Science Library Pad

authentication architecture in a federated enterprise

One of the challenges for authenticated services provided across your entire enterprise is identifying the appropriate credentials to use, for both ease-of-use for users as well as for sustainable manageability.

For organisations with a single central user directory, such as an enterprise-wide ActiveDirectory, this can be relatively straightforward.  In other organisations, there may be separate divisional authentication systems, without a single global user directory.

This means there are a few options for providing a global service within the enterprise, all with associated complexity and tradeoffs:

* One can create a new central directory, and either have users create accounts, or pre-populate it from existing stores.  However, if the existing divisional authentication systems continue to exist, this creates both a potential source of confusion (as users now have at least two accounts) as well as a possible synchronisation issue as both divisional and central user accounts now need to be maintained.

* One can federate across the various authentication systems, using e.g. Active Directory Federation Services or various LDAP federation approaches.

* One can use Shibboleth or other distributed authentication systems, where trust relationships allow the individual divisions to continue to maintain the credentials, but act as trusted authentication providers to other parts of the enterprise.

Within the Government of Canada, there are a number of potential approaches that could be taken to solve this problem.  For example, there is a PKI credential that can be created, attached to the globally-unique employee identifer (the PRI).  This is called myKEY... except it seems this branding is also used to describe a variety of legacy PKI systems within the government as well, so the situation is somewhat muddied.

Where this starts to get really complicated is when you want to have different levels of user rights, with e.g. closed groups with administrators, managers and contributors, and when you want to make this work in proprietary systems (which often have robust rights management, but using proprietary internal user account management) or across organisation boundaries, e.g. an extranet site that allows both internal users and external users.

As well, a federated solution means one has to deal with all of the varying privacy, security, and personal information standards of all the different divisions.  In such a situation, "can we use these credentials for X?" can become a difficult question to answer.

Beyond that, ideally we would like federated search to be able to return results for all content that a user has access to (including closed groups that they participate in).  I'm not sure how to manage this, effectively it means the central search service has to be able to act as an authenticated proxy-user for every single user.

For external collaboration, do we need to consider something like the (controversial) Identity Ecosystem proposed by the US government?  How do we allow Canadian citizens to participate in a trusted way in online government consultations, while ensuring that both their privacy is protected (so we probably don't want to share credentials with health or tax systems) and that they actually are Canadians?

Another issue is internal sustainability, for example, tightly binding to myKEY means that there needs to be a clear sustainability and evolution plan for those credentials.  If not, we run a danger of locking ourselves into a particular authentication solution.  To avoid this, one needs to find a way to loosely couple to an authentication service, but this can be difficult if you are seeking very granular user permissions and identification information.

For the moment, we are simply having users create separate accounts for new cross-division (enterprise global) systems but this is not sustainable.  Even attaching accounts to approved government email addresses is not sustainable, as currently the email address changes when users change departments.  I would be interested in hearing how other organisations are managing this (particularly for internal Government 2.0 services, such as government-internal wikis and discussion fora).  Is GovDex using user-created accounts attached to government email addresses?  Are there any best practices?

Free Public WiFi - the wirus SSID that went round the world

So you're out and about, time to upload some photos, check for a hotspot

Hooray, Free Public WiFi.

Everywhere you go - airports, coffee shops, even right now sitting at my desk at work - Free Public WiFi.

Which would be great, except it doesn't work.

It is a profoundly peculiar interaction of human behaviour and a Windows bug.  Not helped by systems and people who can't distinguish between infrastructure networks (which commonly connect you to the Internet) and ad-hoc networks (which are for a small group of computers to quickly communicate with each other).  Of course, some interfaces, like my N82 above, don't distinguish between the two wireless network types at all.

It looks like the world's greatest social engineering hack - create a wireless virus (a "wirus", if you will) that puts up a network name (an SSID) called Free Public WiFi, and then cheerfully compromise any machine that attaches, and continue to propagate.

