Passwords
Internal Controls
Firewalls
- Internet FirewallsComprehensive list of resources associated with Internet firewalls.
- NCSA Firewall Policy GuideThis document is intended to serve as not only a starting place for people who need to learn about firewall technology, but also as a high-level guide to its deployment
FTP
Risk Assessment
FBI studies have revealed that 80% of intrusions and attacks come from within organizations - not from "hackers" from afar.
NNTP and the Web: Preventing the Authorities From Choking the Publication of Information at Is Source.
"However, now that publishing has come to mean placing a copies of an electronic document on a few servers worldwide, the owners of these servers can be coerced into removing it. It is irrelevant whether the coercion comes from wealthy litigants exploiting the legal process, or from political rulers conspiring to control the flow of ideas. The net effect is the erosion of our inheritance from Gutenberg: printing is `disinvented' and electronics document can be `de-published'. This should concern everyone who values the benefits that have flowed from half a millenium of printing, publication and progress. " Ross J. Anderson
"...if the physical location of the worldwide web site cannot be located, then the rich man's lawyers will have nowhere to execute their seizure order" Anderson, supra.
National Security and Political Issues
- The Cryptography ProjectThe purpose of the Cryptography Project is to promote the development and use of encryption products that meet the security and privacy needs of users and the public safety, law enforcement, and national security needs of nations.
- Cryptography's Role in Securing the Information SocietyAdvocates expanded use of cryptography to protect information interests.
- Encryption Policy Resource PageEncryption technology is the key to the future of the information revolution. It allows businesses and individuals to communicate securely over any inexpensive communication platform without fear of eavesdropping.
- Efforts to Ban EncryptionOver the past few years, the Federal Bureau of Investigation has advocated prohibiting encryption techniques unless law enforcement can have - through a backdoor key - access to encrypted communications. The FBI asserts otherwise encrypted communications could be used to further criminal activities.
- Masson, Doug,The Genie Let Loose: Ineffectual Encryption Export Restrictions and Their Deleterious Effect On Business, 2 J. TECH. L. & POL'Y 1, <http://journal.law.ufl.edu/~techlaw/2/masson.html> (1996).
- Greg S. Sergienko, Self Incrimination and Cryptographic Keys, 2 RICH. J.L. & TECH. 1 (1996) http://www.urich.edu/~jolt/v2i1/sergienko.html. Issue: Can prosecutors use grand jury proceedings to compel individuals to produce keys to potentially incriminating computerized information which those individuals have encrypted?
- Clipper ChipThe Clipper Chip is being promoted by the U.S. government. It provides a standard for securing private voice communication. With Clipper, however, the government could obtain decryption keys that are held in escrow by two government agencies. Critic's state this "back door" means for the government to decrypt messages could be abused.
- Court Declares Crypto Restrictions Unconstitutional: Free Speech Trumps Clinton Wiretap Plan
- Center for International Trade and Security
- Vice President Gore's Statement on Cryptography and Export Policy
General Encryption Information
Steganography: "Steganography is the process of hiding a message within another message, or hiding it altogether."
Information
Anti-Virus Vendors
- CERT(sm) Coordination CenterBased at Carnegie Mellon University, CERT is a central point to report to in the event of a security breach. Particularly useful for UNIX security issues. Issues the CERT Advisory, notifying you of reported security issues.
- COAST"Computer Operations, Audit, and Security Technology" at Purdue is the foremost center for computer security on the Internet.
- Computer Crime Research ResourcesFederal and state statutes, bibliographies, and Internet links.
- Crypt NewsLetter's HomepageOffbeat view of the subject.
- FIRSTThe Forum of Incident Response and Security Teams (FIRST), brings together a variety of computer security incident response teams from government, commercial, and academic organizations. It is a a coalition to exchange information and coordinate response activities about computer security incidents..
- Information Security Archive An archive of online information security documents.
- National Association of Criminal Defense Lawyers
- National Computer Security AssociationNCSA is an independent organization offering objective views and opinions on computer security issues. It strives to improve computer security through the sharing of knowledge, dissemination of information, and certification of security products.
- The National Institute of JusticeThe research and development agency of the U.S. Department of Justice.
- NIST Computer Security Resource Clearinghouse
- The NSA "Rainbow Series"The "Orange" and "Red" Books are but two of many DoD standards for trusted computer systems. Each standard is known by its cover, the "Aqua Book," the "Neon Orange Book," the "Lavender Book," etc. Many are available here.
- Raptor Systems Online LibraryTexts of many security-related documents.
- Rainbow SeriesAnother source of Rainbow Documents.
- S. G. R. MacMillan, Barrister: Selected Internet ResourcesA collection of computer crime and security references that is particularly strong regarding white-collar computer-related crime.
- Security and Encryption-related Resources and Links
- Security Publications
- Yahoo!: Security and Encryption
