Security for Businesses on the Internet

http://www.catalog.com/mrm/security.html (Einblicke ins Internet, 10/1995)

This page is mostly a collection of links, rather than a source of information in its own right! The What's New page has links to recent press releases about security and digital cash.

Practical examples & tools for securing your business on the internet
Information on encryption & authentication
Links to businesses on the internet, including consulting services
Philosophical musings about where we're all headed

Last updated January 11, 1994

Practical examples & tools for securing your business on the internet

What to do if you suspect a break-in

If you monitor TCP/IP logs using a program like tcpdump you might notice attempted break-ins. Read Bellovin's An Evening With Berferd for ideas on how to get more clues.

Transactions: Ordering & Billing

Examples
- Jewelry Craftsmen ask customers to mail in a check
- CD Connection lets customers telnet in, and browse the extensive online catalog
- Reiters' Bookstore sets up PIN accounts for customers
- NetMarket accepts PGP-encrypted credit card numbers
Tools
- GetStats helps you monitor WWW logs
- vsafecsh plugs a hole in WWW forms
- NetScape sells a secure server for ~$5,000
- SPRY added security features to its Air Mosaic
- Betsi is a Bellcore system for authenticating software that is distributed over the net
Digital Cash
Systems that can be used today
- NetBank - send email to netbank-info@agents.com
- First Virtual by Marshall Rose et al. Or, send email to help@fv.com
Systems in various stages of testing
- December, 1994: USC's NetCheque
- XIWT , consortium of businesses in Washington D.C., connected to NII efforts
- DigiCash by Chaum. Or, send email to info@digicash.com
- CyberCash , founded by Dan Lynch and others. They are working with RSA, EIT and TIS.
Research
- NetBill at CMU and at CNI
- NexusBucks by cypherpunk
- Anonymous Credit Cards from AT&T Research
- Economics of the Internet, Hal Varian's university research page, with the netcash article from USC
Things to keep an eye on
- VISA (no real info online yet)
- Citibank (no real info online yet)
- NetCheque is a debit-card from the Information Sciences Institute (no real info online yet)
- The only online info about Intuit, Inc (recently acquired by Microsoft) is that they're hiring.

See also the Protocols & Standards section, below, for links to people working on various implementations of Secure HTTP and Secure Mosaic.

Email

PGP
PGP Manual
"Protect Your Privacy: The PGP User's Guide" by William Stallings is available from NCSA by mail. The price is $19.95 (US dollars) plus shipping. NCSA is donating $1 from each sale of the PGP guide to Phil Zimmerman's legal defense fund - the order form has a place to elect this option.

ViaCrypt: send email to viacrypt@acm.org, or contact them at

		ViaCrypt
		2104 W. Peoria Ave
		Phoenix, AZ 85029
		Phone: (602) 944-0773
		Fax: (602) 943-2601

TIS/PEM
RIPEM
PGP for Windows
PGP for Macintosh

Some interesting research is being done on document marking at AT&T.

If you suspect someone is forging email from you, check out John Gilmore's tips on how to trace forgeries.

Securing your Internet connection

This boils down to using firewalls and auditing packages. Also, if you allow logins, use a secure password program. If you run an internet server, consider implementing one of the single-use password systems, like the public domain S/Key from AT&T.

Firewalls:

Janus plug 'n play firewall
Bellcore Security Products
Checkpoint is being OEM'd by Sun
Free toolkit from TIS
Gauntlet product from TIS
GreatCircle has a nice online tutorial
TCP Wrappers from CERT
SOCKS

Auditing packages:

COPS from CERT
TripWire from Purdue

Secure passwords:

CERT recommends single use passwords. A public domain package is S/Key, from AT&T.
Crack
Volume 38 and Volume 39 of the software archive at ftp.uu.net contain the Shadow software
Password aging from SURA