In fact, it turns out just to be a bug.  The short answer is, Windows does something stupid.  The long answer is, Windows will present an SSID (with no intervention from the users) of networks it has previously seen in ad-hoc mode.

It's relatively harmless for now (but don't connect to it).

See more info at

Pogue's Posts - Free Public WiFi - January 29, 2008

and a reasonably clear explanation of it (and how to avoid connecting to ad-hoc networks) at

WLAN Book - “Free Public WiFi” SSID - July 16, 2007

If you want the most technical explanation, read this advisory, which dates back to January 2006

Nomad Mobile Research Centre A D V I S O R Y - 14Jan2006
Microsoft Windows Silent Adhoc Network Advertisement
Severity : High (albeit lame)

Sidebar 1: Posting prompted by a Tweet from Paul Walk about seeing this SSID on the train, and re-prompted by it coming up when I discovered WLAN scanning was running on my Nokia N82 while I was at my desk.

Re-found Tweet through

http://twitter.summize.com/search?q=%22free+public+wifi%22

which shows this problem continues to circulate daily.  Owen Stephens provided a quick pointer in response to Paul's query.

Sidebar 2: Shiny screen + trying to take a photo of one (quick to power down to black screen) cellphone with another (quick to power down to inactivity) cellphone was quite a challenge.  This shiny screen everywhere trend wreaks havoc on taking photos, unless you want to mirrorshot yourself every time.

Leopard firewall protection is spotty - Mac OS X 10.5 users beware

The ideal parent-safe OS continues to be Mac OS Classic, as it literally has no services exposed for people to attack.  But of course Progress Must Continue.  OS X 10.4 Tiger at least used the sturdy ipfw firewall, albeit well-hidden from most users under System Preferences... Sharing->Firewall.  ipfw is a time-tested and well-understood software firewall that operates at a low system level, filtering network packets.

In Leopard, Apple has introduced a completely new "black box" firewall that no one knows much about, it is an application level firewall, more like an application inbound traffic ZoneAlarm or Little Snitch.  The main problem is it simply doesn't work very well.

The first problem with the Leopard firewall is that it's difficult to tell what the Set Access option does. It starts the new application-level firewall and lists in the Sharing pane any services you've opened, but it doesn't indicate if they are allowed or blocked. There's also no option for you to add your own open services or ports anymore. Instead, you can add or remove individual applications, but not network services. Stealth mode is still available in the Advanced settings, but the UDP blocking, useful to stop port scanning and some other attacks, is gone.

Worse yet, when you install Leopard, the firewall is turned off, even if you're upgrading and the firewall was previously enabled. Say what you want about Windows, but the firewall is enabled by default. Finally, the firewall can actually break your applications, which I'll explain more about shortly.

TidBITS Safe Computing: Leopard Firewall Takes One Step Forward, Three Steps Back

Also see:
Apple Support - Mac OS X 10.5: About the Application Firewall
Macintouch Reader Reports - Leopard: Security
Macintouch Leopard FAQ - Security

As an immediate note, if the Leopard application firewall is activated, its code signing currently will break both Skype and World of Warcraft.

In a world where having a better security model and a clean, always on, network-level firewall was an advantage for Apple, this new firewall is a stunningly bad move.  They should have just talked to the Little Snitch people, or Zone Alarm, or other application-level firewall experts to create an inbound and outbound application level firewall IN ADDITION to (as an optional layer on top of) the already known and tested ipfw.

Also this emphasis on code signing is shades of Microsoft all over again.  "Hey, let's take something that demonstrably hasn't worked in Windows, and add it as yet another 'feature' in Leopard."

UPDATE 2007-11-15: Apple has released a 10.5.1 patch to address some of these issues, and clarify others.  What was called "deny all" is now

2. Allow only essential services:

This is the most conservative mode. Mac OS X will block all connections except a limited list of services essential to the operation of your computer.

