Internet and Wireless Security
Buy book PDF
- $116.00
Many organisations are transforming their businesses through the development of information and communications technologies. The security of this e-commerce is now a key enabler for businesses.
Inspec keywords: simulation languages; virtual private networks; human computer interaction; XML; mobile computing; computer network security; virtual reality; information retrieval; biometrics (access control); telecommunication security; public key cryptography
Other keywords: ignite managed firewall; mobile computing; security of data; wireless security; biometrics; VPN service; virtual world; digital data archiving; information assurance; human-computer interaction; TETRA security; security managed standard; XML security; identifier-based public key cryptography; security modelling language
Subjects: Ubiquitous and pervasive computing; High level languages; Cryptography; Document processing techniques; Computer networks and techniques; Data security; Mobile radio systems; User interfaces; Computer communications
- Book DOI: 10.1049/PBBT004E
- Chapter DOI: 10.1049/PBBT004E
- ISBN : 9780852961971
- e-ISBN: 9780863410147
- Page count: 302
- Format: PDF
-
Front Matter
- + Show Description
-
Hide details
- + Show Description
-
-
1 Building on Rock Rather Than Sand
- + Show Description
-
Hide details
-
p.
1
–20
(20)
The Internet protocol (IP) is open, offering ubiquitous access to BT systems and data for BT people and BT's customers. It is this very openness which presents tremendous opportunities for eCommerce. The downside, however, is that IP exposes BT to harmful attacks. The purpose of the iTrust Programme is to provide cost-effective protection to BT systems and data. It is a large programme involving the implementation of several software packages. There is a phased approach to implementation. BT is currently splitting itself into separate lines of business (LoBs) and there will be legal and regulatory controls over who has access to what information - as well as commercial implications. Some customers of one LoB may also be the direct competitors of another LoB. In addition, there are substantial technology integration challenges to be faced, both in building up new systems, and infrastructure, yet at the same time decoupling systems, where it is appropriate, to fit into the LoB model. The iTrust infrastructure is shaping up well to these challenges, although as with many things in this complex technological world, implementation must be seen as a journey, not necessarily something that has a clear and distinct end. The vision is known, as is what has to be done to reach it. Getting there, however, will be influenced by changes in the business, new technologies, ability or desire to integrate legacy systems and, of course, the risk profile.
- + Show Description
-
-
2 XML Security
- + Show Description
-
Hide details
-
p.
21
–44
(24)
XML Signature and XML Encryption provide the basis for a new type of security mechanism, and for enabling secure Web services. The advantages of XML Signature over other digital signature standards are its flexibility and its portability. Both standards bring the security 'vocabulary' to XML documents, allowing agreements on levels of security to be made using XML. With XML Signature and XML Encryption, security mechanisms can be interwoven within a document, interacting and making use of its data.
- + Show Description
-
-
3 Using XML Security Mechanisms
- + Show Description
-
Hide details
-
p.
45
–62
(18)
Now that the security standard XML Signature has completed its standards track and XML Encryption is following close behind, the security protocols and software to use them can be created. XML Signature is a sophisticated, generic standard for creating digital signatures in an XML format, optimised for signing XML data. As there are many business formats and standards that already use XML for representing data, there is a ready market in which XML Signature can be applied. However, the major commercial use may be to secure Web services. There are already a number of proposed security service standards that aim to fill this niche. This chapter explores how new security mechanisms will be employed for new Web technologies. It contains an investigation of Web services, showing how XML is being used for the next generation of distributed architectures and eCommerce projects. The current building blocks of a public key infrastructure are analysed with an intention to see whether XML can create improvements. The new XML security standards, such as the security assertion markup language and XML Key Management Specification, show how XML Signature and XML Encryption can be used to create sophisticated new security services and protocols. This chapter aims to determine how these new mechanisms could operate with familiar protocols, such as the secure sockets layer, to create an overall security infrastructure, usable in an Internet environment.
- + Show Description
-
-
4 Security Modelling Language
- + Show Description
-
Hide details
-
p.
63
–94
(32)
This chapter introduces the Security Modelling Language (SecML) - an idea from BTexact Technologies. The SecML is a language, inspired by the Unified Modeling Language (UML), for specifying, visualising and documenting the security-related artefacts of a system. The language can be used to model systems at various levels of abstraction making it useful for tasks as diverse as designing key management protocols or analysing the threats against existing real-life systems. The SecML is mainly graphical and, although it could be written by hand or using general-purpose graphics tools, is intended to be written and drawn using software explicitly designed for the task. In this way any changes to elements in a model can automatically be reflected in the diagrams containing it. Context-sensitive menus can be used to edit and view additional information about elements not shown in the diagrams, such as software source code and design documentation.
