Abstracts of Recent Articles and Literature

breath until the danger passes. More frequently, however, relatively mundane viruses are transferred through floppy disks and E-mail. The potential for viruses em- bedded within messages sent to the message system database is increasing. As messages are shared and sent over corporate networks so too can viruses spread. When it comes to groupware servers, most anti-virus products are ineffective because they tend to skip over very large files. When a message hits the groupware server, Cheyenne’s Antivirus Agents can either detect a virus and delete the document or cure the virus and reattach the document. The agents search for and re- move viruses spreading throughout a messaging system, including Concept, a macro virus that is written in Microsoft Word’s macro language. McAfee recently an- nounced it has discovered a macro virus that can infect Microsoft Excel spreadsheets. To combat this virus, McAfee has developed a new module that works with its VirusScan anti-virus software. LAN, November 1996, p. 20.

Tips for safeguarding your digital assets. This article outlines how you can articulate about security, facilitate decisions regarding obtaining the necessary security equipment and prepare a plan ofaction. Outline the risks and make constructive suggestions. Write a strong enforceable security policy which demands man- agement approval for all Internet-based electronic commerce endeavours. A thorough risk assessment will enable you to articulate the range of risks, threats and vulnerabilities your organization is exposed to. Incor- porate electronic commerce into the overall network security architecture. If your organization hasn’t already developed a comprehensive approach to security, the move toward electronic commerce could be an excel- lent opportunity to get it done. Use security tools as they become available. Turn on and rigorously use the controls supplied by the vendors and Internet service providers. An organization involved with ED1 must take care to ensure that its trading partners employ a level of security at least as good as its own. Use strong encryp- tion. Keys fewer than 100 bits in length may not be a good idea. Keys of 40-50 bits can be broken by deter- mined hackers using brute force attacks. The decrypted values and keys should be stored on a machine that has no connection to the outside network. Consider a security module or tamper-proof enclosure that erases the keys if and when the device is tampered with. Regular comprehensive audits, as well as intrusion de- tection efforts should be conducted on host systems.

Implement strong authentication. One-time authenti- cation is better than any fixed password scheme, as long as it is not cost prohibitive. Devise disaster recovery and business continuity plans for electronic commerce ap- plications and data. Establish clear, concise policies and mechanisms for responding to complaints of fraud, whether perpetrated by or against customers, trading partners, employees or others. LAN, October 2996,~ 60.

Controlling access, Morris Edwards. More companies are giving Internet access to their employees. In doing so they expose their internal network to intruders from any part of the world at any time. The Yankee Group of Boston, USA expects the tirewall market to grow from an estimated $121 million in 1995 to a projected $924 million by 1999. International Data Corp. sees the market expanding from 10 000 units shipped in 1195 to 1.5 million in 2000. Firewalls are generally used to limit outsider access to the internal corporate network via the Internet. For organizations with intranets, tire- walls can also be used to limit internal access to departments with sensitive information such as finance and human resources. A firewall offers no protection once an intruder has penetrated or circumvented it, so the firewall must be immune to penetration and all traffic to and from the Internet must pass through it. Firewalls allow the network administrator to consoli- date security at a single, centralized location rather than being distributed to every host on the network. Internet security can be monitored at the firewall and alarms generated if suspicious activity occurs. The tirewall is also useful for logging and auditing Internet usage. Application gateways are the most secure because they validate not only the IP address, but also the session and the application itself. Application gateways are the most difficult to implement, however, and perform the slow- est since they do such exhaustive checking of the traffic. Circuit-level gateways validate the IP address and the session, but not the application, so they are faster but less secure. Application gateways are less flexible and more intrusive, but this relative lack of transparency is the price for higher security Conrrnunicutions News, October 1996. pp. 78- 79.

Getting real about virtual private data nets, Nick Lippis. Creating secure links over the Internet is going to take some serious effort. This is a new trend referred to as virtual private data networks (VPDN); extending a VPN to include the Internet for data. Instead of managing routers and private lines, companies just buy

588