The system services that are still allowed to receive incoming connections are:

    * configd, which implements DHCP and other network configuration services
    * mDNSResponder, which implements Bonjour
    * racoon, which implements IPSec

http://docs.info.apple.com/article.html?artnum=306938

via Slashdot Apple Fixes 'Misleading' Leopard Firewall Settings /.

In my opinion you should still consider crafting ipfw rules in front of the app firewall, if you're comfortable with that sort of thing.

attack of the killer RSS feeds

It's been a long time since I wrote anything security-related here, but I came across this gem as I was plowing through this month's dozens of pages of Microsoftese on the latest 9 security patches:

If a user subscribed to a malicious RSS feed in the Feed Headlines Gadget ... an attacker could potentially run code on the system.

Microsoft Security Bulletin MS07-048 - Important - Vulnerabilities in Windows Gadgets Could Allow Remote Code Execution (938123)

Truly this is a wondrous age we live in, when thanks to Windows Vista and Gadgets, your computer can now be attacked by yet another type of datastream.

Personal Firewall Day

January 15 is Personal Firewall Day

However, considering that the vendors haven't updated the above site since 2004, I suspect I'm the only person who remembers this yearly event.

Computer Security Day 2006

Every November 30 is Computer Security Day.

While I think of course you need to be worried about virus and network attacks, and you should investigate whether you can get some good software for free either through your ISP or just from the net, don't forget

BACKUPS

If you're going to take anything from Computer Security Day, take it as an opportunity to at least do a yearly backup.  When your harddrive fails (which is inevitable), you will thank me.

This doesn't have to be hard.  Just buy an external disk and drag and drop all your important files to it (e.g. your entire photo, video, audio and document directories).

If you want some more technical information, you can try my page on home computer security, or my

Computer Security Book Store (powered by Amazon.com)

Computer Security Book Store (powered by Amazon.ca)

spam the politics of spam spam reduction spam

Have you noticed how spam has declined thanks to the hard work of governments worldwide?
Me neither.

An anti-spam crusader fears Industry Minister Maxime Bernier is ignoring the spiralling threat of unsolicited e-mail, but a government official says substantial progress is being made.

Technology consultant Neil Schwartzman, a member of Industry Canada's spam task force, said he's worried about Bernier's silence on the issue since being appointed minister in February.

"Nothing has moved forward," Schwartzman said. "He has ignored the (task force) report."

Members of the task force will step up efforts to pressure Bernier to deal with the spam dilemma in the fall session of Parliament, Schwartzman said.

Spam fight at a standstill: Activist

our powerless world

• Globe and Mail - Loss of power line hits sweltering Alberta - July 25, 2006
• Calgary Sun - Calgary blacked out - July 25, 2006
• Edmonton Sun - Blackouts blamed on high heat - July 25, 2006

Would the last one leaving civilization please turn out the lights.

Anyway, again a reminder of our dependency on electricity, and its increasingly unreliable supply as all of our wonderful blinkenlight technology demands more and more power.

It's almost as if we need, dare I say, to

1. use energy more efficiently
2. use less energy, wherever practical
3. have a distributed electricity generation system (local solar panels, wind power, etc.)

Previously:
July 24, 2006  reasons why you need a disaster plan

reasons why you need a disaster plan

               

MySpace.Com - Undergoing Maintenance

                                      

hey everyone! there's been a power outage in our data center. we're in the process of fixing it right now, so sit tight. hopefully we'll be back online within the hour. its 6:40pm PST now. wanna place a bet? -Tom

This is actually a profoundly disturbing message, since one of the main reasons to host in a data centre is that such locations are supposed to be able to survive power outages with massive UPS and generator systems.

If that's not enough to remind you to work on your disaster recovery and business continuity plans, how about power outages across the United States?

