Abstracts of Recent ArCicles and Literature

vast array of methods of communication. Sadly, it is a matter of fact that for every different type of system, there are many and varied methods for criminals to defraud and exploit them.This article explains some of the ways in which different systems can be exploited by criminals to gain unauthorized or fraudulent access, examining how and why it is done and the potential liabilities to business. There are many ways the fraudster can obtain the electronic information required to establish a clone; it can be collected using a radio scanner to monitor the frequencies used by the networks. Information can be read from the manufac- turer’s panel behind the battery, or from the display, or even obtained from the legitimate owner by some pretext. However, it is probably true to say that this is problem is on the decrease as a result of work by the network providers. More serious for the business user is the danger that analogue phones represent in terms of call security. Many users fail to appreciate the rela- tive ease with which analogue mobile phones can be monitored. Business users need to recognize the potential for fraud. Most dial-through fraud can be prevented by ensuring that remote engineering access is limited. A dial-back modem will go some way towards maintaining system integrity when coupled with ensuring that the password is a minimum of six random alphanumeric characters, and is changed at least every three months. The ~olrrnal or International Security, Vol. 7, Issue 718, 1997, pp. 261-263.

In the line of fire,jan Guildentops. If you don’t take precautions you could be inviting others to take a look at your company’s network.You must make sure that your network, and all information in it, is safe from the prying eyes of the global Internet community. Because it is virtually impossible to safeguard every PC in the network, the firewall principle states that you should concentrate all your security efforts on one spot - the front door formed by the connection of the net- work to the Net - closing this gateway to all but the most harmless forms of Net traffic, and scrutinizing and verifying all data before allowing it to proceed. A firewall is of no use unless it is deployed as part of an overall security plan. It must be checked, maintained and updated regularly to do its job well. Before you start thinking about gadgets such as firewalls and

encrypted connections, ask yourself some basic ques- tions. Which information has to be secured and on which systems does that information reside? If you’re using a standard Novell IPX network with all data held on the server and without and TCP/IP connec- tions, your security requirements will be different from those of a fully fledged TCP/IP network. It is also necessary to decide from who or what you wish to secure your valuable data. Make an inventory of the different ways someone can gain access to the net- work. Who is in charge of managing key security ele- ments such as a firewall and its configuration? Permanent Internet connections pose most security risks. Installing a firewall is therefore necessary to ade- quately shield the network from the Internet. Network Solutions, August 1997, pp. 17-30.

Bridging the business-to-business authentica- tion gap, Christy Hudgins-Bonajeld. Public Key (PK) authentication and underlying encryption ultimately will determine whether businesses forsake private net- works to derive the savings, collaborative and compet- itive benefits of the Internet. Similarly, authentication, access control and privileges may underlie efforts to streamline staff previously needed for business-to- business transactions. Most businesses are just entering a pilot period f or testing and building in-house public key certificate systems. Both businessses and vendors are discovering that the framework for this new child of the Internet has yet to be established and that there are many gaps and hurdles on the road ahead. On the plus side, users finally will have freedom of choice in what has been a narrow PK authentication market. One critical roadblock to widespread deployment is the fractured and overlapping nature of security stan- dards and approaches. In security, it is hard to make choices, but important to do so. One of the chief ways encryption will be implemented for authentication lies with an IETF standard known as IPsec. How will business handle Government key recovery require- ments? Many businesses will want to enhance securi- ty by using short-lived encryption keys. Vendors already have products that offer a different key for each packet, although most users will prefer longer time intervals. Network Computing,July 15, 1997, pp. 63-79.

512