| Related sites for http://jwd-ods.blogspot.com |
| Lowth_com Linux security and related software articles and tools. | | Smart_Webby Free articles, guides, tutorials, tips and tricks on web design, development and promotion. | | JohnD39\'s_QLink_Page Pictures of Q-Link alumni and an internet contact list. | | Concord_Technologies Offers toll free unified messaging services along with fax broadcasting and internet based fax transmission throughout the United States. | | 7H_Free_Web_Hosting 20Mb. Banner ad on each page. Web-based email account. Site building tools. Domain hosting. URL: 'http://yoursite.7h.com/'. | | Link2Mark Bookmarks may be imported and exported, and WAP access is available. | | Jonas_Walldén__Macintosh_Shareware Desktop utilities. | | Jan-Jaap Large collection, including an OMR form creator and reader, mainly documented in Dutch. | | RFC_1245 OSPF Protocol Analysis. J. Moy. July 1991. | | Assembly_HOWTO by Konstantin Boldyshev, Francois-Rene Rideau: insightful, general systems and usage philosophy, and tips. | | PrettyCode_Encoder This tool colors your Visual Basic and VB.NET code in HTML format. Advanced options enable you to add line numbers, change default auto-indenting options, your custom colors. | | Wandering_Star Contact management and real estate investment software. | | SDL_gui A library written in C++ for displaying and controlling user interface elements in an SDL application. | | Teaching_Computer_Classes Handouts and tutorials for various Microsoft computer classes. There are also links to other similar sites. | | BenefitFocus_com Offers benefit enrollment software designed to improve productivity and reduce costs. | | RFC_2588 IP Multicast and Firewalls. R. Finlayson. May 1999. | | Webility Offers hosting and website design services. | | iTeam_Graphics Offers design, hosting, cgi scripts, shopping carts, databases, and forms. | | CMX-MicroNet_TCP/IP_Networking Commercial TCP/IP stack for 8-bit and 16-bit embedded processors. | | Web_Content_Categorization_Using_Link_Information By Zoltan Gyongyi and Hector Garcia-Molina, Stanford University, and Jan Pedersen, Yahoo. Technical Report, June 2006. Introduces a link-based approach to classification, which can be used in isolatio |
|
Thoughts on Security
/*
-----------------------------------------------
Blogger Template Style
Name: Minima
Designer: Douglas Bowman
URL: www.stopdesign.com
Date: 26 Feb 2004
----------------------------------------------- */
body {
background:#fff;
margin:0;
padding:40px 20px;
font:x-small Georgia,Serif;
text-align:center;
color:#333;
font-size/* */:/**/small;
font-size: /**/small;
}
a:link {
color:#58a;
text-decoration:none;
}
a:visited {
color:#969;
text-decoration:none;
}
a:hover {
color:#c60;
text-decoration:underline;
}
a img {
border-width:0;
}
/* Header
----------------------------------------------- */
#header {
width:660px;
margin:0 auto 10px;
border:1px solid #ccc;
}
#blog-title {
margin:5px 5px 0;
padding:20px 20px .25em;
border:1px solid #eee;
border-width:1px 1px 0;
font-size:200%;
line-height:1.2em;
font-weight:normal;
color:#666;
text-transform:uppercase;
letter-spacing:.2em;
}
#blog-title a {
color:#666;
text-decoration:none;
}
#blog-title a:hover {
color:#c60;
}
#description {
margin:0 5px 5px;
padding:0 20px 20px;
border:1px solid #eee;
border-width:0 1px 1px;
max-width:700px;
font:78%/1.4em "Trebuchet MS",Trebuchet,Arial,Verdana,Sans-serif;
text-transform:uppercase;
letter-spacing:.2em;
color:#999;
}
/* Content
----------------------------------------------- */
#content {
width:90%;
margin:0 auto;
padding:0;
text-align:left;
}
#main {
width:70%;
float:left;
}
#sidebar {
width:25%;
float:right;
}
/* Headings
----------------------------------------------- */
h2 {
margin:1.5em 0 .75em;
font:78%/1.4em "Trebuchet MS",Trebuchet,Arial,Verdana,Sans-serif;
text-transform:uppercase;
letter-spacing:.2em;
color:#999;
}
/* Posts
----------------------------------------------- */
.date-header {
margin:1.5em 0 .5em;
}
.post {
margin:.5em 0 1.5em;
border-bottom:1px dotted #ccc;
padding-bottom:1.5em;
}
.post-title {
margin:.25em 0 0;
padding:0 0 4px;
font-size:140%;
font-weight:normal;
line-height:1.4em;
color:#c60;
}
.post-title a, .post-title a:visited, .post-title strong {
display:block;
text-decoration:none;
color:#c60;
font-weight:normal;
}
.post-title strong, .post-title a:hover {
color:#333;
}
.post div {
margin:0 0 .75em;
line-height:1.6em;
}
p.post-footer {
margin:-.25em 0 0;
color:#ccc;
}
.post-footer em, .comment-link {
font:78%/1.4em "Trebuchet MS",Trebuchet,Arial,Verdana,Sans-serif;
text-transform:uppercase;
letter-spacing:.1em;
}
.post-footer em {
font-style:normal;
color:#999;
margin-right:.6em;
}
.comment-link {
margin-left:.6em;
}
.post img {
padding:4px;
border:1px solid #ddd;
}
.post blockquote {
margin:1em 20px;
}
.post blockquote p {
margin:.75em 0;
}
/* Comments
----------------------------------------------- */
#comments h4 {
margin:1em 0;
font:bold 78%/1.6em "Trebuchet MS",Trebuchet,Arial,Verdana,Sans-serif;
text-transform:uppercase;
letter-spacing:.2em;
color:#999;
}
#comments h4 strong {
font-size:130%;
}
#comments-block {
margin:1em 0 1.5em;
line-height:1.6em;
}
#comments-block dt {
margin:.5em 0;
}
#comments-block dd {