• CNN -  St. Louis struggles without power - July 24, 2006
• New York Times - Restoration of Power in Queens Remains in Doubt - July 23, 2006
• San Francisco Chronicle - State's power supply starting to feel strain from record heat wave - July 23, 2006

It seems we haven't learned many lessons from previous disasters, whether Katrina or the blackout that hit Ontario and the eastern US.

Canada: copyright, DRM and other tech policy issues

I am far from being expert in these matters, but I know where I stand, which is: compensate creators reasonably, for a reasonable amount of time, allowing for all traditional fair use, first sale etc. rights.

This issue has some particular importance in Canada at the moment as we are having a Federal Election.

The Corporation tries to pull all into private space forever, this is a rational action by it to maximize profits.

I will let more expert voices speak, I do have one note: the "UN" WIPO treaty was just the US advocates of DMCA legislation, thwarted in the US, making international law behind closed doors and then coming back to the US and saying "oh dear, it's international law, I guess we must have a DMCA now".  I don't have a good ref on this, feel free to provide some.

I find it interested that the passion of the Canadian "rational technology policy" groups seems to be around copyright (which is certainly an important issue) with, as far as I can tell, no energy devoted yet to fighting electronic voting in Canada.

Anyway, on to some resources and thoughts on copyright and DRM in Canada.
Cory Doctorow has a major article out in Sunday's Toronto Star: Trademark political shenanigans.

Worrying about the Americanization of Canada is practically a national sport, and nowhere is it more prevalent than in politics. Recently, two-term Liberal MP Sam Bulte (Parkdale-High Park) has followed her American counterparts down the path of rewarding her entertainment-industry campaign backers by throwing her support behind U.S.-style copyright laws for Canada.

On Thursday night, just four days before the election, she will host a $250-a-plate fundraising dinner sponsored by the heads of the industry associations for the film, music, publishing and videogame sectors.

...

Take 1998's Digital Millennium Copyright Act (DMCA), a law that was enacted to implement the UN's WIPO Copyright Treaty. This is the same treaty that Bulte led the charge on trying to implement in the last Parliament with Bill C-60, Canada's own controversial copyright reform bill. (The bill died when the election was called but could be resurrected if the Liberals win the election; Bulte is thought to be a shoo-in for the job of minister of Canadian Heritage, which would make her responsible for copyright laws.)

The DMCA, passed in Congress with no debate, represents a kind of farcical wish list for rights holders who don't want to have to reinvent their business to accommodate the digital age. It lets anyone who claims to be an infringed-upon copyright holder demand the censorship of Internet materials without showing any evidence that any infringement has taken place.

...

Another form of "self-help" is so-called Digital Rights Management (DRM) technology. These are the technological restrictions put on the media that you buy, such as games, CDs and DVDs, that seek to control how you use works after you buy them.

These DRMs indiscriminately restrict the enjoyment of your lawful property, allowing rights holders to control your private use of media in ways not considered under copyright law. For example, Adobe's eBook technology blocks your ability to copy and paste a quotation, even where copyright law would allow it, e.g. in the course of criticism or in academic research.

DRM technology on DVDs prevents you from watching discs bought overseas in a Canadian DVD player, despite the fact that copyright doesn't give creators the right to control where their creations are viewed after they've been sold. That's why you don't need to leave your Canadian editions of your favourite books at home when you go on holidays in foreign countries.

...

Bill C-60 contained its own analogue to the Broadcast Flag: a mandate that required libraries to use DRM technologies when loaning out digital documents to patrons. Under C-60's proposal, Canada's tax-funded libraries would have to buy and use onerous restriction software to control how patrons used their digital documents — and their patrons would also have to pay a premium for DRM technologies to read and use these documents.

The outcome of the American approach that Bulte advocates is nothing less than a war between the entertainment industry and the public. In the U.S., thousands of lawsuits have been filed against music fans, including grandmothers and little girls in subsidized housing.

