E- business data exchange-security essentials. (Security).

While media attention on privacy and security tends to focus on consumer information on the Internet, much broader issues are at the core of business success in the electronic age. Whether the concern is the protection of corporate assets, compliance with industry or government regulations, or guarding sensitive personal information, business processes and procedures must adhere to the security policies of an organization.

As companies extend their business processes electronically to customers, partners and other external constituencies, there is a need to ensure the security of those transactions and of the sensitive business data that is being shared. The integration middleware and infrastructure that supports electronic business must have robust security features to satisfy these requirements.

ELEMENTS OF A SECURE E-BUSINESS ENVIRONMENT

Corporate security policies define levels of trust within the organization, and implement appropriate barriers between unauthorized users or malicious intruders, and valuable corporate information. In the context of e-business, security policies extend to the protection of business information shared with external constituencies.

Whether internal or external, security policies address the following elements.

* Authorization and authentication of users

* Access control to applications, data and other resources

* Protection of confidentiality and integrity of stored or transmitted information

* Proof of participation in an electronic transaction

* Intrusion detection and prevention

Authorization and Authentication of Users

Authorization is the process of granting user access to corporate resources These resources may include specific computer systems or networks, corporate data, applications and the like. Users may be internal to the organization or they may be external entities granted access to specific resources. Whether a user is an individual or an application, it is typically identified by a user ID with which certain privileges are associated In some environments, a specific set of privileges may be defined for a role in the organization or a particular group of users Assigning an individual user to the role or group grants the appropriate privileges.

Authentication the process of verifying the identity of the user attempting to access corporate resources, is often accomplished through a challenge/response technique, of which the login procedure with prompt for password or Personal Identification Number (PIN) is probably the most familiar. The security of a challenge/ response system relies on maintaining the confidentiality of the response data (such as the password or PIN).

Authentication may also be accomplished through presentation of a certificate that has previously been validated by a trusted party.

Regardless of the technique used, authentication mechanisms guard against unauthorized intrusion by verifying that the user, application, or system attempting to gain access to resources ,is who they claim to be. In the case of system-to-system communications, this provides security against such hacker tactics as IP address spoofing.

Access Control

Access control describes the mechanisms used to control access to corporate resources by authorized users. The simplest form is physical--resources are secured by denying physical access to unauthorized users. Familiar examples include locks on doors or filing systems and ID badges that permit the holder to have access to specific locations within the physical plant.

Controlling access to electronic resources may be accomplished in a variety of ways, such as

* By the privileges granted to an individual user, role or group

* By the rules associated with a specific file, database or other data source

* Through the application required to access the data

Access may be controlled by facilities within the operating system or network or by application or system sol, are.

Data Privacy, Confidentiality and Integrity

Ensuring the privacy and confidentiality of data extends beyond mere access control This is especially true when data is exchanged among departments within an organization or with external entities When data is transferred from one system to another, privacy must be ensured during the transfer. This may be accomplished by using a private connection (such as a WAN or leased lines) or by encrypting data that transits public networks. Increasingly, industry and governmental privacy regulations as well as corporate security policies require encryption of data in transit, regardless of the physical security of the network over which it travels. The Cryptography Technote--provides additional details on the concepts and implementation of cryptography for ensuring data privacy. Despite all other security precautions, it is still possible for a data packet to be intercepted and changed during transmission. Data integrity checking guards against tampering with data in transit, Typically, a message digest (or hash value) is computed independently at both the sending and receiving locations and is compared to verify the accuracy of the information received.

Proof of Participation

Proof of participation in an electronic transaction is also referred to as `non-repudiation.' Non- repudiation is typically achieved through the use of digital signatures, which are transmitted with the electronic transaction and may be stored with the data for later reference. A digital signature provides both proof of origin of the data and proof of participation by the sender. The United States has recently passed legislation giving digital signatures the same legal authority as handwritten signatures for certain types of transactions.

Intrusion Detection and Prevention

This category of security precaution guards against the penetration of corporate resources by unauthorized external entities. Like access control, some aspects of intrusion detection and prevention are associated with physical access to facilities and resources.

For electronic transactions, one technique for controlling intrusion is implementation of one or more firewalls between public networks. The simplest configuration is a single firewall between corporate systems and public networks. In today's complex business environment, where companies often exchange data with partners and customers, a common configuration is two firewalls with a `demilitarized zone" (DMZ) between them. External entities can traverse the outermost firewall for access to resources deployed in the DMZ. Traversal of the innermost firewall is restricted to trusted users or applications with authority to access back-end systems and to move data from the DMZ into the company's most secure environment.

Policies implemented on the firewall govern how far into a company's systems a user may penetrate, what types of data may traverse the firewall, and whether access is permitted in a single or bidirectional mode.

www.sterlingcommerce.com