margin:.25em 0 0;
}
#comments-block dd.comment-timestamp {
margin:-.25em 0 2em;
font:78%/1.4em "Trebuchet MS",Trebuchet,Arial,Verdana,Sans-serif;
text-transform:uppercase;
letter-spacing:.1em;
}
#comments-block dd p {
margin:0 0 .75em;
}
.deleted-comment {
font-style:italic;
color:gray;
}
/* Sidebar Content
----------------------------------------------- */
#sidebar ul {
margin:0 0 1.5em;
padding:0 0 1.5em;
border-bottom:1px dotted #ccc;
list-style:none;
}
#sidebar li {
margin:0;
padding:0 0 .25em 15px;
text-indent:-15px;
line-height:1.5em;
}
#sidebar p {
color:#666;
line-height:1.5em;
}
/* Profile
----------------------------------------------- */
#profile-container {
margin:0 0 1.5em;
border-bottom:1px dotted #ccc;
padding-bottom:1.5em;
}
.profile-datablock {
margin:.5em 0 .5em;
}
.profile-img {
display:inline;
}
.profile-img img {
float:left;
padding:4px;
border:1px solid #ddd;
margin:0 8px 3px 0;
}
.profile-data {
margin:0;
font:bold 78%/1.6em "Trebuchet MS",Trebuchet,Arial,Verdana,Sans-serif;
text-transform:uppercase;
letter-spacing:.1em;
}
.profile-data strong {
display:none;
}
.profile-textblock {
margin:0 0 .5em;
}
.profile-link {
margin:0;
font:78%/1.4em "Trebuchet MS",Trebuchet,Arial,Verdana,Sans-serif;
text-transform:uppercase;
letter-spacing:.1em;
}
/* Footer
----------------------------------------------- */
#footer {
width:660px;
clear:both;
margin:0 auto;
}
#footer hr {
display:none;
}
#footer p {
margin:0;
padding-top:15px;
font:78%/1.6em "Trebuchet MS",Trebuchet,Verdana,Sans-serif;
text-transform:uppercase;
letter-spacing:.1em;
}
@import url(http://www.blogger.com/css/navbar/classic.css);div.b-mobile {display:none;}
function setAttributeOnload(object, attribute, val) { if(window.addEventListener) { window.addEventListener("load", function(){ object[attribute] = val; }, false); } else { window.attachEvent('onload', function(){ object[attribute] = val; }); } }
Thoughts on Security
Ideas and thoughts about computer and information security.
Finally, a sensible security scheme | Tech News on ZDNet
Finally, a sensible security scheme | Tech News on ZDNet, and one that any enterprise could follow with a few simple changes. The basis for the article is the Visa Cardholder Information Security Program, which is designed to protected credit card information and transactions while being processed by merchants and card processing service providers. The Visa program has a number of tools, including a program description, a compliance audit procedure, training and list of certified consultants available to assist in meeting compliance requirements.
The most important tool for those that want to improve security in their own networks is the Security Audit Procedures and Reporting document (in pdf). At the high level the Visa program has 12 steps (taken directly from the web site):
Install and maintain a working firewall to protect data.
Keep security patches up-to-date. Protect stored data. Encrypt data sent across public networks. Use and regularly update anti-virus software. Restrict access according to "need to know" basis. Assign unique ID to each person with computer access. Don't use vendor-supplied defaults for passwords and security parameters. Track all access to data by unique ID. Regularly test security systems and processes. Implement and maintain an information security policy. Restrict physical access to data. These are explained in detail in the Audit Procedure document, which sets out what should be implemented and how to verify compliance in a very easy and straight forward manner. The only change any enterprise needs to make is to replace the words "cardholder information" with whatever data is critical to their business. Visa developed this so that external partners had a security roadmap to follow. Note that it may be necessary to consult with Visa about using this, or a very similar program, as Visa holds the copyright. But at least the principle of giving external partners useful security guidance is of value.
Moreover, most enterprises would improve internal security if they followed these, or similar, guidelines themselves. Access to all business critical data is tracked by user, and all business critical data is encrypted while stored (at rest), and while in transit outside local area networks.
The reader should study the Audit Procedure document and work out what the elements of the security architecture are that are necessary to meet the requirements. There are obvious hardware and software elements. What resources are required to support the added complexities that face the knowledge worker, or the system administrator in this environment? Visa says that these are the requirements to do business with them, and there are significant financial penalties for failure to meet these requirements, even if the failure to meet these requirements does not result in a security incident and loss of information or money.
As much as I like these guidelines, I still feel there are critical elements that have not been addressed. Can you spot some of the weaknesses that would exist in an implementation of these guidelines? Next time I will revisit this with some suggestions for improvement.
posted by John Davidson at 19:08
189 comments
 
|
|
