Privacy, Confidentiality, Security And Control Issues Relating To The Wide-Spread Use Of The

Dr. Karen A. Forcht Professor of Information and Decision Sciences College of Business James Madison University Harrisonburg, VA 22807 Forchtka@jmu.edu

Loyola College in Maryland Baltimore, Maryland April 11,1997 Presentation for: David D. Lattanze Center For Executive Studies in Information Systems Loyola College in Maryland Baltimore, Maryland April 11,1997

Internet . . .

Overview Of Presentation Internet Defined Development of Internet Policies Basic Internet Security Mechanisms Firewalls Cryptographic Techniques Consumer Concerns with Internet Security Doing Business on the Internet Internet Security Tools and Techniques

Network of Networks Over 30,000 Networks 4,000 host computers 40-50 million people worldwide 10,000 users added monthly in U.S. Over 85 countries Relies on Voluntary Cooperation/Respect No responsible governing body

Began in late 1960s - Department of Defense Advanced Research Projects Agency (ARPA) - 1970’s National Science Foundation - 1980’s Late 1980s, became public

Information poor versus information rich Basically free use Maintenance/upkeep becoming burden Commercial sites growing

Growth of Internet Introduces: Issues of Security Reliability Ownership Liability

Uses of Internet E-mail “Surfing” Global Information Transfer File Transfer Protocol (FTP) Chat Groups Bulletin Boards Clubs/Organization Boards Pornography Solicitation Commercial Ventures

Connectivity Problems Include TCP/IP Incompatibility Uniform Resource Locators (URL’s) unreliable Hypertext Markup Language (HTML) slows down systems Name Pages Proliferate Lack of implementation of open systems interconnection (OSI) globally

No one police unit Laws do not apply Anonymous users Responsibility for under-age users Spamming, Cracking E-mail insecurity Password capture

Crimes of Internet Use Pornography Child solicitation Financial data diverted Hacking Data manipulation

Today’s Security Climate Network Use Policies/Protocols Employee Attitude/Training Fair Competitive Practices Clear Organizational Structure Fair use Policies

Personal Credo When Using Internet Integrity - accuracy Reliability - complete Availability - up to date Security - adequate protection measures

Introducing over long time Provide case studies Emphasize improvements Consider employee input Set senior management’s commitment/involvement Describe consequences of security breaches Consider diverse opinions Appoint workgroup security person Develop policies and procedures Enforce standards Monitor compliance

Parameters to Include in Internet Policy Authentication -- proof of identity Access Control - who/what Integrity - pureness of data Confidentiality - keep information private

People Problems Design and implementation of security mechanisms should consider: Complexity of communications networks Counter measures when using algorithms Unique services/procedures not always clear Physical placement of network points/nodes Encryption keys need protection

Attack Points Send Mail Login bypassing authentication Password sniffers Script availability

Internet Security Tools Firewalls Cryptology Authentication settings Secret Keys Public Keys Clipper Chip Secure Socket Layer (SSL) Secured Servers Physical Security

Consumer Concerns Pornography Privacy Racial/Sexual Harassment Credit card/billing issue Password Capture E-mail violations Stalking Diversion of Financial Transactions

The New Internet Talk Work Shop Play Invest

Available Techniques (PGP) Pretty Good Privacy Software E-mail Protection Devices Password Protection Schemes Using Protection Software Chipper Chip Technologies Encryption Devices