If you want a UK angle, I liked the posting by Kevin Marks: Response to the UK Parliament's DRM Inquiry

Each computers' immanent ability to become any kind of machine and the copying of data that happens as part of this, leads the DRM advocates naturally to the point where they want to outlaw computers, or to take them over by stealth, using virus-like techniques.

The reductio ad absurdum of this is to privilege DRM implementers in law above the owners of the computers on which their software runs, without their effective consent. Sadly, this is exactly what is being demanded by the publishers' lobby.

Slashdot points out yet another issue about DRM, in that it is in a way an attack on your own computer, potentially comproming your security.  The Choice Between DRM and Security, quoting a Groklaw article

We are entering the era of ubiquitous and safety critical computing, but the developers of DRM technologies seem to believe that computers are nothing more than personal entertainment systems for consumers. This belief is convenient, because creating DRM mechanisms that respect security, safety, and reliability concerns is going to be an expensive and complex engineering task.

I'd like to mention a side pet peeve of mine, which is that copyright holders are demanding so much money for even brief bits of their content, that is slowing, preventing, or altering DVD releases of TV shows.  Or even important documentaries, the pre-eminent example being Eyes on the Prize.  (Eventually rescued by donations of over US$850,000.)

There are also ongoing battles around the ability to make copies of digital content.  This includes forcing HDCP DRM on digital content, the endless HD DVD format and DRM wars, and digital radio.  (As a side note, corporate paranoia leading to increased DRM associated with enhanced digital quality has basically killed at least three technologies so far: DAT, SACD and DVD-Audio.)  It gets even worse, as the latest idea is a "broadcaster's right" and "webcaster's right".  That doesn't mean "right to webcast" that means "right to prevent anyone else from ever showing anything you transmit, even if you don't own the content yourself".

Slashdot 'Webcaster's Right' in WIPO Treaty /.
Slashdot Tension Between Record Labels And Digital Radio /.
Ars Technica "Analog hole" legislation introduced
Ars Technica Licensing our history

As luck would have it, there are a wealth of Canadian resources on these topics:

• Digital Copyright Canada
• Online Rights Canada
• Michael Geist
• faircopyright.ca
• Election 2006 - Internet Issues - CIPPIC

January 15: Personal Firewall Day

January 15th is Personal Firewall Day.

This launched in 2004, but as far as I can tell the website hasn't been updated since then.  The website is mostly about commercial firewall software, but there are free options as well.  Whether running Mac OS X or Windows XP, at a minimum make sure you turn on the built-in firewalls.

If you want to go one step better, ZoneAlarm (free) for Windows and Little Snitch (fee) for Mac OS X add outbound connection monitoring as well.

Google likes to watch...

Google doesn't want to be evil... but The Corporation is evil by design.

So their latest thing is finding ways to watch where you are going on the web.
Internally I'm sure this is justified as a way to improve their link rankings.

Google started with the Toolbar with PageRank turned on.
In order to calculate PageRank for each page, it has to contact Google and tell them what page you're visiting.  To be fair, it does put up a privacy notice.

Then there was Sidebar, which also seems to know what you're looking at.
There's also desktop search and such.

They try to offer you "free" functionality in exchange for knowing where you are going.
Now there are a couple handy Firefox extensions:

• Blogger Web Comments for Firefox The Blogger Web Comments Extension sends the URLs of pages that you visit to Google, so that we can search for and identify blogs that talk about that page.
• Google Safe Browsing (USA only).  An anti-phishing toolbar. If you enable Enhanced Protection, the Google Safe Browsing Extension will provide more up-to date protection by sending the URLs of sites that you visit and limited information about the site content to Google for evaluation.

So just be aware of this, when you're installing new Firefox extensions and such.

via Google blog - New Firefox extensions
Note: Google blog links are broken, I only got there from Google Labs - Google Extensions for Firefox.  It seems the links don't work without "index.html" on the end at the moment.

