Computers and Security, Vol. 7, No. 3

problems are discussed, although it is concluded that there is no easy solution to the shortcomings in the insurance market. Znarmation Age,

January 1988, pp. 13-16.

Secure Access Control and MAC-based Signatures, Henry Beker. The well known concept of message authentication and the less well known access control tech- nique of dynamic passwords are addressed. The dynamic password method of access control relies on the generation, by the user, of a one-time password, thus rendering useless any fraudulent attack against the system from the recording or unauthorized disclosure of a user’s password. Furthermore, the specific password associated with any login is unpredictable in ad- vance of the login. Following a discussion of the general dynamic password technique and its ap- plications, a novel system which combines a dynamic password with message authentication to produce a “signature” is presented. Information Age, January 1988, pp. 20-22.

Typical System Access Control Probletns and Solutions, D. Ted Karren. This article considers problems of, and solutions for, the three functions of access control: identification, authorization and authentication. After describing three basic identification methods and a simple problem whose solu- tion lies in computer-automated identification. the need for auto- mated password mechanism is pre- sented along with a few sample problems. Authorization is dealt with in the final section which in- cludes a treatment of capability system problems followed by brief mention of other authorization techniques and their difliculties.

Information Age, January 1988, pp. 23-32.

Disaster Recovery Planning, Yasha SusoeJ Disaster recovery is something all data processing man- agers should consider-before they need to. This article looks at some practical and inexpensive alternative approaches to disaster planning as it affects computing. Information Age, January 1988, pp. 39-40.

Legal Protection of Software in the United Kingdom, Richard Dedman. The principal areas of law to which one looks in the U.K. for protection of software are pa- tents, confidentiality and copyright. The author discusses each of these areas in detail, citing relevant cases and states that the law of copyright is generally thought to be the most apt of all forms of legal protection for software. Also included is a discussion of the types of contrac- tual terms which a supplier may wish to insert into his licenses in order to protect his intellectual property rights. The Computer Law and Security Report, Januaty- February 1988, pp. 10-13.

Pentagon Attacks Viruses, Cilliam Gibbs and Charles Arthur. The U.S. Pentagon has started a huge 4 year programme to prevent computer viruses crippling its systems. The Pentagon has defined a minimum level of trust which classified and sensitive un- classified computer systems will have to meet by 1992. University staff in the United States have claim- ed that the Pentagon has told them not to comment in public on their virus experiences but the Pen- tagon says it “has no knowledge” of such instructions. Security experts have been warning for

some time that viruses pose an im- portant threat to commercial DP systems. Several programs are now on the market claiming they can counteract viruses but according to Dr. Highland, “No one should expect total protection.” Computer Weekly, February 25, 1988, p. 112.

Virus That Could Kill. Editorial. Computer viruses are easy to write, says the U.S. Pentagon. Even with cuts in its budget, the Pentagon is starting a 4 year pro- gram to protect its systems from rogue code which eats up system resources and corrupts files because the threat is real. Knowing how tetchy companies are about admit- ting computer faults, any incident will probably be hushed up. That will let the blase attitude spread- perhaps dangerously. Computer Weekly, February 25, 1988, p. 13.’

Computer Weekly. Quadrant House, The Quadrant, Sutton SM2 5AS. U.K.

Other Abstracts

NSA Suppresses GAO Report, Brad Bass. The National Security Agency has blocked the release of a report by the General Accounting Office that indirectly criticizes the agency’s Orange Book of standards for evaluating trusted computer systems, according to an anony- mous government source familiar with the report. GAO’s attempts to release a declassified version of the report were repeatedly stymied by NSA’s director, Lt. Gen. William Odom. Odom did not approve the declassified version because he was “protecting the Orange Book” from critics inside and outside NSA, the source said. He said the NSA computer com- munity is split between those sup-

323