1. Security and Privacy: Panel of Perspectives Rick Skeel University of Oklahoma

2. Where Are We Most Vulnerable To Security Issues?  Integrity of the record  Privacy of the record  At sending and receiving points

3. How it can and does happen... –Destruction, Alteration, Disclosure of Data  65% Carelessness, Honest Mistakes  19% Disgruntled Employees  13% Physical Damage  3% From Outside - Hackers Source: “ Session 8.1 Security and Acknowledgement ” by Jeanenne Rothenberger, SPEEDE Workshop, Baltimore MD, October 18-20, 1992

4. How it can and does happen (cont’d)... “ Globally, 79% of participants in 12 countries said that a breach in their e-commerce system would most likely be perpetrated through the Internet or other external access. It is well documented, however, that the greatest risk is from internal perpetrators – such as disgruntled or former employees or external service providers who have an established relationship with the company – who may commit the breach, or may supply the information necessary to do so to someone else.” Source: KPMG Survey, as reported by Antoinette Panton, KPMG, March 2001 Press Release “ Companies underestimate internal threat, says KPMG ”

5. So you see...  For sending and receiving data, the more serious security risks are within our own offices - not in transit  Can be overcome with... –Office policies and procedures –Controlled access to sensitive information –Audit mechanisms –User training and education –User documentation and support

6. EDI – One Approach For Security  Fewer Paper Handlers  Eliminate U.S. Mail  Require a more Sophisticated Tamperer  Acknowledgment and Receipt  Easier Tracking for Sender and Receiver

7. Security … EDI-style Transcript Exchange  Control counts built into data … integrity –transaction set, functional group, interchange  Unique identifiers for trading partners … authentication  Acknowledgements … non-repudiation, integrity  Encryption … confidentiality –Can choose to add or not –Works better in small, closed system –Large effort to counter smallest risk (remember the 3%?)

8. Are signatures still relevant?  Outside our own jurisdiction, who recognizes and/or verifies? –e.g. banks & checks (cheques )  General acceptance of new paradigm without signature –Credit cards, debit cards  “Acceptance” of “implied confirmation” –Computer software (“By breaking this seal, you accept…”) –Check boxes (“I agree…”)  Digital signatures –Link you to the computer, not necessarily the person intention –Carry the same notion of intention as hand-written signature? –http://www.schneier.com/crypto-gram-0011.html

9. Identity Theft – The Newest Threat  Serious issue or just in the news?  Use of the SSN on campus –Who really needs access? –Who wants access? –Who gets access?  ID number on student & faculty/staff cards