\documentstyle[6.033-ps,11pt]{article}
\title{Internet Security}
\settopmargin{0.75in}
\begin{document}
\maketitle

Two major groups of problems need to be corrected in order to improve
security on the open Internet.  Uneducated users unknowingly introduce
security holes in UNIX\footnote{AT\&T would want me to say something
here about how they control use of the word ``UNIX.''} systems through
action or inaction.  Technical errors in system software open up other
security holes.  In order to make the Internet more secure, both of
these problems must be addressed.

By far the largest security problem is uneducated users.  People with
no experience and little or no training are given accounts on the
Internet.  These users then commit errors which can open critical
security holes, either to themselves or to the entire system.  The
most common example of this is choice of passwords.  Most people will
choose a password which is easy for them to remember: usernames,
spouse's or children's names, comic strip characters, and birthdays
are all examples of common passwords.  Unfortunately, these are also
examples of bad passwords, as they can be easily guessed by an
attacker who knows something about the victim.  Even if the victim is
not known by the attacker, combinations of readily available
information will often yield a correct password.  On a system where
users are trained to choose ``good'' passwords, such as passwords
containing acronyms, capital letters, and digits, system security is
greatly enhanced, as a routine attack will get nowhere.

Another common user error is misunderstanding UNIX file protections.
Often, a user will leave important files unprotected, allowing any
user on the system (including the unauthorized ones) to read financial
records, business strategy, or even other passwords for different
parts of the system, or different systems.  Users who are trained in
the UNIX operating system will be less likely to make these mistakes
and other similar errors.  Even the best security system cannot
protect against uneducated users making real mistakes.  Before any
system can be secure, users must be educated to understand how
important security is, and how to implement it.

The other major classification of security holes come from
programmers, including maliciously intended backdoors, or accidental
coding errors.  These are the more difficult security problems to
solve, as they often go unnoticed until someone exploits them.  At
this point, it may be too late.  The best guard against these kinds of
problems is a well-designed development cycle.  Designs and production
code should be audited by different programmers to insure that they
are free of errors.  Good programming style and robust languages
should be used to assist the human programmers from making mistakes
such as the ones which Morris used in fingerd to spread his worm.
Repairing programming errors makes a system more secure, at no cost in
ease of use to the user community.

Contrary to the beliefs which seem to be held by the commercial and
military establishments, openness, ease of use, and security need not
be mutually exclusive.  If a system is carefully designed to be free
of security holes and users are trained in computer security
measures, it is possible that a machine be both openly accessible to
those who are entitled to use it, and inaccessible to those who are
trying to break in.  This goal of open, secure systems can be achieved
through user education and rigorous programming practices.

\end{document}
