Databases Reference
In-Depth Information
WWW SUPPORT INFRASTRUCTURE
• WWW servers accessible from external networks should reside out-
side the firewall and be managed centrally.
• By special approval, decentralized programs can manage external
servers, but must do so in accordance with corporate policy and be
subjected to rigorous audits.
• Externally published company information must be cleared through
legal and public relations departments (i.e., follow company proce-
dures).
• External outbound http access should utilize proxy services for addi-
tional controls and audit.
• WWW application updates must be authenticated utilizing standard
company security systems (as required).
• Filtering and monitoring software must be incorporated into the fire-
wall.
• The use of discovery crawler programs must be monitored and con-
trolled.
• Virus software must be active on all desktop systems utilizing WWW.
• Externally published information should be routinely updated or ver-
ified through integrity checks.
In conclusion, as information security practitioners embracing the tech-
nical challenges of the twenty-first century, we are continually challenged
to integrate new technology smoothly into our existing and underlying se-
curity architectures. Having a firm foundation or set of security principles,
frameworks, philosophies and supporting policies, procedures, technical
architectures, etc. will assist in the transition and our success.
Approach new technologies by developing processes to manage the inte-
gration and update the security framework and supporting infrastructure,
as opposed to changing it. The Internet, intranet, and the World Wide Web
is exploding around us — what is new today is old technology tomorrow. We
should continue to acknowledge this fact while working aggressively with
other MIS and customer functional areas to slow down the train to progress,
be realistic, disciplined, and plan for new technology deployment.
Search WWH ::
Custom Search