Abstracts of Recent Articles and Literature

major business interruption, which will be considered a malfeasance of duty. Steps to ensure that con- tingency plans are adequate include conducting a legal audit, setting managerial roles, extending con- trols and rethinking cost/benefit analysis. Computerworld, July 11, 1988, p. SIO.

Approach Your Hot Site as Home Away from Home, Peter Scisco. Users, vendors and consult- ants have suggested the following factors to keep in mind when choosing a hot site. Price: Usually includes a monthly fee, a one- time declaration charge and a daily fee when the hot site is used; some of these costs may be negotiable. Compatibility: Means not only choosing a site with the hardware brand the firm uses but also means the hot site upgrades and maintains its hardware. Location: Choose site close to firm and a vendor with multiple locations. Commitment: Check the site provider's track record; 23 companies have left the business since 1978. Telecomm- unications flexibility: Check access to networks, drops to the nearest central switching office, modems and multiplexers available, con- tingency plans for regional dis- asters. Also consider the availability of hotel space, office space and all of the normal office products. Computerworld,July 11, 1988, p. $5.

Biometrics: the Future in Secu- rity Methods?, Shelley Bakst. Distributed data processing in- creases an organization's security risks. One future alternative to tra- ditional security methods is biometrics. A biometric system scans or replicates the characteris- tics to be measured and compares

the information to data which has been previously stored. Current systems measure fingerprints, voice patterns, retina patterns, hand geometry and signatures. Problems include user uneasiness, high cost, limited storage capacity, installation requirements, in- stability of physical characteristics and accuracy. Seven criteria and questions that system planners may use to determine viable products include system size and maximum number of users, number of access points, and audit and back-up cap- ability. A glossary ofbiometric terms is included in the article. The Office, July 1988, pp. 19-20.

Computer "Hackers" Viewed as a Threat to Phone Security, John Markoff with Andrew Pollack. Sophisticated personal computer users are becoming increasingly adept at penetrating the telephone system, raising questions about its security and privacy, according to experts and law-enforcement officials. Tampering has grown significantly as telephone com- panies have largely substituted computer-controUed switches for electromechanical call-routing equipment. Intruders can eaves- drop, add calls to someone's bill, alter or destroy data, steal facsimile documents being transmitted, have all calls to a particular number automatically forwarded to an- other number or keep someone's line permanently busy.

Some of these dangers were dis- closed in an internal memorandum written by the manager ofelectonic security at a telephone company and supplied to The New York Times by a teenage computer en- thusiast who said it had been ob- tained by a fellow hacker who illi- citly intercepted a facsimile trans-

mission. The manager also warned that an electronic intruder could essentially disable a central switch- ing office for routing calls, disrupt- ing telephone service to entire neighbourhoods. The telephone company vice president stated that it had taken steps to make it tougher to penetrate its systems but that the company had to strike a balance between security and cost. However, new and less ex- pensive security measures are ex- pected. The New York Times, July 22, 1988, pp. A I, D5.

Hill Might Punish Security Lapses, Kevin Power. The follow- ing statements were made at the NBS conference on guidelines for implementing the Computer Secu- rity Act. (1) Government officials must be willing to meet their respon- sibilities under the Act or they may lose money for information technology and prompt additional legislation. (2) Officials of NBS and OMB have agreed to allow agencies to lump systems that per- form similar functions into a single category for security planning pur- poses. (3) Agency officials were to have identified their sensitive systems early in July and agencies had to decide what kinds of infor- mation require protection. NBS's responsibility is protection not identification. Government Com- puter News,July 22, 1988, pp. 1, 120.

Securing the RSA- Cryptosystem Against Cycling Attacks, peterJamnig. Starting with a critical review of an attack against the RSA encryption scheme proposed by Berkovits, this paper investigates the impact of the key numbers, i.e. primes and encryp- tion exponent on the cycle lengths

526