Also consider Google cookies: the search pages themselves want to drop cookies.  The toolbar wants to give you a cookie.  And of course, Google Analytics is in a whole other league of user tracking, including pushing a cookie (to, amongst other things, distinguish new visits from revisits).

But a while ago I noticed that the Google Blogger button, you know, that harmless "I Power Blogger" button you have to put on your Blogger pages?  It started pushing a cookie.  And all BlogSpot pages started pushing a cookie.  Err, how many cookies do we need exactly, Google?

Live Microsoft Live - antivirus

I think we will get tired of "Windows Live" Everything, but anyway:

Windows Live OneCare beta

is Microsoft's latest doodad, combining antivirus, maybe firewall, "tuneups" and backups.

via ChannelRegister Microsoft launches anti-virus public beta

Computer Security Day

Today, November 30, is Computer Security Day.  You can find some info and posters at

http://www.computersecurityday.org/

It's not exactly an extensive site, but it is a worthwhile reminder.
Have you backed up?  Are you running security software?  Are your patches up-to-date?

InfoWeek on SOA challenges and security

Service-oriented architectures are promoted as a model of efficiency for software development, a way of bringing plug-and-play ease to software "services." But implementing them hasn't been easy, with some companies finding that SOAs add complexity rather than simplicity.

Nearly a third of companies using them say service-oriented architectures are falling short of expectations, according to an InformationWeek Research survey. Among this group, a quarter have seen growing complexity in their IT systems, a third have been hit with higher-than-expected costs, and half report trouble cost-effectively integrating legacy systems into new software-development processes. It's a disappointing report card for a technical philosophy that's meant to guide software projects for years to come.

Software honchos haven't given up on SOAs, and many continue to be believe that their efforts will be worth the frustrations. In our survey of 120 business-technology professionals, respondents cited IT platform standardization, business-process automation, business flexibility, and operational savings as the leading business drivers behind their moves to service-oriented architectures.

The hard part is getting there. SOAs involve more than a few software services that get used across a couple of applications. They require a fundamental change in an IT organization's approach to software development, a broader role for business analysts, a clear understanding of employee and customer needs, and a plan for managing and securing the services that are key to it all.

InformationWeek - SOAs - Work In Progress - October 31, 2005

Also see Information Week sidebar - SOAs - Safer with SOAs--Or Not? - October 31, 2005

Info Grid 2005 - Tuesday 27th, 17:00 -

17:00

DEFF Identity and rights mangement activities
Arne Sørensen, DEFF

[err, see the presentation, I'm tired]

Presentation: ppt (466K); pdf (1.4M);

Projects 2005

* Shibboleth and EZproxy

http://www.deff.dk/aai/ (currently points to http://www.statsbiblioteket.dk/AAI/aai.jsp )
http://sso.kb.dk/

Projects 2006
- international networking
- use Knowledge Exchange
- national workshops
- from devel to production in selected areas
- formation of Danish InCommon: DK-AAI

Organization issues
- formal org to guarantee the sphere of trust
- e.g. Haka in Finland

Projects 2006+

- Shibbolize user databases
- Shib - ScienceDirect trial

wider communication about comp.risks

I highly recommend reading comp.risks if you're interested in getting a feeling for how fragile and often poorly-designed and thought-out the computer systems are that we rely on each day.

Peter G. Neumann has issued a call for wider dissemination of this information:

My note in RISKS-23.96 on 20 years of putting out issues of the ACM
Risks Forum has led me to reflect further on what we have accomplished
in the way of progress and what remains to be done.

The basic problems considered here keep recurring.  Whatever progress
might be made in computer-related technologies and their applications
has not been reducing the threats, vulnerabilities, and risks related
to the systems upon which we individually and as a civilization depend
most.  Overall, this leads me to a sense of frustration that the Risks
Forum has been largely preaching to the choir, and that our message is
not getting through to those who really need it most.  All of you
regular RISKS readers are likely to be totally unsurprised by the
items that you read here --- they are just more of the same.
Occasionally we might gain a new convert in the understanding of the
depth of problems of what is wrong and what is needed to meaningfully
address those problems.

