- Introduction
- Understanding the Basis for Policies
- Determining and Assigning Risk
- Writing Mobile Code Policies
- Summary
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Understanding the Basis for Policies
Mobile code should be allowed for some items but not for others. One way to implement this strategy is to create a level of trust between systems, or even based on technologies. Another way is to use code signing to identify the sender of the code. The concept is to execute only mobile code from a trusted source. The problem is that there are ways to defeat this method, and users may ignore the warnings.
Mobile code employs diverse technologies, which change as fast as users ask for new features. While it may be a good idea to "baseline" requirements based on a few technologies, doing so may hamper the ability to use those technologies to provide improved service. Additionally, users demand the functionality and the convenience provided by implementing mobile code, especially in support from many web-based services. This fact has caused many organizations to review their security policies and how they handle mobile code.
Even with the demands for functionality, the potential security problems cannot be ignored. Mobile code could be used to initiate denial-of-service (DoS) attacks, compromise information, or corrupt sensitive data. Although these problems may not happen because of a security breach, policies must be written to protect your organization's system and networks from mobile code that may be used to compromise critical information.
Considering these problems, one way to create your mobile code policy is to analyze each of the technologies used and assign it to a risk category based on its potential threat. Each of the risk categories is then assigned to a corresponding policy. When mobile code technology changes or new technologies are requested, you can have a policy that requires the technology to undergo a risk assessment so that it can be assigned to one of your risk categories. To prevent problems, your policy should state that if a mobile code technology has not been assigned a risk category, its use on your organization's computers and networks is prohibited.