June 8, 2005 (Computerworld) --
Security through obscurity is probably one of the oldest tricks in the security book. The basic premise stems from the fact that people are trying to ensure security by hiding certain facts of their software or architecture design from regular users. This is equivalent to someone hiding a house key under a pot of plants in front of his house. However, Auguste Kerckhoffs, a 19th century Flemish cryptographer, said it should be assumed that attackers know the design of the entire security system, except for the keys. This concept, known as Kerckhoffs' law, basically rejected the notion of security through obscurity (your key hidden under your potted plant) and suggested that a system should be secure even if everything's public knowledge, except the key. Most administrators and developers these days are somewhat familiar with the various security concepts such as virus, worm, buffer or heap overflow, cross-site scripting and SQL injection. Since these concepts are fresh in their minds, they try to take explicit precaution to avoid these traps. However, they continue to develop software and products that rely on hiding certain trivial information, such as URL, username or other session information, and hope that users won't find them. They also try to hide this information in obvious places, such as hidden fields of a Web page or a different directory on a Web server. A case in point: Last March, Harvard Business School, along with a few other top business schools, suffered a huge embarrassment because its admission portal had a "break-in," as university officials called it (see story). ApplyYourself.com, a company that handles applications for Harvard and other elite institutions, had a Web portal where applicants could check on the status of their applications. Generally, Harvard's decisions go out on March 30. However, one applicant had figured out a way to obtain the status before that date. This applicant then posted it on a Web site for others to try. In the end, a total of 119 applicants tried this method. After finding out, Harvard decided to reject these 119 applicants regardless of their admission status (see story). Stanford University had made similar decisions recently, rejecting 41 applicants who tried this method. Lessons learned We are not here to argue whether Harvard and Stanford made the right decision or whether the action taken by the 119 applicants was ethical. However, there are some lessons to be learned here. First of all, ApplyYourself.com's method of hiding the admission status from the applicants was a great example of security through obscurity. In order to obtain the status early, the users took information that was readily available to them, modified the URL
"Need help sorting through the hype of cloud computing? Here's some IDC research on the benefits, barriers -- and what..."
Read more...
"Stephen Spoonamore offers more details on what I was trying to drive home in my recent column: Because individual votes..."
Read more... Read more Security posts or See all Blogs
One positive development stemming from the collapse of Wall Street may be a boost in interest in computer science and IT careers among students who were previously interested in financial services jobs.
From Laggard to Leader: Transforming the Data Center
From Laggard to Leader: Transforming the Data Center Register for this complimentary webcast today! Go to the webcast
Computerworld Executive Bulletin: Building a Robust Antivirus Defense
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. (Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more. Download this executive briefing
Intercept Spam & Viruses
Download this whitepaper to learn how to outsmart spam & viruses, compliments of MessageLabs. (Source: MessageLabs) Register for a complimentary 30 day trial of MessageLabs' new managed Anti-virus and Anti-spam security solutions. MessageLabs guarantees complete protection against all known and unknown email threats. By providing 24 hour support, your business can increase productivity and decrease risk.Register now for a complimentary trial and receive a free datasheet. Download this white paper
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Go Green with Webroot® Perimeter Security SaaS! Webroot Perimeter Security SaaS is a powerful alternative to obsolete on-premise hardware based security solutions. SaaS allows businesses to obtain flexible protection through an expert security provider, solving the problems caused by software, hardware and appliance solutions. Benefits include easier manageability, better protection and guaranteed performance –all at a lower cost. Register for your free copy of the "Why Security SaaS Makes Sense" whitepaper and Go Green with Webroot! Download this white paper now!
Fired up about IT?Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.
Companies today are realizing that competitive advantage is harder to sustain when based solely on gains in productivity and cost efficiency. The focus is shifting to invest more in business optimization initiatives which rely on trusted information to develop new insights that deliver better business results. But how can this be done efficiently in a business environment across multiple applications and processes. The answer is an Information Agenda - an innovative approach to transforming business information into a strategic asset for competitive advantage.
See your link here
Subscribe to
Computerworld 
From Laggard to Leader: Transforming the Data Center
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. 
Download this whitepaper to learn how to outsmart spam & viruses, compliments of MessageLabs.
Read up on the latest ideas and technologies from companies that sell hardware, software and services. 
Webroot Perimeter Security SaaS is a powerful alternative to obsolete on-premise hardware based security solutions. SaaS allows businesses to obtain flexible protection through an expert security provider, solving the problems caused by software, hardware and appliance solutions. Benefits include easier manageability, better protection and guaranteed performance –all at a lower cost. Register for your free copy of the "Why Security SaaS Makes Sense" whitepaper and Go Green with Webroot! 
Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.
John Brandon: Google Chrome = Dead, Google Search = Hot
Computerworld