1
|
- Week 13
- LBSC 690
- Information Technology
|
2
|
- Questions
- Equitable access
- Appropriate use
- Project demonstrations
|
3
|
- Computing facilities
- Networks
- Speed, continuity, access points
- Information sources
- Per-use fee vs. subscription vs. advertising
- Language
- Skills
- System, access strategies, information use
|
4
|
- Ownership
- Identity
- Privacy
- Integrity
|
5
|
- Who has the right to use a computer?
- Who establishes this policy?
How?
- What equity considerations are raised?
- Can someone else deny access?
- Denial of service attacks
- How can denial of service be prevented?
- Who can gain access and what can they do?
|
6
|
- Establishing identity permits access control
- What is identity in cyberspace?
- Attribution
- Impersonation
- Forgery is really easy
- Just set up your mailer with bogus name and email
|
7
|
- Serves several purposes
- Sensitive issues on discussion groups
- Brainstorming
- Whistleblowers
- Marketing (“Spam”)
- Common techniques
- Anonymous remailers
- Pseudonyms
|
8
|
- What privacy rights do computer users have?
- On email?
- When using computers at work?
At school?
- What about your home computer?
- What about data about you?
- In government computers?
- Collected by companies and organizations?
- Does obscurity offer any privacy?
|
9
|
- Privacy Act of 1974
- Applies only to government records
- TrustE certification guidelines
- Site-specific privacy policies
- Federal Trade Commission enforcement
- Organizational monitoring
|
10
|
- How do you know what’s there is correct?
- Attribution is invalid if the contents can change
- Access control would be one solution
- No system with people has perfect access control
- Risks digest provides plenty of examples!
- Encryption offers an alternative
|
11
|
- Secret-key systems (e.g., DES)
- Use the same key to encrypt and decrypt
- Public-key systems (e.g., PGP)
- Public key: open, for encryption
- Private key: secret, for decryption
- Digital signatures
- Encrypt with private key, decrypt with public key
|
12
|
- Viruses
- Platform dependent
- Typically binary
- Virus checkers
- Flooding
- The Internet worm
- Chain letters
|
13
|
- Parental control
- Web browsing software, time limits
- Intellectual property protection
- National security
- Censorship
|
14
|
- Establish policies
- Authenticate
- Authorize
- Audit
- Supervise
|
15
|
- Access control
- Effective multilevel security is hard to achieve
- Copy protection
- Licensing
- Shrinkwrap, Shareware, GNU Public license
- Digital watermarks
- Provide a basis for prosecution
|
16
|
- Used to establish identity
- Two types
- Physical (Keys, badges, cardkeys, thumbprints)
- Electronic (Passwords, digital signatures)
- Protected with social structures
- Report lost keys
- Don’t tell anyone your password
- Password sniffers will eventually find it
|
17
|
- Long enough not to be guessed
- Programs can try every combination of 4 letters
- Not in the dictionary
- Programs can try every word in a dictionary
- And every date, and every proper name, ...
- And even every pair of words
- Mix upper case, lower case, numbers, etc.
- Change it often and use one for each account
|
18
|
- Protect system administrator access
- Greater potential for damaging acts
- What about nefarious system administrators?
- Trojan horses
- Intentionally undocumented access techniques
- Firewalls
- Prevent unfamiliar packets from passing through
- Makes it harder for hackers to hurt your system
|
19
|
- Balance two desirable characteristics
- Financial incentives to produce content
- Desirable uses of existing information
- Safe harbor agreement (1976 legislative history)
- Book chapter, magazine article, picture, …
- Developed in an era of physical documents
- Perfect copies/instant delivery alter the balance
|
20
|
- Copyright Term Extension Act (CTEA)
- Ruled constitutional (Jan 2003, Supreme Court)
- Digital Millennium Copyright Act (DMCA)
- Prohibits circumvention of technical measures
- Implements WIPO treaty database protection
|
21
|
- Communications Decency Act (CDA)
- Ruled unconstitutional (1997, Supreme Court)
- Child Online Protection Act (COPA)
- Enforcement blocked (March 2003, 3rd Circuit)
- Children’s Internet Protection Act (CIPA)
- Ruled constitutional (June 2003, Supreme Court)
|
22
|
- Any individual approach is imperfect
- Term-based techniques
- Recall/precision tradeoff
- Not very useful for images and audio
- Whitelists and blacklists
- Expensive to create manually
- Differing opinions, time lag
|
23
|
- USA PATRIOT Act
- Access to business records (with a court order)
- Internet traffic analysis (with a court order)
- Foreign Intelligence Surveillance Act (FISA)
- Secret court for monitoring foreign communications
- Special protections for citizens/permanent residents
|
24
|
- Built-in features of standard software
- Browser history, outgoing email folders, etc.
- “Parental control” logging software
- ChatNANNY, Cyber Snoop, FamilyCAM, …
- Personal firewall software
|
25
|
- Proxy server
- Set up a Web server and enable proxy function
- Configure all browsers to use the proxy server
- Store and analyze Web server log files
- Firewall
- Can monitor all applications, not just the Web
|
26
|
- Scan for files in obscure locations
- Find by content for text, ACDSee for pictures
- Examine “deleted” disk files
- Decode encrypted files
- Possible for many older schemes
|
27
|
- Web tracking
- Browser data, clickthrough, cookies, …
- Packet sniffers
- Detect passwords, reconstruct packets, …
- Law enforcement
- Carnivore (US), RIP (UK), …
- National security
- Echelon (US), SORM (Russia), …
|
28
|
- Send private replies unless a public one is needed
- Don’t send unsubscribe requests to the list
- Read the FAQ before asking one
- Avoid things that start flames, unless you intend to
|
29
|
- Scheduled in advance
- Targeted for 30 minutes
- Web-accessible projects in my CLIS office
- Other projects anywhere you need to be
- Some time on Dec 9 or 10
- Get your reservations in early!
- At least one person from a team must come
|
30
|
- Starts with you showing me around
- You guide, I’ll drive
- I’ll run off the road a lot, though, to see what happens
- For Web projects, I may try another browser
- Some discussion about what you learned
- I’ll award the group’s grade on the spot
- Perfection is not required, only greatness!
|