View/Open - JUWEL - Forschungszentrum Jülich

Hacking and Protecting a Cultural Website : The Case ofCVC
and the systems team since the administration and maintains of the website depend on
the way the software development is done .
The technical team in the CVC has the following objectives:
To attain that the applications work through the security servers.
To transfer the security accrediting patterns through the different levels of the
application.
To carry out the authorization.
To guarantee the data integrity and privacy as they are spread along the public
networks .
To guarantee the security ofthe application state with a database .
To make an application that could be enlarged to admit a larger number of users .
What is wanted to be protected?
According with our security policy: every element in our website should be protected,
from any attempt of unauthorized access from the outside, including hardware, software
and data .
What kind ofdata is used in the CVC?
For example, if a user wants to register in our web, these are the date that the user has to
introduce .
Personal details, such us : name, surname, e-mail address, age and country .
Then, Technical details, such as, connection rate, operative system, if he has or has not
sound card.
Why we need these technical details?
Well, for us would be useful to know the user's technical details to tackle the
development ofnew web applications.
Also, Professional details. In the case the user were a Spanish teacher as a second
language, he would introduce the name of his working place or the total number of
students that he has . These details are useful for us in order to adapt our contents to the
user's interests, and to know better the situation ofthe Spanish culture in the world.
Another example would be the case of a user who wanted to take part in the in the
translation virtual workshop. Apart from introducing the details referred to the activity
he does, he would also have to include in the personal details his mother tongue .
On the other hand, it is also important to know what kind of data is used in the Spanish
course . So, if we access the virtual classroom for Spanish application, we will see that
the details handled are again the personal details where we would have to include, apart
from name, surname, address, country, or e-mail address, our city, postcode, nationality,
date of birth or sex.
Also, academic, professional and access details should be introduced, together with
details ofthe institution, class course an group .
The dilemma, functionality versus security
When developing an application some questions have to be raised .
On the one hand the necessary functionalities for the user to be able to develop his
activities in an environment which fulfils his necessities has to be offered.
85