Data Security On The Web In Workplaces example essay topic

the practice of information security has become much more complicated and the need for qualified information security professionals has become critical. During this time, the International Information Systems Security Certification Consortium (ISC 2) has made significant progress in testing and certifying information security practitioners as Certified Information System Security Professionals (CISSP's). Currently, almost 1000 practitioners have achieved certification and several hundred sit for the examination annually. Data secutiry The purpose of this document is to illustrate the importance of "data security on the web in workplaces". It outlines the essential security measures implemented by workplaces to prevent hackers from the outside world ( ) to gain unauthorised access to sensitive data and other resources and tampering with it. In preventing from such attacks in the workplace, which can cost a company dearly, this document analysis the network infrastructure design and software that can enhance workplace data security.

It discusses such things as FTPS (secure file transfer protocol), HTTPS / SSL (secure hyper text transfer protocol / Secure Socket Layer), PKI (Public Key Infrastructure), firewalls, EFS (encryption file system) and VPN (virtual private networks). Workplaces around the world lack data security in terms of transactions over the web / Internet, which is why organisations are now taking greater security measures to ensure hackers do not gain unauthorised access to sensitive data. Researcher found that the. ".. highest percentage of companies that had been attacked by hackers in 2001 (44 percent) were in the enterprise space, which In-Stat / MDR defines as companies with more than 1,000 employees" [Tom Smith - Internetweek. com, 04 April 2002]. With such a high percentage, businesses are deploying as a standard to make transactions and data transfers more secure by implementing FTPS and HTTPS as appose to FTP and HTTP. Many organisations dealing with clients / customers transfer data of some sort from one another over networks. The mediums of such transfers are through "e-mails" which is unsecure and limited by size, "ISDN file transfer" (FTP) which is not secure for transferring sensitive data, or by copying data to "CD" and sending it, which is costly and time consuming.

Due to new. ".. strict regulations and changes in privacy policies in the finance sector... workplaces are required to encrypt sensitive data transfers" [Samuel Byrne - AFR, 13 April 2002]. This statement has drawn concern in workplaces to get their act together and transfer data more securely using FTPS and HTTPS. FTPS is a process that provides secure encrypted file transfers between local and remote computers that allows bi-directional transfer of binary (images) and ASCII (data) files between computers. Software packages such as McAfree E-business Encryption. ".. simplifies protecting files, file transfers, and application data while improving security" [McAfree, 2002] at the same time protects data when using FTPS. This automates securing transactions and data files for transfer to only authorised users. Such a solution protects clients / customer and business data from malicious or unintentional misuse in particular to external parties over the web.

Since there are so many Internet users on the, how do businesses differentiate from authenticated users to those who are not? With the growth in business use of the Internet, network security is rapidly becoming crucial to the development of the. Many Internet sites now use the HTTPS protocol (also known as Secure Socket Layer - SSL) for handling secure transactions and this is becoming increasingly common for accessing bank account balances and similar confidential data. This allows businesses to control who can access certain information by issuing certificates to authorised users, which is what SSL relies on. "SSL security protocols are used widely by Internet browsers and servers for authentication, message integrity, and confidentiality" [Microsoft Windows 2000 Server Resource Kit. Microsoft Press, 1999].

Workplaces can configure SSL security features to verify the integrity of data, verify the identity of users, and encrypt network transmissions. This reduces the risk of security breaches by unauthorised people over the Internet. That's why customer based businesses that make transactions or transfer personal data over the web are required to use HTTPS as the standard mean of communication. A lot of business networks consist of both intranet and extranets, all of which are susceptible to access by unauthorized hackers who may maliciously view or alter digital information data assets. Although its evolution has been slow, another solution for workplaces at high risk of potential hackers is to implement PKI - Public Key Infrastructure.

PKI is a system that makes use of. ".. digital certificates, certification authorities, and other registration authorities that verify and authenticate the validity of each party involved in an electronic transaction" [Exam Cram Network Design - Kim Simmons, Jarret W. Buse & Todd B. Halpin - 2000]. For the effectiveness of PKI, user authentication or identification must be coupled with the encryption and data transmission processes to be certain that confidential data is delivered only to authorised parties. A well organised PKI can help secure data and distribute and manage identification credentials across a network security architecture in the workplace. "Standards for PKI are still evolving, even though they are being widely implemented as a necessary element of electronic commerce" [Microsoft Windows 2000 Server Resource Kit.

