Cyberspace confidential: protecting your words

[Tami]

Cyberspace confidential: protecting your words
Certificates, encryption and biometrics secure the new wave of digital documents



By GEORGE BUTTERS
Special to The Globe and Mail

Phone calls, e-mails, private memos, sensitive budgets, patent documents, architectural drawings, Supreme Court decisions, even the strip on the back of your debit card -- they are all digital documents, part of the expanding digital infrastructure that surrounds and supports the knowledge-based economy.

With our help and encouragement, that infrastructure is increasingly interconnected and our documents are much more accessible, for good and for ill.

Walk through any major airport, read any business newspaper or magazine and it's obvious that all of the big information technology companies are advertising the S-word: Security is everywhere.

No wonder. Symantec, a leading provider of desktop security software, reports more than a fourfold rise in the amount of Windows-based viruses in the first six months of this year; and says about 30,000 insecure computers are recruited daily into remotely controlled secret zombie networks that are often used to send spam to launch denial of service attacks or steal confidential information.

"More and more home PC owners are using tax software. Your tax return contains a wealth of personal information for identity thieves," says Corporal Jacques Boucher, a member of the RCMP's Atlantic Tech Crime Unit. "What would happen if someone hacked into your home computer and was able to access those files?"

Or suppose your hard drive crashes and you drop your computer off for repairs.

"How many people will handle that drive and have the opportunity to extract personal information from it?" Cpl. Boucher asks.

He recommends encrypting sensitive computer files, a system of encoding and decoding messages to keep information secure. But he warns that won't protect against keyboard sniffers that track keystrokes, save them to a file and send the file off to destinations unknown. He says larger companies are more aware of these perils but residential and small business users need to take them seriously.

Most corporate security experts say that even some larger firms needed prodding, although security is now firmly on the radar.

"This is the fallout from Enron," says Sean Sears, chief executive officer of Halifax-based abridean inc., which provides a document-management system to help clients control employee access to corporate papers and network resources.

New regulations require publicly traded companies south of the border to confirm in their quarterly statements that there has been no undue disclosure of financial information, and Mr. Sears says controlling and monitoring access to corporate documents is essential to compliance.

Failure to keep insider information secure could lead directly to jail. "That's a pretty sharp motivator," he says.

"Before the Internet, documents were kept in a filing cabinet. Unless someone broke into that cabinet, the documents were secure," adds Anthony Santilli, vice-president of marketing for Soltrus Inc., the Canadian arm of VeriSign, one of the world's leading digital security companies. No more.

With the Enron scandal still fresh in the minds of regulators and the stock-owning public, and with the Private Information Protection and Electronic Document Act now fully in force in Canada, public companies are being much more vigilant, Mr. Santilli says. "This is percolating activity within the industry. It is not going to go away."

He says parent company VeriSign sells more than 300,000 digital security certificates each year. These 'certs' are used to designate servers that can safely send and receive encrypted, sensitive data over the Internet or on a corporate network.

Jeff Harris, senior systems engineer for Loris Technologies Inc. of Toronto, is also in the business of storing and managing digital materials for such clients as Ford, Rogers Communications and Deutsche Bank.

He says access controls break down if managers have to wait for the Internet technology department to set up or modify user accounts. "Implementation is slow. Most people need quick changes, so they share user IDs and passwords. That's what happens in the real world."

The solution, he says, is to allow the people closest to the corporate documents and other network resources to quickly manage access as day-to-day needs dictate.

But what about safeguarding the corporate network from attack?

Cisco Systems Inc. spokesman Christian Bazinet says security must be interwoven into the fabric of what he calls a "self-defending network" that recognizes attacks, and instantly spreads the alarm. This can help prevent the disastrous cascading effects of malicious software like the Slammer worm, which spread around the world in 11 minutes.

The self-defending network can be configured to ensure that desktops or laptops logging in are properly protected with up-to-date antivirus software before allowing access to a newcomer.

So who, exactly, is that newcomer? That's what the Supreme Court of Canada wanted to know before implementing the new electronic court filing system that could be used by lawyers across the country. The answer will be provided by IDSscript Digital Credentials Inc. of Humboldt, Sask., in the form of digital identifiers.

"There are two components: the security technology side and then there is the trusted authentication side," says IDSscript president Jim Ramsay. In this case, the identity of the individual assigned a specific digital identity is verified by Juricert, an independent body established by the Law Society of British Columbia. "It's like getting a passport, only it's tougher."

Although the process is rigorous, he says it's relatively inexpensive -- about $200 a year per person -- and can be quickly activated: "If you get your documents to [Juricert], it can be turned around in a day."

One of the early adopters of the IDScript system was Terri-Lynn Williams-Davidson, a lawyer and executive director of Eagle Law, a non-profit agency that provides legal assistance to people involved in environmental and treaty issues from the Semiahmoo Reserve in Surrey, B.C.

"We are involved in a very large lawsuit," she says. "It's one of the first completely electronic trials. We are working with two other law firms and we wanted to have that evidence secured."

Documents are digitally signed using the digital identifiers and, in many cases, are also encrypted, requiring a key in order to view them.

Ms. Williams-Davidson says the system has been easy to use, but adds that some people with older computer systems haven't been able to open the encrypted documents. "We don't send them privileged information by computer," she says. To keep down costs and complexity, each of the groups involved provides a single, trusted point of contact.

For the average residential user or the small business owner without the resources of an IT department, there are some fairly simple steps that can be taken to protect sensitive files. To render distributed documents tamper proof, use PDF -- the portable document format developed by Adobe Systems -- which is essentially the poor man's document security tool.

The most popular tool for digitally signing and encrypting documents for e-mail is called PGP -- short for Pretty Good Privacy. It's free and is relatively easy to use.

For files that will remain on a drive, there are many inexpensive encryption programs that will render your files indecipherable to anyone without the proper password. Including you, if you forget the code.

What about the world of digital voice?

"Biometrics," says Jeremy Barnard, marketing director of Diaphonics Inc. of Halifax. Banks and other financial institutions typically challenge telephone customers with one or more personal details.

Thieves "can find that stuff in your garbage," he says. Better to have a digital recording of your vocal characteristics tied to your account. "You have to start tying a person's identity to a document, and you have to do that with biometrics. Over the phone, that's voice recognition."

IBM turned to biometrics of a different variety for the launch this week of its new line of ThinkPad laptops with an integrated fingerprint reader to control access to sensitive information.

[url=\"http://www.globetechnology.com/servlet/story/RTGAM.20041007.gtsrsecure07/BNStory/Technology/\"]source[/url]