Somehow we need to be able to reach out professionally and effectively
beyond the RISKS audience.  I have testified at least a dozen times
for governmental bodies on RISKS-related issues, but always have a
gnawing feeling that these efforts fall on deaf ears or are largely
ignored by brains that are preoccupied with other concerns.

Perhaps libraries could play a role?  Perhaps podcasting could be used to distribute the audio content proposed in the rest of the message?

Microsoft Update unifies security

One of the big flaws with the old MS security process was that Windows Update only updated the operating system, you still had to go separately to Office Update for those patches, and to other application sites to get their particular patches.  MS has thankfully unified this process now in

Microsoft Update

When I ran it on my Windows 2000 desktop, nothing showed up for Office though.

Rogers free security software now available

(Rogers is the cable Internet service that I use.)
Software for Windows only.  Very heavy on the ActiveX for installation (meaning you will need to use Internet Explorer).  Once installed, it is standalone software (except for the popup blocker).  Consists of

• anti-virus (from Computer Associates)
• parental controls
• pop-up blocker with toolbar (Yahoo IE toolbar)
• anti-spy

The home page for the software suite is

http://onlineprotection.yahoo.com/rogers/computer.php

You may have noticed that a firewall is not included in the above suite.  They have partnered with ZoneAlarm (which is free anyway).  They are providing a "special offer" of 20% off ZoneAlarm Pro, the pay version which has a few more features.

You can get the Rogers software from

http://rogers.software.yahoo.com/getprotected

You will have to login to download it.
You will need to disable your existing anti-virus to use the free one; might want to wait until your existing subscription runs out (if you have paid for anti-virus).

There is lots of information about the software at

How do I use the new all-in-one Rogers Yahoo Online Protection software suite?

Fancy narrated tour available (requires Flash).

Bell Sympatico does offer security software, but only for a fee.  Hopefully this move by Rogers will push them to go free as well.

UPDATE 2005-07-12: It is always wise to backup your computer before any major new software installation.  In Windows XP, you can take a snapshot of the machine's current state by making a Restore Point using the System Restore Wizard.  From the MS Help and Support Center:

To access the System Restore Wizard, click Start, and then click Help and Support. Click Performance and Maintenance, click Using System Restore to undo changes, and then click Run the System Restore Wizard.  Click Create a restore point, and then click Next.

Previously:
2005-April-29  Rogers Internet and Cogeco (and Shaw) provide free security software

Rogers Internet and Cogeco provide free security software

UPDATE 2005-07-11: Rogers free software now available.

If you're in Canada, you should see if your ISP is providing free or low-cost security software.

The days of paying a separate monthly fee to protect your home computer from viruses, spyware and other malicious intruders are gradually coming to an end.

Come June, all Rogers Cable high-speed Internet customers will get "all security features," including PC anti-virus, firewall protection and anti-spyware, for free as part of their monthly service subscription, the company said yesterday. Rogers currently charges $4.95 a month for McAfee anti-virus, the same amount for firewall protection, or $8.95 for both.

"We think anti-virus and (firewall protection) is a good thing our customers should have," said Terry Canning, vice-president of Internet at the Toronto-based cable company.

"It takes the crap out of the Internet."

Canning said there are too many different PC and Internet security products on the market, creating confusion for online users that often leads to inaction.

Less than 5 per cent of Rogers' high-speed customers actively use anti-virus or firewall features, according to the company.

"People are looking for leadership on this," said Canning, adding that 10 years after Rogers first launched high-speed Internet service the online world has become a more hazardous place to surf.

What was once mostly online vandalism has turned into a "more professional sport of intrusion," marked by a dramatic increase in identity crimes and, according to a recent Ipsos-Reid survey, rising consumer concern.

