Research By :
Kuo Lane Chen
Vance Etnyre
Huei Lee
Analysis/Summary By:
Gautam Sarswat
ABSTRACT
The purpose of this research paper is to examine possible information security problems and recommend possible ways to evaluate and reduce information system risks.
INTRODUCTION
Despite the growing popularity of VPN-based Intranet systems, security remains one of the major concerns regarding the use of the Internet. Organizations now have to contend with Internet “worms”, network intrusions, and compromised computers.
LITERATURE REVIEW
In 2002, Microsoft provided a system of advanced Internet development tools – the .Net Framework and XML Web services. The .NET platform is similar to Sun Microsystems’s Java 2 Platform Enterprise Edition (J2EE). These systems aid application developers by providing useful tools to create web-based applications. They also provide security control structures for Intranet applications development (Stiefel & Oberg, 2002).
There are two security weaknesses inherent in the current infrastructure of Intranet-based systems. First, high-speed telecommunication lines (Internet backbone) are subject to line breakage, causing disruption of service. Second, messages and other information are susceptible to being intercepted, recorded or modified as they pass from the host to the recipient.
virtually no law that prevents any Internet Service Provider (ISP) from observing, recording, selling, or giving away any information that passes through host computers. Major problems in Internet and Intranet security include virus attacks, denial-of-service, industrial espionage, and spam mail.
SECURITY MANAGEMENT TECHNIQUES
can be divided into three major approaches: 1) general technological approaches, 2) behavioral approaches, and 3) systems programming approach.
General Technological Approaches
1. Authentication
Authentication means that a person using the system is required to prove his or her identity (Panko, 2003). The forms of authentication include passwords, personal identification number, membership ID, or cryptographic key (Raisinghani & Savoie, 1999).
2. Authorization
Authorization means that only certain individuals or groups or users filling certain roles may have access to specific resources.
3. Encryption
Encryption converts the sender’s message into ciphertext, which an interceptor will not be able to read. At the receiving end, the receiver decrypts the ciphertext back to the sender’s original message.
Secure Socket Layer (SSL), developed by Netscape Communications, is a popular encryption protocol that makes language passing through the Internet indecipherable. It has become a de facto standard for Internet e-commerce security (Panko, 2003).
4. Digital Certification
Digital certification is another way to assure security. Using digital certification, a sender adds to each message a digital certificate, which is created by a certificate authority
5. Firewall Systems
Webopedia.com defines a firewall as “A system designed to (selectively) prevent unauthorized access to or from a private network.” There are two kinds of firewall systems: Packet Filter Firewalls and Applications Firewalls. In Packet Filter Firewalls, the packet IP and TCP headers are examined any packet IP or TCP header containing a local resource address is terminated. A technique known as network address translation is also used in firewall systems. Applications firewalls, also known as proxy firewalls, examine the application layer messages to check for possible problems (Panko, 2003).
Behavioral Approaches
Behavioral approaches means that careful internal management can prevent security problems.
Systems Software Approaches
Since most PC-based systems in small and medium companies are Microsoft systems, it is important to discuss special approaches in Microsoft’s new .NET platform.
The .Net environment gives programmers and service providers a single platform that can be used to compile programs written in several different programming languages. The Common Language Runtime feature of .NET allows providers with a mechanism that can combine components written in different languages into a coherent integrated package.
One of the most important features of the .NET platform is the ability to create Web Service applications. However, without Microsoft’s Internet Information Service (IIS) package installed and activated, the user loses the ability to create Web Service applications. Also, in order to use the IIS package, the user must be granted administrative security clearance. As one can see, this creates major problems for the network security. Once the user is granted the permission to use the IIS package, this access to the critical network components with IIS makes the entire network vulnerable to severe accidents and malicious attacks because it allows users unnecessary access to other various resources of the server. In general, IIS provides only three types of security control techniques: authentication, authorization, and impersonation. Authentication includes forms, Passport authentication, and Windows authentication. In Passport authentication, the user is redirected to a login page on Microsoft’s site. These security control techniques are sufficient for e-commerce, but more rigorous security control methods should be available to protect other more restricted configurations such as company Intranet systems. (Augustyniak, 2002).
