User Indifference Thwarts Electronic Signature Effort

Computerworld - An e-mail from the director of marketing put a spring in my step this week. He and I have locked horns over security issues in the past. Marketing always wants to develop new services and offer our clients access to them online.

Those are good business ideals, but marketing never seems to think about the fallout from such schemes. I've had to steer them away from the plans that were the most—well, I'd call them mad, and they would probably call them innovative.

This healthy tension between taking risks to bring in new business and protecting our brand has meant that although we get on very well personally, professionally we often find ourselves in heated debates about new projects. But for once, the marketing director's e-mail seemed to show that we were perfectly aligned. He wanted to discuss electronic signatures on our Web site, with reference to distributing documents to shareholders and customers.

An e-mail like that makes me want to dance—in the past six months, I've put some effort into sorting out a decent system for pushing out public-key infrastructure and signatures to clients. The result is multivendor compatible, with a distribution system using Mountain View, Calif.-based VeriSign Inc.'s Secure Sockets Layer certificates to authenticate us to our clients.

This system wasn't backed by the business teams because they felt the time wasn't right. Although they didn't stand in the way, we had to beg and borrow the budget for software and equipment to get the system working. But this e-mail showed me that my work hadn't been in vain: Marketing now wanted to take advantage of the setup. No doubt the plan was to use digital signatures to ensure that the information that affects prices couldn't be tampered with while being downloaded.

THISWEEK'SGLOSSARY Back door: This is an entry into a system left by a trusted insider so that he can gain access after official privileges have been removed. The greatest back door of all time was developed by Unix co-creator Ken Thompson. He modified the C compiler so that it would recognize when the log-in command was being recompiled and insert code recognizing Thompson’s password, giving him entry to every system. Normally, a back door could be destroyed by removing it from the source code for the compiler and recompiling the compiler. But to recompile the compiler, you have to use the compiler. So Thompson had the compiler recognize when it was compiling a version of itself. It then inserted the backdoor code into the new compiler. Having done this once, he was then able to recompile the compiler from the original sources; the back door perpetuated itself invisibly. Logic bomb: This is a piece of code included secretly in software that will perform malicious acts at a set time if not stopped by the writer. Disgruntled ex-employees have used logic bombs to punish companies for sacking them. LINKS: This story tells how Emulex Corp. in Costa Mesa, Calif., lost $2.2 billion in market capitalization through a stock manipulation because it didn’t have effective electronic signatures for its documents. But at least the attacker got 44 months in jail. Look here for the legal mumbo jumbo behind the Electronic Signatures Act.