OVERVIEW
If you've been following these articles and thinking about all of
the things you should be doing to protect information, your brain
is probably on fire by now. This is the forth and final installment
and we have only have just touched on some of the possible risks to
your vital information.
Don't worry, protecting information is a matter of creating
security layers and that is done over time. Make a list of objectives
and assign priorities based on actions that will patch the biggest
holes in the least amount of time at the lowest cost.
The first article exposed some of the risks and suggested that a
risk management program should be set up to create policy. This is
your first step. It will make you aware of your vulnerabilities by
identifying vital information and creating procedures and methods
for protecting that information. This cost you practically nothing.
The second article covered the CISP (Cardholder Information
Security Policy) being instituted by the credit card acquiring
networks. Even if you aren't running a storefront making credit
card transactions, you should find that much of the information
provided there is useful across the board.
The third installment described a number of site and
form design practices that should be followed. Certainly, if you
have a large Web site, upgrading can be a daunting task. This is
why you need a management plan to identify the areas of greatest
risk and fix those first.
EDITORIAL
CISP is a misnomer! It could more accurately be called MAPP
(Merchant Acquirer Protection Policy). After all, who is being
protected? The cardholder already has a maximum exposure for
card misuse of $50 and for some newer card issues, no liability
at all. So what's this about Cardholder Security? CISP is about
protecting the acquiring merchant bank from exposure so they can
pursue agressive marketing programs. This agressiveness isn't all
bad, though. It does put more buying power in the hands of the
consumer with more confidence to make on-line purchases.
Consequently, the on-line merchant benefits; unfortunately for
the small merchant, the burden increases.
MYTHS
SSL (Secure Socket Layer) is the commonly used protocol solution
to encrypting data while in transit on the Internet. This protocol
is enabled with a digital certificate installed on a server. The
certificate serves two functions: It should verify that the host
domain is who they say they are and it encrypts the data traveling
back and forth between your customer's browser and the host server.
Certificates are sold to a requesting party by issuing companies.
These companies have a critical interest in sales growth.
One might conclude that the certificate will only reflect the rightful
identity of the applicant to the extent that the issuer is willing to
invest time and money checking the applicants bonafides. Such a
conclusion wouldn't be unfounded. Recently a perpetrator
represented themself as Microsoft and received two certificates.
Certificates are often shared on a single server in a multi-domain
environment. When this is done, the only verification of identity
is that the domain resides on a particular machine at a particular
IP address number. It doesn't mean that the site you're visiting
is to be trusted.
Certificates on a "trusted" site can in some instances act the same
as signatures for signed code. Depending on your browser security
settings, this "trusted" code could be be used for vile purposes like
reading and erasing your hard drive. The chances are that you'll
never know who did it or even that it was done, unless of course,
your files are erased.
Certificates use a symmetric scheme to encrypt data in transit over
the Internet. This means that the client browser and the serving
host are using the same key to encrypt/decrypt the data. A sophisticated
hacker can get the key and begin a packet sniffing session.
Packet sniffing is the re-routing of data bits over the Internet,
usually to a hacker's machine. The hacker's machine will set up a session
with the client computer by pretending to be the intended client
target (the host) or simply by inserting themselves transparently between
the client and the host. Once the session is established, the hacker
can read anything you, the client, send to the host and anything that the
host sends to you.
This means that, in spite of SSL, logon and administrative passwords
are still vunerable to reading by someone that is determined to do so.
These passwords may give the hacker full run of the office. IE: once
admin passwords on a server are compromised, all information on that
server is available to the hacker.
