Internet & Intranet Security Management - Risks & Solutions

A typical e-commerce ëpractice', as encouraged by ISPANZ, is to inform customers about the
availability of secure transactions mechanisms whenever they intend to purchase goods via the
Internet. Another practice advises ISPs to provide customers with a schedule of all planned service
outages in advance.
Security Solutions
There is a common belief that lack of security is the major barrier to successful commercial use of the
Internet. Businesses detest the kind of exposure provoked by attacks on the Internet. In 1996 Xtra, the
largest Internet Service Provider in New Zealand, was forced to restrict access to their users to patch a
security problem (Dias, 1996). It was a very simple problem. New passwords to users accounts were
created disregarding normal precautions in those cases. However, users suffered from ''Denial of
Service" while the problem was fixed. Recent Internet-related security attacks have also taken the
form of malicious code transported as e-mail attachments. Notorious among those were the Melissa
virus and the Happy99 worm (Malcolm and Fusaro, 1999). Obviously, an organisation planning to
base an important part of their business on the Internet would think twice about doing so given that
sort of media attention.
The advent of e-commerce as an important element of the business environment adds another
dimension: the web server as the weakest link in the security chain. Security holes in freely available
web-server software creates a window of opportunity for hackers to get into the rest of an
organisation's network before the IT department has a chance to extend the security blanket in order to
include the new system.
Although a basic Internet link may be a security risk, there are several ways of addressing the
potential problems discussed above. The following is a summary of the main issues:
Encryption
Using encryption can protect sensitive data travelling over the Internet. Encryption is the
transformation of readable text (also called clear or plain text) into an unintelligible form called
cipher text, using mathematical algorithms. Only users with a digital key, and a program based on the
encrypting algorithm, can decode an encrypted message.
These are the basics of symmetric or single-key cryptography. Most commercial solutions also use
asymmetric or public-key cryptography in which encryption is accomplished by using key pairs, one
private, and one public. Users with private keys made available their corresponding public keys to
communicating partners. Each public key will decode only those messages sent by the holder of the
corresponding private key. Users maintain the confidentiality of their private keys.