- + Show Description
-
-
5 Public Key Infrastructures - The Next Generation
- + Show Description
-
Hide details
-
p.
95
–120
(26)
This chapter presents the history, to date, of the PKI, and has also shown some of the proposed ways forward for its evolution.
- + Show Description
-
-
6 An Overview of Identifier - Based Public Key Cryptography
- + Show Description
-
Hide details
-
p.
121
–132
(12)
All public key cryptography (PKC) methods require, in some sense, a public and private key pair. It is the semantics of, and relationship between, these keys that determine the security model for a given public key cryptosystem. Shamir proposed the concept of an identity-based public key cryptosystem (IDPKC) in 1984. Some years later, Cliff Cocks of the Communications-Electronics Security Group (CESG) invented the first practical solution to this problem. This chapter explores the current model for PKC and examine the salient points differentiating traditional PKC from IDPKC, before then giving a broad overview of the Cocks IDPKC method and finally exploring some potential practical applications where IDPKC may give a real business benefit. IDPKC is referred to as identifier-based PKC, since it is a more appropriate nomenclature - the identifiers need not in any way refer to an 'identity' in the traditional sense.
- + Show Description
-
-
7 Secure Digital Archiving of High Value Data
- + Show Description
-
Hide details
-
p.
133
–146
(14)
Creating, distributing and storing documents electronically has been providing greater convenience, higher speeds and increased economy for businesses and people since the advent of the personal computer. Electronic documents can be created more easily than their paper-based equivalents, transmitted around relevant parties quickly, and can be modified easily. Furthermore, electronic documents can be stored and backed up at a fraction of the cost and space of physical ones. However, one drawback has been that they have been a little too easy to copy or edit. There was no way to tell original electronic documentation from a copy, or who created it, or even whether it had been altered. This made the system rather unsuitable for auditable records, such as financial details, contracts, etc. Powerful mathematical techniques, based on cryptography, provided a solution to this, by providing protection and evidence of who created what, and whether anything had been altered. However, it is only recently that legislation has caught up with technology.
- + Show Description
-
-
8 Wireless Security
- + Show Description
-
Hide details
-
p.
147
–162
(16)
This chapter describes the security architecture for 3G that maintains compatibility with GSM as far as possible. Those features of GSM that have proved to be robust and useful have been retained, but enhanced to overcome actual or perceived weaknesses in 2G systems. These features are now being designed into 3G equipment that will be deployed across the world in the next two years. The chapter then describes why these features are based on shared secret key techniques and how these techniques may extend into the wired multimedia world, until such time that a truly global PKI is a reality.
- + Show Description
-
-
9 Adapting Public Key Infrastructures to the Mobile Environment
- + Show Description
-
Hide details
-
p.
163
–170
(8)
A prerequisite for many commercially attractive services is the deployment of a secure infrastructure protecting the interests of all the parties. For many of the mobile operators and service providers the PKI model is of particular interest, offering the authentication, integrity, non-repudiation and confidentiality requirements demanded by many application providers. Financial institutions, for example, need to offer their customers the ability to bank on-line or trade in shares using their mobile devices, while retaining the same level of transaction security available in the 'wired world'. Currently under GSM, there are two common approaches to providing value added services on top of bearer services - via SIM Toolkit (STK) or via the use of wireless application protocol (WAP). There are already a number of STK-based PKI solutions available from vendors today, but while they may offer early-to-market advantage, they are typically proprietary, 'walled-garden' solutions. The remainder of this chapter focuses on WAP, and discusses the WAP Forum's standards-based approach to implementing a wireless PKI - an initiative that is proving attractive to many operators.
- + Show Description
-
-
10 TETRA Security
- + Show Description
-
Hide details
-
p.
171
–186
(16)
This chapter describes the way in which security has been designed into TETRA, and has placed it in the context of users of the BT Airwave system. As with any system, the security requirements do not remain static, but continue to evolve over time to meet the needs of real-world users. Also, the valuable experience gained in the design of the TETRA Security Architecture will be (and has been) carried forward into the design of future ETSI mobile standards.
