I have regularly browsed this mailing list for the last few weeks & found
the information very valuable. I am currently finalising the requirements
for running an Internet pilot. There are two risks which I will need to
protect against:- i. illegal outside access & ii. virus infection, both of
which have been discussed at length in your correspondence.
I would like to share some of our conclusions re: the required security
set-up for my Internet pilot and at the same time solicit feedback &
assurance that I will not be putting my systems at risk. My security policy
& pilot is being based on the following assumptions. I am already aware of
several potential qualifying statements and a few comments or questions
follows each assumption.
I would be very keen to hear of incidents where any of these assumptions
have been proved wrong and illegal access or a virus infection has been the
result.
I would also appreciate responses that highlight flaws in the logic & an
outline of theoretical ways the statements could be false & specific
answers or comments in relation to my qualifying statements/questions.
These can be sent to me directly or posted to the whole mailing list. I
will plan to post my final conclusions - FYI & the best of the feedback, in
a few weeks time.
thanks in advance - Martin
ASSUMPTIONS MADE IN SECURITY POLICY/ SET-UP of PILOT
--------------------------------------------------------------------------------
- The first 5 assumptions below refer to the risk of contracting viruses or
having trojan horses placed on my systems, as a result of Internet
connectivity.
- The last 3 assumptions refer to the risk of illegal access to my systems
from an intruder over the Internet.
1. VIRUSES CANNOT BE CONTRACTED FROM TEXT FILES, ONLY EXECUTABLES, WHICH
HAVE TO BE EXECUTED FOR THE VIRUS TO BE ACTIVATED.
--------------------------------------------------------------------------------
Qualifying Statements:-
1.1 A Word document or spreadsheet (containing macros) is not a text file,
as this can be executed.
1.2 A file can be disguised so that you execute it unknowingly.
2. A PC OR MAC WITH FULL INTERNET ACCESS THAT IS ONLY USED TO DOWNLOAD TEXT
FILES CAN SAFELY BE RE-CONNECTED TO ANOTHER INTERNAL NETWORK WITHOUT
INCREASING THE RISK OF SPREADING A VIRUS TO THIS INTERNAL NETWORK.
---------------------------------------------------------------------------
-----
Qualifying Statements:-
2.1 The use of a web browser can present additional risks, if it contains
OLE functions that can receive, then execute code.
2.2 The use of a web browser can open up the possibility of a virus
infected file (or trojan horse), being transferred onto your machine via
FTP, without your knowledge.
2.3 I would be interested in any specific feedback on any experienced or
perceived security problems from using the Netscape web browser.
3. VIRUSES ARE OPERATING SYSTEM SPECIFIC, i.e. A PC VIRUS PRESENTS NO RISK
TO A UNIX MACHINE etc.
--------------------------------------------------------------------------------
Qualifying Statements:-
3.1 A program that is downloaded and appears safe by passing a virus
checker, could be carrying an undetected virus that impacts another
operating system.
4. GOOD VIRUS PROTECTION PROGRAMS NOT ONLY PROTECT AGAINST EXISTING VIRUSES
THAT ARE KNOWN BUT CAN ALSO PROTECT AGAINST NEW VIRUSES BY INCLUDING FILE
SIZE CHECKS USING CHECK SUM ROUTINES.
--------------------------------------------------------------------------------
Qualifying Statements:-
4.1. Not all virus checkers include "check sum routines". Which ones for
the Macintosh or PC do?
4.2 The global nature of the Internet means that it is easier to come
across a virus on the Internet, that standard virus checkers are not
specifically coded to detect.
4.3. Can you trust even reputable sites to have virus free software e.g.
patches from known vendors e.g. DEC & IBM, free or trial encryption
software from CERT. If so why?
5. A FIREWALL OFFERS NO PROTECTION FROM VIRUS INFECTION.
--------------------------------------------------------------------------------
6. THERE IS NO REPORT OF A WELL ARCHITECTED "APPLICATION LEVEL FIREWALL"
(E.G. GAUNTLET, SEAL OR INTERLOCK) EVER BEING BREACHED.
--------------------------------------------------------------------------------
Qualifying Statements:-
6.1. The recent IP spoofing scare could have resulted in a breach, but if
so I am unaware of it. TIS admitted the then current version of their
Gauntlet software wouldn't protect against this, but version 3.0 was soon
released & now does.
7. UNAUTHORISED ACCESS CANNOT BE GAINED VIA GATEWAYS &/OR PROTOCOL
CONVERTERS THAT ONLY SUPPORT SMTP SERVICES.
--------------------------------------------------------------------------------
8. AN INTERNET CONNECTION TO A MACINTOSH OR PC (THAT OFFERS NO LOCAL
SERVICES i.e. ONLY OUTGOING & NO INCOMING CONNECTIONS), THAT IS ALSO
SIMULTANEOUSLY CONNECTED TO AN INTERNAL NETWORK, DOES NOT PRESENT ANY RISK
OF AN ILLEGAL ENTRY POINT TO THIS INTERNAL NETWORK.
--------------------------------------------------------------------------------
Qualifying Statements:-
8.1. What software used in an office desktop environment could make the
PC/MAC act as a router, nullifying the above statement ?
|
|