Microsoft Press, 1999]. The need for PKI is beginning to show and many of the major software vendors are starting to support PKI. "Companies in the financial services, health-care and government sectors -under pressure to meet stricter privacy and data security regulations - are also beginning to adopt PKI's" [Kelly Jackson Higgins - Internetweek. com, 21 November 2001]. Because of this factor, greater data security measures in particular over the web are an essential part of preventing unauthorised access to networks. "A recent study from Dataquest says that while only 23 percent of 86 IT managers surveyed had PKI products installed, 69 percent said they are now evaluating PKI products" [Kelly Jackson Higgins - Internetweek. com, 21 November 2001]. Hence increasing businesses moving forward are looking towards PKI as a solution.

Due to hackers all over the world the deployment of security solutions has never been greater. "The Internet connects 300 million computer users in a maze of networks and connections. But the Internet also exposes us to the threat of fraud and to an invasion of privacy" [Paula Hawkins, Channel 4 UK, January 2002]. To screen such a wide are network of potential hackers, companies are implementing more secure firewalls, such as SPINACH (Secure Public Internet Access Handler), making it a lot harder for hackers to break into. In practice workplaces only want authorised individuals to access certain networks to transfer data; SPINACH provides such a security measure as describe by researched at Stanford University. "The SPINACH system has two major functions: it controls the passage of network communications between public ports and the rest of the building network, and it provides a mechanism for unknown users to prove themselves as authorized so that they can have full network access".

[Elliot Power & Mary G. Baker - Stanford University, December 1997]. A "firewall" (aka - "prison walls"), such as the SPINACH security system, usually composes of a combination of hardware and software, intended to protect a network against external threats coming from another network, including the Internet. It prevents an organisation's networked computers from communicating directly with computers that are external to the network, and vice versa. It also audits network activity, recording the volume of traffic and information about unauthorized attempts to gain access.

"There are two basic types of network security, transit security and traffic regulation, which when combined can help guarantee that the right information is securely delivered to the right place" [Darren Bolding - September 1995]. One of the prominent features of firewalls is the IP filters, which directs the destination of an IP packet (data information) to the intend. Each IP packet is checked against the IP filter on the firewall, and if a match is found, the properties of the associated security policy are used to send the communication. Filters need to be configured for both incoming and outgoing traffic to ensure that only authorised people can access data information. Many workplaces use virtual private network (VPN), which is an extension of the private network that encompasses encapsulated, encrypted, and authenticated links across shared or public networks. It mimics the properties of a private network, allowing data to be transferred between two computers across the Internet securely which is why many companies have a VPN setup as security measure standard.

The two main advantages of VPNs are that they. ".. allow private address space, and they allow the packet level encryption / translation to be done on dedicated systems, decreasing the load placed on production machines" [Microsoft Windows 2000 Server Resource Kit. Microsoft Press, 1999]. Because of the packet level encryption, encrypting traffic as a security measure, it makes it more efficient for workplaces to gain network access and transfer data from one point to another. Security breaches by unauthorised people over networks are not a question of if; they are a matter of when. This brings about growing concerns especially to America as they were outraged to hear that they were under attack from the Chinese military. A ISR - Internet Security Review article commented: "The officials' assessment came after a Los Angeles Times report Thursday that said U.S. intelligence officials believe the Chinese military is working to launch widespread attacks on American and Taiwanese computer networks, including Internet-linked military systems considered vulnerable to sabotage" [Internet Security Review - International Magazine on Safety, Security, and Protection of Data Communications on the Internet, 25 April 2002].

As a possible data security measure of such an attack, the use an encryption file system (EFS) to protect data will make it difficult for hackers to break encryption / algorithm codes. EFS is an extension to the NTFS file system that provides strong data protection and encryption for files and folders. "The encryption technology is based on use of public keys and runs as an integrated system service, making it easy to manage, difficult to attack, and transparent to the user" [Exam Cram Network Design - Kim Simmons, Jarret W. Buse & Todd B. Halpin - 2000]. This is particularly useful for securing data on computers that may be vulnerable to theft or hackers, such as mobile computers.