• Internet Security is everyone’s responsibility

    Aug 05.09 | Technology   

    Server administrators, web-application programmers, web site designers, help desk support, software companies, technology providers, government officials, and yes, even end-users — we are all responsible for information security on the internet.    We need to not fall for knee-jerk, and ineffective solutions — i.e.  strong passwords — or assume that certain technologies will keep us safe — i.e.  “I use a mac and they don’t get viruses”.  What can we do?  I am not a security expert with specific prescriptions to give — but remember, easy prescriptions don’t exist.  What is needed is an ongoing conversation — at my workplace the CIO recently held the first of a series of campus-wide forums to provide technology staff with information, and to gather ideas from all of us.  This is a good first step.  Here are a couple of other ideas:

    • Identify the causes of security attacks in your user community and let your community know how, when, and why these occur.  Don’t kid yourself that keeping these secret provides some form of protection — the bad guys already know this stuff.  The good guys need to be kept in the loop.
    • Implement measures that address the root causes of known attacks.  Try to focus on the larger ecosystem to help anticipate possible exploits instead of trying to stay one step ahead of the bad guys — they’ll normally win.  Question common-sense approaches — many are a panacea that can add expense and end-user inconvenience with little actual benefit.
    • Do not implement security policies that stifle innovation — if you do your users will just end-run your policy, and in the process create a greater security exposure.
    • Talk to users about security issues, but also listen to their needs, questions, mis-conceptions, problems, etc.   Good security practices will develop with community involvement, not prescriptions from on-high.
    • Security needs to be part of everything we technology professionals do — not just some last minute addition.  Everyone is a security officer.  Cost and time pressures can not knock security considerations off the table.

    Internet Evolution – Jart Armin – Browser Hack Emerges as Key Threat

    Both the CSRF token hack using CSS history and the JavaScript “Ping” Sweep attack have been released into the hacking community as PoC (proof of concept) vulnerabilities.

    Internet Evolution – David Vellante – Twitter Hack Points to Bad User Habits

    What can we learn from this incident? First, the convenience of inexpensive (often free) Web services and their natural openness is in opposition to highly secure systems. While one individual system may have reasonable security, bad user practices exponentially increase users’ exposure across the Internet. …On a broader scale for corporate systems, users should consider two-factor authentication systems. Your business may depend on it.

    Internet Evolution – Ira Winkler – Twitter Sets Security Example

    I was ecstatic when I read that Twitter Inc. was taking action against accounts that were clearly infected with the Koobface worm.

    Internet Evolution – Jonathan Hochman – Simple Security Steps to Stop Server Spam

    If enough Websites made basic attempts to protect their email addresses and forms, spammers would lose revenues, or they would start processing JavaScript and CSS.

    Related Posts

    Tags: , , , , , , , , , ,

    • Author: Randy

    In my day job I serve as Information Technology Director for the Yale School of Drama. Otherwise I garden, play guitar, build stuff out of wood, take photos, play around with technology and have been blogging since 2003.

    Share on: LinkedIn

    Stay Informed!

    Did you enjoy this post? Then subscribe to my email newsletter and have the daily posts delivered directly to your inbox. Enter your email address here:

    ADD YOUR COMMENT
    Comments are moderated.

    Adjacent Posts

Welcome to RodeWorks

Randall Rode's online home for thoughts, notes, and experiments with a wide range of technology topics. Visit the about page for info on my recent projects and professional background. I welcome your comments!

  • Recent Comments

    • Coming Soon

    Open Source Way in creating community

    March 17, 2010

    Drupal 7 promises big UX improvements

    March 17, 2010

    Site Topics