Rogers has roughly 1 million high-speed Internet subscribers in its operating territories of Ontario, New Brunswick and Newfoundland. It's just the latest major Internet service provider in Canada to view the free provision of PC-protection software as a cost of doing business.

Last November, Montreal-based Cogeco Cable, which sells broadband services around the Kingston area and Golden Horseshoe, began offering a free security package that includes PC anti-virus and firewall protection.The package, however, still costs $8 a month for its Internet "Lite" customers, and does not yet include spyware protection.

Bell, meanwhile, won't say if it plans to go the free route.

from Rogers absorbs cost of Net security, Toronto Star, April 29, 2005

Cogeco calls their offering simply Internet Security Services.  It appears to be based around F-Secure software.

It's nice to see the ISPs realizing that it's in their own best interest to make security as easy as possible for their users.  I guess they finally did the math on having to handle all the support requests, network traffic, and abuse complaints associated with having thousands of infected and compromised PCs on their network.  Hopefully as ISPs take a more active role, it will begin to clean up the Internet ecology a bit.  I really don't think it's useful trying to push much of this responsibility onto the users.  When was the last time you had to patch your television for security?  The computer is a home appliance, there is a big responsibility on the hardware, software and network service vendors to work together to reduce the huge security problems out there.  I'm surprised actually that banks and other financial services providers aren't pushing this more, or providing free software to their clients.

UPDATE 2005-05-02: Shaw provides a free service for subscribers (even covering up to 3 computers per household), also based on F-Secure, called Shaw Secure.

I think MacOS X is due for some security problems, anyone using a computer needs to take good precautions, but currently Windows is the major issue.  Walt Mossberg has a good article out this month: A Digital Crime Wave.

wireless hot spot or not spot?

WiFi users feel the sting of 'evil twins'

a new type of attack by a hacker using a fraudulent WiFi hot spot. Commonly known as "evil twins," the fake hot spots are set up close to legitimate public wireless access points in an attempt to trick users into logging onto the rogue site while believing they're using the trustworthy site. "Users think they've logged on to a wireless hot-spot connection, when in fact they've been tricked to connect to the attacker's unauthorized base station," said Dr. Phil Nobles, a cybercrime expert

in today's Globe and Mail

Remember that any time you're not using your computer or your network, you're at risk of having your information intercepted.  VPN, SSH tunnel, or other ways of sending your data encrypted are best.

virtual reference - IM security?

For those of you doing reference services using Instant Messaging, a bunch of questions:

- Are you doing anything about security?  For example, is the IM machine on the same network as the rest of your library machines, or is it isolated (e.g. by firewall)?
- What software do you use?  Do you support messaging from multiple networks or just from one?  Most library IM addresses I have seen are for AIM.  What about MSN?  What about open-source, multiple network software like GAIM?
- Do you log the sessions?
- Do you take any measures to limit/prevent instant messaging spam (aka "spim")?  Has it been a problem?

Any other feedback/suggestions?

Fraud Awareness Month

You may have not been aware of it, but it's Fraud Awareness Month in Canada.

anti-spam best practices

Canada's Task Force on Spam has created a site www.stopspamhere.ca listing three anti-spam best practices for consumers, along with links to more information:

1. Protect your computer
2. Protect your email address
3. Protect yourself

Auditor General 2005 - IT Security

1.1 Despite encouraging signs of improvement, the government has made unsatisfactory progress in strengthening information technology (IT) security since our audit in 2002. It has laid a foundation by developing IT security policies and standards, and lead agencies and departments are more involved and committed to IT security. However, two and a half years after revising its Government Security Policy, the government has much work to do to translate its policies and standards into consistent, cost-effective practices that will result in a more secure IT environment in departments and agencies.

2005 Report of the Auditor General of Canada - Status Report - Chapter 1 - Information Technology Security (also available in PDF version)