On the other hand, the harder core black hat hackers, such as those involved in criminal activity, or acting as part of a military conflict, will not be deterred by such an approach. In these cases, it is a matter of prevention, detection and sanction.

Types of hacking

There are many different forms that hacking can take, including:

· Access to and theft of data from databases: much of the concern in this area has been with potential loss of financial data, such as bank and credit card account data.

· Covert monitoring of information: sometimes called "sniffing", this is where a program may be introduced as a virus or Trojan; one common form of this is the email wiretap, where a program simply reads and forwards on internal or external email messages (some of which might contain confidential corporate information, or compromising information about the private lives of senior managers, which then can be used for blackmail purposes, and so on).

· Identity misrepresentation: sometimes called "spoofing", a hacker may masquerade as a legitimate organisation, for example, to induce a supplier to send goods to a new address.

· Denial of service (often called DoS attacks): perhaps the most dramatic kind of hacking occurs when an organisation is flooded with traffic, so much so that its internal systems crash and the organisation"s e-business operations are offline for a period of time; more and more extensive versions of these are continuing to be developed: distributed DoS attacks use a large number of computers to launch the traffic; a smurf goes one further and induces large numbers of potential users and customers to send verification messages to an organisation; much of all this is likely to be used by hactivists rather than the professional fraudster.

An additional issue which does not actually represent a security risk, though it can sometimes stem from one, is spamming, as discussed earlier. It is important to recognise that spam is unsolicited email, not unlike "junk" direct postal mail. One needs to distinguish here between direct mail (or electronic or paper form) that is sent to an individual who has freely and knowingly chosen to disclose their name and address to an organisation, and spam proper, which uses people"s names and addresses without their knowledge or consent. Not all disclosures are knowing - many organisations either on the internet or in call centre scripts, require the disclosure of personal details before any further activity can be progressed, and in some cases these may be passed on without the individual realising this.

Spam is a growing phenomenon - some estimates put it as high as 40 per cent of the entire email traffic on the internet. Whilst it is not a security weakness, in itself it may relate to one - as people have become more wise to spam mail, the spammers have taken to disguising their addresses; for example, spoofing by using information taken illicitly from third parties or by using a routine to distort the recipient"s own email address (so that jsmith@isp.com becomes aljsmith@isp.com, for example). There are filter programs that will deal with spam, as well as firewalls and similar designs. For any organisation, the receipt of spam can represent a major waste of time, but the sending of it can be equally difficult; for example, by diminishing the credibility of the organisation.

Remedies for external exposure

It is important to remember the points made earlier, that the sources and reasons for security risks existing are various, and hence the remedies also need to be diversified, not only to address the different motives that people may have for exploiting security weaknesses, but also to spread the degree of general protection. In the case of criminal activity, for example, it is generally presumed that they will go where the pickings are easiest. A well defended organisational network, for example, though not foolproof, may offer a less promising location than one that seems to have a less general focus on security. It is an analogy with burglary - the house with no evidence of security consciousness at all is more vulnerable than one where someone just puts up an empty box that resembles an alarm.

There are three key themes that need to be taken careful note of when developing protection systems for an e-business operation:

· The specific vulnerability of the organisation and all its stakeholders.

· The extent to which security systems curtail performance of the system.

· The general social benefits of having an open, accessible yet safe world wide resource.

These three tend not to work together. The safer the security system, usually the slower. The greater the benefits of public accessibility, the more likely this will conflict with the specific interests and needs of a particular e-business. For the organisational manager, this therefore means that a balance needs to be struck between these three considerations.

Legal protection

There are various laws in different countries that deal with some of the above issues. For example, many countries have data protection and privacy legislation, protecting the individual from the unauthorised use of their details. Similarly, the USA has legislation regulating the use of spam, and the UK and other EU countries are also in the process of developing similar regulations. Financial fraud is covered in detail in the legislation of most countries in the world. Basic employment law in many countries involves (in addition to workers rights) certain responsibilities for employees not to act recklessly or without due care and attention to the interests of their employer. And there is legislation covering areas such as child protection, which arguably would extend to internet based child pornography and similar activities.

The main difficulty for governments is not the issuing of laws but their ability to detect and prevent or punish prohibited activities. By and large, the countries with the most extensive usage of the internet tend to have extensive detection apparatus for such areas as financial fraud, but many fraud detection professionals anecdotally report that their ability to stop fraud occurring is diminishing constantly, as criminals find ever more effective ways of exploiting the vast opportunities of the internet.

Staff related

As has been the theme of this chapter overall, many of the key remedies lie in addressing human factors. These will not eliminate the risks associated with e-business - every activity under the sun carries some kind of risk. But they can address some of the main sources of vulnerability, and thereby reduce the level and degree of exposure.

Some of the exposure identified earlier in this chapter stems from loose organisational practice. It is easy for a systems expert to identify ways in which such looseness can be tightened up. This has to be balanced, though, against the general culture of the organisation. A university, for example, is one of the most risky environments when it comes to electronic security - many students gaining access, swapping files between their university email and their personal email, staff sending files with research material all over the world to colleagues and fellow researchers, and so on. But it is also one of the loosest kinds of organisational culture. A high degree of autonomy is the norm in any university. Academics will shout loudest of all when it comes to the restriction of their right to go about their chosen business (that is, teaching and research). Hence, simply setting policies and processes to regulate behaviours would win a battle but lose a war - the academics might well simply ignore it. This is the reality of organisational change relating to the internet; it has to fit around other features of a business if it is to work.

