Internet Security and Privacy

Security and privacy are two major issues that continue to raise concerns with all those involved with the Internet. Stories about Web site break-ins and e-mail viruses appear on an almost daily basis. Governments around the world have had to come to grips with a new method of crime: "cyber terrorism." Most of them still don’t understand how to deal with it nor do they comprehend the extent of the destruction that can be brought on by cyber terrorists. While the majority of attacks are carried out by amateur hackers, the damage that is done is still real.

The Internet is a different realm than most of us are used to dealing with in our daily lives. It is constantly changing at a rapid pace. What is new in one moment can be literally out-of- date within a matter of hours, sometimes even minutes. This pace has slowed down somewhat recently, but, in many aspects, it still holds true. One of the things that make it so formidable is that it is always "on" -- the Internet never sleeps. Unlike the stock market, which at least shuts down for a few hours a day, the Internet continues to operate. This means that all the Web sites that you design and/or manage are available for visitation on a 24/7 basis. This also makes it vulnerable for attacks on a 24/7 basis.

So how do we deal with the problem? The links highlighted below can provide some help. There are also additional links on our "Security and Privacy" Web page." We invite you to visit the page and investigate the links listed there.

•  SecurityTracker is a Web site dedicated solely to security vulnerabilities. According to information on the Web site the organization uses "automated agents [to] scan Web sites, e-mail lists, newsgroup feeds, white hat/gray hat/black hat information sources, vendor bulletins, and incident advisory sources for the latest vulnerability information." The information is then filtered and categorized "using a variety of narrowly defined topics to characterize the vulnerability as specifically as possible." The company states: "Our goal is to help you extract just the information you are looking for, without requiring you to search through an excessive amount of often confusing information." They have free weekly e-mail security updates.

•  Security Issues When Installing and Customizing Pre-Built Web Scripts This article, written by Selena Sol, details the fundamental concerns of security when installing and customizing pre-built CGI scripts, and gives pointers for further information. "The minute you connect your computer to the Internet is the minute that the security of your data has been compromised. Even the most secure systems, shepherded by the most intelligent and able system administrators, and employing the most up-to-date, tested software available are at risk every day, all day."

•  CGI Security Another excellent article by Selena Sol, this one covers CGI security in general. Topics include Perl resources and CGI form handling libraries.

•  The Microsoft Security Advisor provides many areas of help in the security and privacy area. One area is in tools and checklists. These are excellent tools for setting-up and maintaining security on your Internet and Intranet servers. Bulletins are available as well as several articles covering a variety of security issues.

•  Electronic Privacy Information Center This site is like a gold mine of information, reports, articles and links for privacy. EPIC also provides the latest in privacy news and developments.

Internet security is not something to be taken lightly. It is an extremely important aspect of your Web site. In the case of online merchants, security and privacy is also a very sensitive subject. You are being entrusted with someone's personal information. You have an obligation — a fiduciary responsibility — to protect the privacy of the site's visitors.

While these links are not all-encompassing, they do cover quite a bit regarding Internet security and privacy. In addition, most of them have additional links to other sites. Use them for your own, as well as your Web site's, protection.

P3P - Platform for Privacy Preferences
Andrew Starling
August 12, 2002
P3P is a system for making Web site privacy policies machine-readable. It's been around for a while now and is a W3C recommendation, yet still isn't very popular. One reason is that it's technically quite complicated, requiring an XML file and additions to HTTP cookie headers. Here's a quick introduction.

Resources

• Links to Security and Privacy Resources
• Check out the security links in our Virtual Library also.