Securing the underlying file system

Online docs for Kerberos, from Cygnus Support
Kerberos FAQ
Kerberos-enhanced ftp
Kerberos-enhanced telnet
Kerberos for Mac
Read about CFS (Cryptographic File System), AT&T Research and check out the announcement for information on how to get a copy of CFS
SmartDisk from InfoLane is a hardware security device for your 3.5" drive

Viruses

VIRUS-L FAQ from CERT
CERT archives of anti-viral software, from oak.oakland.edu
MS-DOS anti-viral software archive
Macintosh anti-viral software archive, from oak.oakland.edu
More PC anti-viral software, from risc.ua.edu
PC911 is a package you can run when your PC does not boot up normally

Subscribe to the virus-l mailing list by sending a message to listserv@lehigh.edu with the text "sub virus-l" in the body of the message.

Information on Encryption & Authentication

FAQs

Security pages

EINet's engagingly written paper, "Nasty things that go bump in the night." Mostly PC oriented.
SAIC seems to specialize in selling expensive solutions to the government
bsy's page
Rodney Campbell's page
NCSA on security for Mosaic
How to improve unix security for SunOS 4.x
Rutger's
Vince Cate's page
Open Source Solutions, Inc by Robert David Steele
Cliff Stoll
COAST is a project at Purdue
FIRST , Forum of Incident Response Security Teams (block that acronym), coordinated by NIST and CERT
Telecom Resources , a university research page

Consortia

Community Networks
- Victoria Freenets
- EFF's Extended Guide to the Internet - See Section 10 for a list of internet access providers
- Free-nets Home Page
The Tao of the IETF
CommerceNet , and my summary of what CommerceNet looks like to me
XIWT

Protocols & Standards

SSL , Secure Sockets Layer, from NetScape. SSL adds security by using a reliable protocol. SSL can be used with telnet, ftp, and smtp as well as http. An SHTTP implementation could be layered on top of SSL. Other NetScape opinions on security are discussed in Internet Data Security, by Marc Andreesen.
Chrg_HTTP from AT&T Research
SHTTP , the Secure Hypertext Transfer Protocol, is a potential IETF RFC, authored by folks at EIT. The second draft of the proposal was published in December 1994.
Examples using Secure Mosaic/HTTP from CommerceNet
Secure Mosaic manual from CommerceNet
Secure HTTP manual from CommerceNet
Authoring with Secure HTML from CommerceNet
SHEN from Cern

Working groups

CommerceNet Working Groups on Connectivity, Network services, Payment services, Directory services, Electronic catalogs, Electronic data interchange and Collaborative engineering

Links to businesses on the internet

Commerce pages

Thomas Ho's favorite Electronic Commerce links
AT&T Research's hangout for people who like to talk about online money: the www-buyinfo home page

Consulting services

Directories

Electronic Storefronts
OpenMarket's list (formerly the MIT list)
RPI's list
LLNL's list , odd but true.
BizWeb

Storefronts & malls

Standalone businesses

NetScape sells commercial versions of Web browsers and server software.
SPRY added security features to its Air Mosaic
IUMA

Philosophical musings about where we're all headed

December 1994: Time's online magazine service, Pathfinder, has a (bit overblown!) article on the recent rash of breakins, including the GE incident
Arnold Kling's Internet and Business Economics page has links to interesting articles about micropayments.
EFF Policy
Index of Clipper resources, through Wired Online (use mrrm as login, with password "hotwired")

Security for Businesses on the Internet

Practical examples & tools for securing your business on the internet

What to do if you suspect a break-in

Transactions: Ordering & Billing

Email

Securing your Internet connection

Securing the underlying file system

Viruses

Information on Encryption & Authentication

FAQs

Security pages

Consortia

Protocols & Standards

Links to businesses on the internet

Commerce pages

Consulting services

Directories

Storefronts & malls

Standalone businesses

Philosophical musings about where we're all headed

WebWork by Marianne Mueller , mrm@netcom.com.

Last updated January 11, 1995