- + Show Description
-
-
11 Firewalls - Evolve or Die
- + Show Description
-
Hide details
-
p.
187
–202
(16)
The phenomenal growth of the Internet continues apace. IP networks are cheap, highly flexible, endlessly upgradable, and ubiquitous. Everyone uses them; nobody can now afford not to. Businesses have been quick to recognise the value of the Internet as a source of information, and as a new medium for communicating with customers. However, they have been slightly more reluctant to use the Internet as a means of interconnecting their own internal networks, despite the obvious cost savings offered. Accustomed for so long to being isolated from the outside world by firewalls, and to the connection of remote sites using private networks, the idea of trusting private packets to a public transport medium like the Internet has been slow to catch on. Although virtual private network (VPN) technologies, which allow the creation of secure overlays on untrusted networks, have been in existence for some years, it is only recently that implementations and standards have reached a level of maturity appropriate to the commercial world.
- + Show Description
-
-
12 The Ignite Managed Firewalland VPN Service
- + Show Description
-
Hide details
-
p.
203
–214
(12)
The Ignite Managed Firewall product has evolved over the past three years to a fully featured security service offering a wide range of applications and capabilities. Probably the most exciting of these is the IPsec capability which, when combined with low-cost Internet connectivity from DSL technology, is set to fundamentally change the nature of private networking.
- + Show Description
-
-
13 Information Assurance
- + Show Description
-
Hide details
-
p.
215
–228
(14)
BT's Information Assurance Programme (IAP) aims to improve the state of preparedness to counter the emerging threat of malicious electronic-based attacks on our critical assets by protagonists with a high level of capability. As such it is directed to understand, identify and minimise the risk to our own enterprise and our customers' enterprises from the threat posed by the deliberate, unauthorised and systematic attack on critical information activities. Such attacks would be designed to exploit information, deny or affect service to authorised users, or to acquire, modify or corrupt data, and will be executed by capable, resourced and motivated perpetrators. Reaction to such attacks applies equally to BT's networks, the services it supports, and to its customers and the services they contract from BT, together with considerations of the communications infrastructure within the UK. This chapter will explain in more detail how the IAP operates and the benefits that it provides to BT and its customers. Detection and reaction processes to attacks are essential and the IAP is building upon the internal expertise in this area and BT's computer emergency response team (CERT).
- + Show Description
-
-
14 Biometrics - Real Identities for a Virtual World
- + Show Description
-
Hide details
-
p.
229
–242
(14)
Electronic transactions and processes are irrevocably changing the lives of people throughout the world, whether it be at work or in the home. As with the introduction of the letter post and the telephone, increasing interaction with people and systems remotely - rather than face-to-face - brings new challenges to society. Using the Internet, there are even fewer clues as to the identity of the sender of a message, except for references in the content or context of the communication. Individuals can take advantage of this opportunity for anonymity, or use pseudonymous identities in novel ways that would be impossible without such features of a new medium. However, there are many services that require the recognition of the identities of specific individuals. It is for these services that biometric methods - secure automated methods of recognising individuals using a measurable, distinctive physical aspect or action - offer the prospect of more secure ways of authentication.
- + Show Description
-
-
15 Transforming the 'Weakest Link' - a Human-Computer Interaction Approach to Usable and Effective security
- + Show Description
-
Hide details
-
p.
243
–262
(20)
With the exponential growth of networked systems and applications such as eCommerce, the demand for effective computer security is increasing. At the same time, the number and seriousness of security problems reported over the past couple of years indicates that organisations are more vulnerable than ever. In many of the reported cases, user behaviour enabled or facilitated the security breach. The security research community which hitherto largely ignored the human factor now acknowledges that security is only as good as it's weakest link, and people are the weakest link in the chain.
- + Show Description
-
-
16 Security Management Standard - ISO 17799/BSS7799
- + Show Description
-
Hide details
-
p.
263
–272
(10)
Security is more than using the right technology. In the words of cryptographer Bruce Schneier: 'If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology'. Security is as much about people, and the way they use the technology. The information security management standard BS 7799 addresses this very issue. BS 7799 was developed in the early 1990s as a result of demand from industry, government and commerce for a common information security framework. Organisations felt that they needed to assure those with whom they do business that they operate to a common minimum security standard. They also needed to be able to provide others with assurances about their own security.
- + Show Description
-
-
Back Matter
- + Show Description
-
Hide details
- + Show Description
-

