Computer and Network Security and Computer Viruses

Introduction

Computer and network security issues are hurting the new economy.  Despite all of the enthusiasm about e-commerce, security issues are holding back many businesses from implementing on-line shopping.  Network administrators are concerned about crackers and virus outbreaks on a daily basis.  Employees can't telecommute because of remote access concerns.  Internet credit card fraud continues to concern consumers as well as undermining merchants.  Some experts even argue that the whole Internet system is fatally flawed and a new approach is required.

Computer Security Supports your Mission

Good computer security implementation protects your organization's valuable information resources, including business data, confidential information, hardware, and software.  Through the selection and implementation of appropriate safeguards, security supports your mission by protecting physical and financial resources, reputation, legal position, employees, and other tangible and intangible assets.  Unfortunately, security is sometimes viewed as a collection of draconian rules and procedures on users, managers, and systems.  However, appropriate security rules and procedures are needed to protect your assets and to stay in business.

Computer Viruses 

While many of us will never meet a hacker, we are likely to meet a virus. A computer virus can be defined as "A self-replicating program containing code that explicitly copies itself and that can "infect" other programs by modifying them or their environment such that a call to an infected program implies a call to a possibly evolved copy of the virus." A computer virus has the potential to disrupt work, damage data, and even bring your network to its knees.

A virus program does not have to perform outright damage (such as deleting or corrupting files) in order to be classified as a "virus".  The virus label is loosely used to describe many types of malicious programs.  Viruses can be further classified as worms or Trojan Horses, and a variety of others.  A virus can be in an executable (.exe) file or in other script files (like .vbs) so be aware that what constitutes a "program" for a virus may include a lot more than you think--don't assume too much about is or is not a virus nor about what a virus can or can't do!

More computer virus information can be found at the Virus-L/comp.virus FAQ.

Guidelines for the Security of Information Systems

Courtesy of the OECD

Accountability - The responsibilities and accountability of owners, providers and users of information systems and other parties...should be explicit.

Awareness - Owners, providers, users and other parties should readily be able, consistent with maintaining security, to gain appropriate knowledge of and be informed about the existence and general extent of measures...for the security of information systems.

Ethics - The Information systems and the security of information systems should be provided and used in such a manner that the rights and legitimate interest of others are respected.

Multidisciplinary - Measures, practices and procedures for the security of information systems should take account of and address all relevant considerations and viewpoints....

Proportionality - Security levels, costs, measures, practices and procedures should be appropriate and proportionate to the value of and degree of reliance on the information systems and to the severity, probability and extent of potential harm....

Integration - Measures, practices and procedures for the security of information systems should be coordinated and integrated with each other and other measures, practices and procedures of the organization so as to create a coherent system of security.

Timeliness - Public and private parties, at both national and international levels, should act in a timely coordinated manner to prevent and to respond to breaches of security of information systems.

Reassessment - The security of information systems should be reassessed periodically, as information systems and the requirements for their security vary over time.

Democracy - The security of information systems should be compatible with the legitimate use and flow of data and information in a democratic society

Building a Secure Site

There are a number of things that a company must consider when building a secure web site.

First, you must identify your key business processes and goals and design the functionality necessary.  When designing this project, three critical components must be included:

1. Information Security Policies and Procedures

2. Security Technology

3. Internal Audit of Programming Security

Many organizations make the mistake of quickly building new applications and web sites without good project management. As a result, security concerns are often overlooked.  With appropriate project management, these issues should be appropriately dealt with.

Conclusion

To avoid an e-business disaster, a company must concentrate on identifying the set of resources that will bring the most value to its customers or employees.  Business managers must decide what information is required and how this can best be distributed.  Computer Security is obviously an important and complicated issue.  We have gathered some good resources below that should help you in your computer security and antivirus efforts.

Computer, Internet, MIS Security Policy Manual on disk - over 100 pages of security policy for your business.  See Computer Security Books and Products.  Our book store offers the best risk management, computer security, business continuity, and emergency management books and products. 

The Sans Institute - The SANS (System Administration, Networking, and Security) Institute is a cooperative research and education organization through which more than 96,000 system administrators, security professionals, and network administrators share the lessons they are learning and find solutions for challenges they face.

IT Continuity - comprehensive information continuity and availability portal.

IT Security - The Encyclopedia of Computer Security

Computer Security Institute - (CSI) is the world's leading membership organization specifically dedicated to serving and training the information, computer and network security professional.

Computer Security Information - general information about computer security

Computer Security Resource Center - computer security issues, products. From NIST's Computer Security Division.

The Center for Society and Cyber Studies - cyber crime news, internet Investigation, Cybercrime Training & Education, e-Profiling, Public Safety Cybercrime Units, and more.

CERT offers a number of resources for computer incident response:

CERT Advisory Mail List
CERT Overview on Incident and Vulnerability Trends
Common Terminology Project (PDF file)

Info-sec.com

Cyber Angels Need help?  Cyber Angels Is the Largest Internet Safety Organization in the World.

Internet/Network Security BBS

Computer-Related Risks - Based on data gathered by the author as part of ACM's International Risks Forum, this book contains accounts of mishaps attributed to computers and the people using them...

Secrets and Lies: Digital Security in a Networked World -- Bruce Schneier; Hardcover

Mastering Network Security -- Chris Brenton; Paperback

Hacking Exposed: Network Security Secrets and Solutions -- Joel Scambray, et al; Paperback

Cyberwar: Security, Strategy, and Conflict in the Information Age

ICSA Guide to Cryptography

Time Based Security

Defending Your Digital Assets Against Hackers, Crackers, Spies & Thieves