Nevertheless, certain policies and practices, when implemented in a manner that takes account of the organisational culture and norms, can have a significant effect in reducing the degree and level of exposure, though rarely in eliminating it. These include:

· A set of education and development options that will keep all users of a system aware of the kinds of risk they may run not only to a mythical organisation (from which even well educated employees such as university lecturers can sometimes feel alienated and therefore unwilling to support) but also to their own work and security.

· An open dialogue on security and the preservation of the huge utility of the internet, possibly conducted through organisation wide forums or via working parties.

· A set of clear rules and sanctions, so that when people do feel tempted to slacken off their vigilance, their mind can be concentrated by the prospect of some direct sanction to which their slackness might render them liable.

· Regular audits and random checks to establish how far organisational rules are being complied with or violated - it is important that this process is introduced in a manner consistent with good employee relations practice, otherwise it may be counterproductive, if people resent it (and thus will try to subvert it).

· A clear information management strategy in the broadest sense will also help to clarify what information goes where, who can have access to what, what land of authentication is required, and so on - many criminals gain access to systems simply by asking a question of someone who is not sure who they should or should not tell.

Such activity achieves so much, but not more - the well meaning individual who leaves their username or password lying about may well change their behaviour as a result of a combination of education, encouragement and sanction. But the ill-meaning individual, who is intent on damaging the business or, worse, on criminal activity, will remain untouched by all of this. Nevertheless, the more awareness there is of security issues in general, the harder it is for an individual to take advantage of the system. As simple a matter as the policy on out of hours working is also important here - if someone is to commit industrial espionage, of an electronic or physical form, they are far more likely to do it when there are few people around than when there are many. A policy of notification of out of hours working, and of recording who accesses what data, can significantly reduce the degree of exposure, sufficiently so that a criminal decides to go elsewhere to get what they want.

Controlling data access

The prime feature of any violation of security for an e-business is where some unauthorised party reads, and maybe changes, data. One natural way of preventing this happening is to make the transmission medium as secure as possible - we shall deal with that to some extent in the following section.

Another way is to make the data useless, because it makes no sense to the reader. This is the concept behind encryption, the transformation of data via a code or key so that only authorised people can read it. It is as old as the Elizabethans (if not older), though recent developments in mathematics have made it a much more powerful tool.

Public key encryption has been welcomed by the computing industry, but as yet has not had a major impact, primarily because of the loss of performance involved. Some approaches try to make the most of the relative speed of symmetric keys and the relative security of asymmetric, using technologies such as digital envelopes, where the bulk of the data is transmitted using the faster symmetric method, but the symmetric key is itself transmitted using an asymmetric key.

User identification

Spoofing, website theft, and similar moves underline the need for a business to establish clearly who they are dealing with. We have seen that passwords, though extremely easy to use, have a plethora of potential limitations - loss of password, inadvertent disclosure, sloppy password security, naive password choice, amongst others. Despite these, password driven entry remains an important, if limited, component of the overall security system of an organisation.

There are, however, further and more sophisticated forms of authentication of users. Public key encryption can be used to develop additional protections, such as:

· Digital signatures: Each document is processed initially by a special function (called a hash function) to produce material that functions as the signature; this along with the original data is then encrypted in the normal asymmetric way; the recipient then decrypts in the usual way, and also reverses the hashed material; if the de-hashed material mirrors the original message, then there has been no tampering with it since initiation from source; in this way each document has a unique identification.

· Digital certificates: There are now a number of central authorities, called certificate authorities, that issue certificates that verify the identity of an e-business, including digital signature and other relevant information; these authorities include private organisations such as Verisign, and state bodies such as Post Offices.

One advantage of these methods is that it is harder for an individual to repudiate a message - hence its value for legal purposes. Though it cannot do much about repudiation of receipt of physical goods, it can establish that a certain individual really was the person who ordered certain goods or services.

Transmission security

Potentially, there can be many different kinds of signature, many different kinds of certificate structure. Two protocols have been developed that standardise this aspect of security:

· Secure sockets layer: SSL - also known as TLS or Transport Layer Security -is a standard relating to authentification and certification.

· Secure Electronic Transaction: SET is a more comprehensive approach to authentication developed to facilitate online credit card transactions; not only does it verify who someone is, it also carries out the other electronic messaging necessary to complete a transaction, such as contacting the credit card company.

All of these initiatives are being continually developed and strengthened via a range of government initiatives. The USA, in particular, has set up several bodies to improve the management of security for the internet, partially as a means of improving their detection of criminal, and more latterly terrorist, internet activity.

Summary

1. Much of the risk with e-business is due to human factors.

2. Virus like programs - malware - are continually developed.

3. There is a wide range of different kinds of hacker, not all of whom are malicious in intent.

4. Encryption - especially asymmetric - is the prime method of protecting data.

5. Public key encryption can be extended to provide further forms of security such as digital certification.

Размещено на Allbest.ru