In last month’s column, I talked about repurposing and managing digital assets. If you are going to move client art, corporate identities, brands, and other sensitive business graphics electronically, it stands to reason that these transactions be secure. This month, I would like to introduce the primary issues involved in moving digital files over the Internet in a safe, secure, and protected manner.

 

The history of file transmission

 

In last month’s column, I talked about repurposing and managing digital assets. If you are going to move client art, corporate identities, brands, and other sensitive business graphics electronically, it stands to reason that these transactions be secure. This month, I would like to introduce the primary issues involved in moving digital files over the Internet in a safe, secure, and protected manner.

 

The history of file transmission

 

Even before the Internet, it was possible to send and receive digital files between computers. This was done through dial-up modems and bulletin-board software. It was not a very secure method because it relied on user-entered passwords as the sole barrier to unauthorized intervention.

 

With the Internet came e-mail and the ability to attach graphic files to electronic messages. E-mailing soon became a popular way to get graphic files where they needed to be. If a file was below 1 MB, it was generally not too much of a problem to send it via e-mail. But with anything larger, all bets were off. Add to this the various data formats used by Macs and PCs, and it quickly became apparent that e-mail attachments were not the best way to transfer large graphic files.

 

Websites for file transfer

 

With the commercialization of the Internet, one of the primary tools of the research and educational community began to surface as a new way to transfer files–the file-transfer protocol (ftp) site. This system allows users to log in and serves as a direct channel between a client and a Website. Files can be uploaded as well as downloaded. Initially, interfacing with an ftp site required you to enter complex programming codes, daunting for all but the most seasoned operator. However, the text-code interface gave way to the familiar graphic interface we recognize as the browser.

 

Anyone can log onto an ftp site and move files. Many sites are even known as anonymous ftp sites simply because anyone can use them. Often the only password you need to enter the site is your e-mail address. Many Internet Service Providers (ISPs) do not permit the use of ftp sites because, left unmanaged, these sites can be the source of all sorts of mischief. Still, the ftp site became the most common way for printers to send or accept files from clients electronically.

 

It also became very common for service bureaus to provide ftp capability to their customers to speed up the process of sending and receiving digital art. It was the easiest way of sending very large files, and it could be accessed at any time.

 

The major disadvantage of the ftp site is that it is public. Indeed, it is so insecure as to be accessible at almost any level with virtually no experience on the part of the viewer. I once logged onto a site to see how the ftp process worked. I was shocked to find dozens of folders with client names (many of whom I recognized) on them. All of the files were completely in the public eye. I could see what files were being sent and even had access to the files themselves. If I was so inclined, I could copy the contents of any file to my desktop. This is certainly not the norm, but it exemplifies the danger of a public ftp site. Clearly, a better approach was needed.

 

With the development of the World Wide Web, a new type of server protocol began to appear–hypertext transfer protocol (http). This is the familiar label that begins most Website URL’s today. It also is a publicly accessible server protocol, and it is most often used to send information via forms and links when a user requests it.

 

The need for security In 1997, 85% of Internet users expressed some degree of fear that their private information could be compromised, copied, or stolen. It did not take long before the general public began demanding better security and protection of their private information, most notably, credit-card account numbers.

 

The resulting solution was the secure sockets layer (ssl) protocol developed by Netscape. It is designed to safely transmit and receive digital information between two parties in such a way that it cannot be intercepted, copied, or stolen. In a Website URL, the protocol is identified as "https", where the "s" denotes a secure server. The ssl technology is used in conjunction with special software called a digital certificate or digital signature. It incorporates encryption and decryption that is not easily broken or decoded. It all sounds very 007ish, but it is really your assurance of a protected transaction.

 

Verifying that you are in the middle of a secure transaction is simple. Besides the appearance of https in the URL header, both Netscape and Internet Explorer display a closed padlock when you are in a secure mode. It is very important to note, that not all pages on a Website will be secure. This is why the padlock and header are displayed.

 

The largest and most recognizable vendor of these security methods is Verisign RSA, one of the inventors of the encryption technology used today. There are two levels of encryption available: 40 bit and 128 bit. The larger number represents longer security codes that are more difficult to break. This level of security is so great that Verisign claims it has never been broken and would take a trillion, trillion years of computer processing to break the sequence! That’s good enough for me.

 

Even 40-bit is incredibly safe, and it can be used worldwide with no special licenses or permits. So now that you have a basic understanding of where file security has been, let’s focus on the things that should be important to you.

 

Authentication

 

<P>In any business transaction, you want to know who you are doing business with. When it comes to the digital world, this practice is called authentication. With Internet transactions, it happens on two different levels and is known as bidirectional authentication. On one side, the site owner wants to know that those who log into the site are who they say they are. The reasons for this are obvious: If a user is sending files for the site owner to reproduce, the site owner needs to know that the images really belong to the user.

 

On the flip side, the user wants to make sure that the site really belongs to the individual or company intended to receive the image. Until there were reliable methods of authentication, numerous cases of fraud occurred in which an unscrupulous con set up a fake or counterfeit Website that appeared to be the real deal. Just as with credit card, bank data, or other sensitive information you might transfer online, when you send sensitive graphics (like a new product design), you must be assured the recipient is who the image is intended for.

 

Authorization

 

Closely associated with the authentication process is one of authorization. This means that not only are you who you say you are, but that you are legally authorized to conduct the transaction. It is possible to authenticate someone, but they may not be authorized to start a transaction or to enter into a contract. The procedures for establishing who is authorized to conduct business are established in advance. The authorization parameters can be extremely precise, even tying the user to a specific computer from which transactions must be sent. This is done to assure that someone (like a disgruntled employee) does not steal a user name and password in order to initiate a fraudulent transaction.

 

Part of the authorization process is a step called nonrepudiation. This means that when the transaction is consummated and the work done, you cannot back out of the deal by claiming that you did not order the work. This is legally binding and will stand up in court. Nonrepudiation is an essential part of doing business on the Internet. The entire e-commerce model would fall apart if users were not certain they will get paid for the work they do or products they deliver.

 

Confidentiality and privacy

 

The security of the transactions that take place between parties is critical. No one wants the details or the specifics of their business affairs to be open to the public. With something so public as the Internet, protecting this privacy becomes especially important. Secure data transmission and the authentication and authorization processes are designed to strengthen the confidence of the transacting parties.

 

Security is crucial if database access is involved in the transaction process. And in the current B2B Internet environment, you can usually be certain that a database will be involved. Company account activity, purchasing records and history, order information, customer data, and so forth are all examples of information that must be retained in a confidential–yet accessible–way. If you send or receive files, make sure you establish policies for maintaining security.

 

Certificates and signatures

 

All of these functions–authentication, authorization, and security are handled within the scope of a digital certificate. These electronic codes are issued by the secure server to each and every client and are essentially the keys every user must have to get into and use the site. I will not go into the technical specifics about digital certificates and signatures, but they are key to all aspects of security online. For more information, visit Verisign at www.verisign.com. There you’ll find several excellent white papers on Website security, digital certificates, digital signatures, and secure server protocol–all required reading for anyone transacting business on the Internet today.

 

Beef up you security

 

I will close with a bit of advice. If you are really concerned about the security of your transactions, Verisign offers some excellent, low cost products to protect you. If digital security is a new area for you, look for the Verisign logo on the secure site you use. By clicking on the logo, you will be sent to a Versign Website, which details the registration, ownership, and other relevant data about the individual or company who is behind the secure site you’re using. It can be comforting to know that neutral third party companies like Verisign are out there to make your business transactions safer.