CONTENTS - Emerald

More documents

Recommendations

Info

041343 `Password alternatives' WSchwartau, Network Security, Jan 95 pp 9{13 (part 1); Feb 95 pp 13{15 (part 2) The author discusses passwords and their alternatives, such as passphrases, smart diskettes, other tokens and biometrics. 041344 Ìndustrial Espionage: Analysing the Risk' P Sommer, Computers and Security v 13 no 7 (94) pp558-563 The author discusses the context of industrial espionage. Ninety percent of the useful information about a company is already in the public domain, and can be gathered at no risk. Whether the other ten percent will be targeted is a function of the client's business ethics more than anything else. Methods of developing a threat model for a client which wishes to defend itself are discussed. 041345 `The BSA software crimeline' RTaylor, Computer Audit Update (Mar 95) pp 11-14 An association of UK software vendors is o ering a reward to people who inform on the users of unlicensed software. 041346 `The management of computer security pro les using a roleoriented approach' SH von Solms, I van der Merwe, Computers and Security v 13 no 8 (94) pp 673{680 The authors discuss how a security manager can go about constructing models of user roles in a systematic manner. It is especially desirable that exception reporting should be nontechnical and comprehensible to personnel management. 041347 `The Internet Threat' HWolfe, Network Security (Jan 95) pp 7{8 The author surveys hackers' magazines and other information sources, and describes some of the toolkits available for virus writing and password cracking. 041348 `New developments in information technology to combat computer crime and fraud' KWong, Information Security Monitor v 10 no 4 (Mar 95) pp 5{8 The author describes the new British Standards Institute security code of practice which makes recommendations for organisations' policy, plans and controls. He also talks about a number of security products. 041349 Ìdentity token usage at American commercial banks' CC Wood, Computer Fraud and Security Bulletin (Mar 95) pp 14{16 A survey of 35 banks showed that 89% of them used some kind of èxtended user authentication', i.e. did not rely on password based access control alone. The majority used password generators, and the next most popular technique was transparent challenge-response; these techniques were typically implemented at a front end processor or rewall. Case law indicates that, at least in the USA, a security control becomes part of the standard of due care once 33{40% of the rms in an industry use it. 041350 `The use of the PC as a network audit tool' PWood, Computer Audit Update (Mar 95) pp 5{10 According to the author, Netware su ers from a serious lack ofinternal security management tools, which leads to many users being given supervisor status for reasons of convenience. Yet there are no audit trails of supervisory status changes, directory creations and the like, and the system is so complex that manual tracking is unfeasible. This leads him to set forth a set of requirements for an automated security management tool. 041351 `The Verdict on Plaintext Signatures: They're Legal' BWright, Computer Law and Security Report v 14 no 6 (Nov/Dec 94) pp 311-312 It is often said that digital signatures are essential to make electronic commerce 24
legally binding. This is untrue; the de ning attribute of a signature is the signer's intent, and a plaintext name at the bottom of an email message has legal force. It may be easy to forge, but then so are the manuscript signatures which have been used for centuries (see book review, this issue). 041352 `Protecting information from Internet threats' MA Wright, Computer Fraud and Security Bulletin (Mar 95) pp 6{10 The author describes some of the security problems of the Internet and possible countermeasures such as password discipline, rewalls and encryption. 041353 ÈU-Datenschutzrichtlinie: Einigung im Rat' Ulrich Wurmeling, Datenschutzberater v 19 no 2 (15/2/95) pp 4{5 (in German) A majority of the EU's Council of Ministers has rati ed the European data protection guidelines. These cover structured manual data as well as computer les; the national jurisdiction to apply will be that of the data owner's head o ce, so that for example a German rm in France will fall under German law; purely automatic decisions are forbidden on matters important to an individual such as credit decisions; data subjects can demand directly from data owners information which does not have to be reported to the data protection authorities; and data transfers within the EU become unrestricted. 041354 ÈU-Richtlinie vor dem Endspurt' Ulrich Wurmeling, Datenschutzberater v 18 no 12 (15/12/94) pp 1{3 (in German) A recent sitting of the ministers responsible for the EU internal market has brought European data protection guidelines signi cantly nearer. They might be enacted by the middle of 1995. UK objections to its application to manual le systems have molli ed by a decision that the o cial English translation of Àkten' shall be ` le systems' rather than ` les'. 041355 `Computer Viruses | Legal Options' BP Zajac, Network Security (Feb 94) pp 9{10 The USA has no case law dealing with computer viruses yet. If a virus is caught from shrink-wrapped software, then remedies may be complicated by license disclaimers. The argument would turn on whether these were overly broad. 041356 `The BT hack and what it means' BP Zajac, Computer Law and Security Report v 15 no 1 (Jan/Feb 95) pp 35{36 This article describes an incident in which a UK newspaper got hold of the exdirectory telephone numbers of VIPs, and discusses the apparent lack of security at British Telecom. 041357 ÙS digital telephony legislation' BP Zajac, Computer Law and Security Report v 14 no 6 (Nov/Dec 94) pp 322-323 Proposed US legislation will force telecomms carriers to provide monitoring capabilities to the government, and is likely to be passed before the next Congressional elections in 1995. 25
Page 1 and 2: . Volume 4 Number 1 (March 1995) IS
Page 3 and 4: 1 Applications and Engineering 0411
Page 5 and 6: combining debit and credit card fun
Page 7 and 8: 041135 À computer package for meas
Page 9 and 10: 041151 `Doing it the Pick 'nPayway'
Page 11 and 12: 041168 `The Colossus of Bletchley P
Page 13 and 14: 2 Operating System and Database Sec
Page 15 and 16: 041215 `Towards testability in smar
Page 17 and 18: language which would cope with a va
Page 19 and 20: 3 Security Management and Policy 04
Page 21 and 22: 041316 `Fraud prevention and comput
Page 23: 041333 ÙS government board to crea
Page 27 and 28: 041407 `Design and Analysis of Key
Page 29 and 30: lock chaining in such a way that pr
Page 31 and 32: 5 Secret Key Algorithms 041501 `Cry
Page 33 and 34: 041516 Ìntrinsic Weakness of Keyst
Page 35 and 36: 041531 `The Cryptographic Mathemati
Page 37 and 38: 041547 `Linear Cryptanalysis of LOK
Page 39 and 40: 041607 Àn E cient Electronic Payme
Page 41 and 42: 041624 `Comment | digital signature
Page 43 and 44: 7 Computational Number Theory 04170
Page 45 and 46: 8 Theoretical Cryptology 041801 `Ho
Page 47 and 48: 041817 `How to Simultaneously Excha
Page 49 and 50: most productive things for an attac
Page 51: How to Subscribe Subscription order

CONTENTS - Emerald

Create successful ePaper yourself

Delete template?

Save as template?