by Vladimir Volokh, VESOFT
        Presented at INTEREX Conference 1990, Boston, MA, USA
                    Published by VENEWS, #6, 1991.

The  problem  of  computer  security  was  definitely not  invented by
software vendors -- just read the newspapers every day.

Computer crimes come in different flavors:

* simply reading sensitive data (prices, customer lists, etc.)

* modification of data (payroll rates, shipping information)

* sabotage (viruses, time bombs, intentional system crashes)

* software theft

* unauthorized computer use

* defense-related crimes

* and more...

Security-minded  authors have written many  books, as well as articles
in  HP-related  publications,  on  this  subject; we  at VESOFT became
involved  in  the  HP3000  security  industry  in  its  very  infancy,
presenting  computer  security  papers  at  HP  conferences  in Berlin
(1981),  Copenhagen (1982), Anaheim (1984), and, most recently, at the
INTEREX security seminar in 1989.

And  yet  not  every  HP3000 computer is secure!  The word SECURITY is
misleadingly simple, simple enough to make many people think that they
have  adequate system security without  fully thinking out what HP3000
security really entails.

The  issue  of  computer  security  is  actually  very  complex  -- it

* physical security (guards, dogs, locks)

* system set-up (accounts, groups, users, capabilities, access, etc.)

* LOGON security

* file system security (why does MPE have a :RELEASE command?)

* IMAGE security (have you EVER changed your database password?)

* application security (who is allowed to print checks?)

* data encryption (fields, files)

*  LOGOFF security (can people just  walk up to an unattended terminal
  and use it?)

* batch access

* back-up and disaster recovery

* and more... much more...

System  security  is  every  bit  as much a primary  concern of any DP
department as the actual applications running on the machine.


Look at your accounting structure first:

* What accounts do you have (check it by using :REPORT X.@)?

* What groups (use :REPORT @.@)?

* What users (:LISTUSER @.@)?

* Which capabilities do each of them have (SM, OP, PM)?

* What kind of access (Read, Write... -- for ANY, AC, GU...)?

* Are all of these entities passworded, or only some of them?

* Are some of the existing passwords too short or too obvious?

* How often are they changed (if at all)?

* How many various levels of UDCs are set on your system?

* And if you rely on them, how easy is it to bypass them?


Logon  to the HP seems to be quite secure with ACCOUNT, GROUP and USER
passwords. Or is it?  Look carefully:

* MPE error messages at logon time are too "friendly"

* Passwords are readable combinations of up to 8 ASCII characters

*  They are either easy to guess or difficult to remember -- and users
  write them down (sometimes even stick them to the terminal)

* They are often shared or simply disclosed

* Seldom changed

*  If  users  use the session name  (:HELLO MARY,MGR.PAYROLL), it only
  looks  better -- the session name isn't enforceable and the password
  is assigned to user (MGR) anyway

*  Yes, the MPE password is assigned,  so account manager is the first
  suspect (and all SM users too)

* Is it easy to enforce shifts (time restrictions on logon)?

* Can payroll be run in the computer room (from LDEV 20)?

* Or can it be done on the weekend?

* Can end-users ever see ":"? What can they do then?

*  What is better: to forbid most MPE commands via "clever" UDCs or to
  let users execute only some commands and subsystems?

*  And if you have a logon  UDC which brings them into an application,
  how  about  some  other applications (e.g.  HPMAIL), some utilities?
  Should users constantly change their logon ID?


Remote access to the computer is common nowdays: dial-up, DS, NS...

*  Who  knows  your  dial-up telephone number?  Your former employees,
  current employees, telephone company workers, HP SEs...

*  Simple question: what to do if a person leaves the company? (Change
  all  passwords  on  the  system, unplug dial-up  forever, request to
  change your dial-up number...)

*  We have a horror story to tell you: one of our customers did change
  their   dial-up   number,   but...   the   telephone   company   set
  call-forwarding  onto  it  (you know the message  -- "The number has
  been changed, the new number is...")

*  And  if  there  are two or more  computers linked together, can any
  programmer access the production HP/960 from the development HP/42?


Logoff  is also a problem: you should realize that unattended sessions
constitute  a major threat to system  security.  The more sessions you
have (it can be hundreds on XL) the less control you have.

*  Remember  that an unattended terminal is  a convenient way for some
  people to use your system without logging-on.

*  Also,  if  the session is left on  after hours and keeps some files
  open these files might not be backed up.


Batch security is as important as on-line, but...

* MPE requires passwords to be included in job cards, so a typical job

*  This  makes  passwords  easy  to  read  by unauthorized  people and
  difficult  to  change  on a regular basis  by people responsible for
  system security (it might be you)

*  There  are  some  other  important  things  built  into  streams --
  lockwords, database and/or application passwords, etc.

*  The  situation  is  somewhat  better if all of  your streams are in
  groups with X:ANY,R:GU access -- but try to verify this


IMAGE  security had better be good  -- that's where our most important
data usually is.  However

* Passwords (up to 6 of them) create the appearance of good protection
  of the base, sets, and entries

*  But...  these  passwords are often built  into sources -- intrinsic
  DBOPEN  requires this; source code is compiled and guess what? IMAGE
  passwords  are never changed!  The situation is so bad and continues
  for so long, that HP users seldom recognize this kind of danger.

*  It's  even  worse  when  using  some  application  packages  -- all
  customers  of this package have the  same password.  Would you buy a
  car with the same key for everybody else who buys the same car?

*  Some  system managers sense something wrong  in this area and set a
  lockword  on QUERY.  It's better than  nothing, but what about other
  database retrieval tools or custom written programs?


File  system  security  in  general  is  very important.   A couple of
questions come to mind:

* How many files on your HP are released?

* Even worse -- are these files in PM groups?

* And how do you :SECURE hundreds of them? Are you the "creator"?

* Which files were accessed on your HP over the weekend?

* How many programs, and which ones, have PM capability?

*  Is it possible to :FCOPY the  object code of your programs in ;CHAR
mode and see all the 'built-ins'?

*  Do you like the recent  ACD (Access Control Definition) enhancement
  for  MPE/V  file system, which, in  short, links particular users to
  the file?

* If so, before using ACDs, think about selection of these files later
  --  they  will be as invisible as  :RELEASEd files; think also about
  setting  ACDs  for  groups of files, saving  ACDs after editing text
  files, etc.

Having said all of the above let's ask ourselves:

What is the biggest computer security threat?

It  seems  that  the  problem  lies in the wrong  approach to the risk
management  on  the part of DP personnel.   As long as system managers
continue  to count on users' ignorance,  on end-users being "good", on
having only one dial-up line (yes, we've heard this one too) and such,
company assets -- and some people's resumes -- will be in danger.

Go to Adager's index of technical papers