One of the issues discussed in .Net Framework is the role-based security. Instead of examining each individual user name, an administrator can assign a user a specific role-
based security clearance. For instance, a general employee has the right to login into the systems, but he does not have right to revise the payroll file. Role-based security methods can be coded in various programming languages for .NET applications (Stiefel & Oberg, 2002).
The NET platform allows students to learn how to create and use Web Service applications – the hottest new topic in computing. This, however, opens a new security problem. Unlike most business settings, where each person has responsibility (and accountability) for a single computer, many universities use a “semi-open lab” environment. Although there are limitations to general use of all university computers, in a semi-open lab, any student can log in to any available computer. Although there is some temporary accountability in this scheme, additional security problems are inherent in this environment.
In any computing environment, a primary goal of system administrators is to allow convenient access to authorized users while denying access to unauthorized users and unauthorized uses of system resources. This requires a balance between the security concerns of system administrators and the access needs of system users.
RESEARCH METHOD
An experiment has been conducted to establish a method for balancing the needs of system administrators and system users. Graduate students within an MIS program at University of Houston – Clear Lake were divided into two groups. The participants were asked to identify themselves as primarily ‘programmers’ or primarily ‘administrators’. Each group was asked to evaluate alternative modes of configuration in a university semi-open lab environment. The three alternatives for computer lab configuration are:
1. Alternative 1 – (Full Access to All)
One way to configure software in open labs is to have all authorized software available to all workstations. This would provide maximum access to software resources. The cost of doing this can be huge, however, and the exposure to risk of unauthorized uses and unauthorized users could be unacceptably large.
2. Alternative 2 (Segregating) – Restricting Access to a limited set of public resources
In this alternative, a small number of computers in the ‘open lab’ environment are configured to contain a full implementation of the .NET platform (including IIS), while the rest of the computers are configured with a limited configuration (excluding IIS). Only students from a special list are allowed access to the restricted computers.
3. Alternative 3 (Isolating) – Removing a limited set of resources from general availability.
Removing a limited set of resources from general availability and using them to create a local private network change the strategy in a significant way. Computers on the private network are subjected to risk as the server software executes, but that risk is isolated to the private network. Computers in the “open labs” can be easily protected from these higher-risk machines.
In the experiment, seven students identified themselves as “primarily programmers”. Five students called themselves “primarily administrators”. Student participants were asked to evaluate each of the three configurations using four evaluation categories in a “10*10” weighted scoring scheme. The evaluation categories were: Accessibility, Cost Control, Performance Efficiency, and Risk Control. Each category was evaluated with a score from 0 (totally unacceptable) to 10 (ideal). Weights were assigned to each category with the total of all weights equal to 10.0. In such an evaluation system, the range of weighted scores is from 0.0 to 100.0.
ANALYSIS
The problem of resolving preferences is relatively easy in this situation. A balance should be found between the preferences of the programmers, who gave the highest rating to alternative 1 (“Full Access”), and the preferences of the administrators, who gave the highest rating to alternative 3 (“Isolated Subset”).
CONCLUSIONS AND FUTURE RESEARCH ISSUES
In any computing environment, the primary goal of system administrators is to allow convenient access to authorized users while denying access to unauthorized users and unauthorized uses of system resources. This requires a balance between the security concerns of system administrators and the access needs of system users. One purpose of this paper is to review security management techniques for an intranet system.Another purpose is to propose a method for evaluating system configurations. The method proposed allowed for a balancing of concerns of system administrators and system users. The Research Methods section of this paper discussed a method and an experiment for evaluating various system configurations. The results of the experiment, which showed a preference for an “Isolated Subset” of system resources to implement high-risk applications, were limited to the type of configuration found at many universities.Further studies can and should be conducted to see if the same evaluation method can be used in other computing environments.
