Proceedings of 8th European Assembly on telework (Telework2001)

78Information Security in E-workArto Karila, Dr. Karila A & E Ltd.1. Threats and requirements for the security <strong>of</strong> E-workThreats against the security <strong>of</strong> information systems can be divided into three main categories:disclosure <strong>of</strong> confidential information (the disclosure threat), loss <strong>of</strong> integrity <strong>of</strong> information (themodification threat), and unavailability <strong>of</strong> information (the denial <strong>of</strong> service threat). Traditionally,information security has been primarily associated with the disclosure threat. In today’s world,our dependence on information systems is such, that unauthorized modification or extendedunavailability <strong>of</strong> information can have disastrous consequences. In E-work, all kinds <strong>of</strong> informationneed to be accessible through the network. Therefore, information security is a mandatoryrequirement for E-work.When working in an open network, information flowing through the network is susceptibleto unauthorized disclosure and modification. Strong encryption is necessary to protect theconfidentiality and integrity <strong>of</strong> such information. Indirectly, encryption also helps ensure theavailability <strong>of</strong> information networks. When disclosure and modification threats are effectivelyprotected against, it is possible to implement availability by building sufficient redundancy intoinformation networks. Building this kind <strong>of</strong> redundancy is something which the Internet technologywas originally designed and still is well suited for.2. Development <strong>of</strong> network infrastructureInternet architecture is the dominating network architecture <strong>of</strong> the early 2000’s. Internet is based onthe Internet Protocol (IP), which can be run on all kinds <strong>of</strong> physical networks and under all kinds <strong>of</strong>applications. Its independence <strong>of</strong> both physical networks and applications is the main strength <strong>of</strong>IP. IP can easily be implemented even on totally new network technologies, such as Wireless LAN(WLAN) or the General Packet Radio Service (GPRS) <strong>of</strong> the GSM (General System for Mobilecommunications) network. New applications, such as the World Wide Web (WWW), Voice overIP (VoIP), and many others to come, can easily be implemented on top <strong>of</strong> the standard IP service.The Internet architecture has remained essentially unchanged since 1974 and continues to prove itsstrength. Hence, the old slogan ”IP over everything, everything over IP” is more true today thanever before.The main shortcomings <strong>of</strong> IP are its inadequate address space, lack <strong>of</strong> mobility support, lack <strong>of</strong>differentiated quality <strong>of</strong> service, and lack <strong>of</strong> security. Each <strong>of</strong> these issues has been addressed bythe Internet Engineering Task Force (IETF) and standard track solutions have been developed foreach <strong>of</strong> them. The new version 6 <strong>of</strong> IP (IPv6) <strong>of</strong>fers a virtually unlimited number <strong>of</strong> addresses