Last week I posted a blog on “9 qualities of worthwhile software“. Today I’d like to expand on #9, security. A good piece of software should “protect the information it is responsible for”. It should “secure the bits”. I have found one of the best ways to gain insights into computer technology (the bit world) is to look for parallels in the “real world” (the world based on atoms). Once one understands the major differences and similarities between bits and atoms, it is much easier to understand how to live in a world filled with bits.

As a husband and father, I take seriously my job of protecting my house and those in it. I’m protecting things made of atoms. I can see them. As a bit builder, I take seriously my job of protecting my clients’ information. In some sense, they cannot be seen nor felt. They are intangible, though in many cases are extremely valuable. One of the major differences between bits and atoms is that atoms can be seen and for the most part, bits cannot be.

Why do I say “for the most part”. Bits cannot be seen by the “naked eye”, the untrained eye. But with the right tools, a trained individual can sort of see the bits. In my 28 years of teaching computer science, I have noticed those that are inherently good with numbers can usually see the bits in their head. That’s because they are good with numbers. Securing bits has everything to do with understanding numbers. Its a “numbers game”.

In the atom world, we secure things in layers. The number and strength of each layer is determined by the value of the item being secured. For example, most of us secure our money in a bank. The bank secures it in a vault. The vault has layers of protection and so on. Now one thing worth noting in the atom world, which is also true in the bit world, the tighter I secure atoms (i.e. the more layers), the more difficult it becomes to access them when I need them. For example most of us use keys to gain access to our cars. Without the keys, accessing the car’s functionality is made considerably more difficult. Not impossible, just more difficult. If I live in a neighborhood in which car jacking has become a way of life, I probably also want to install other layers of security on my car – steering wheel locking bar and LoJack come to mind. An interesting thing to note about the locking bar, it is fairly easy to find something that will “hack through” this layer of security, such as the BUSTER – removes steering wheel locking bars (which, btw, I found in the same google search I used to find a locking bar, so take note – even the crooks use google!). Which brings up an important point about information security – any bits I can secure, can be made insecure by someone else.

Rule #1 – securing bits is a mathematics game

Rule #2 – any bits that one person can secure, can be made insecure by another person willing to put enough effort into it- beware of anyone telling you they can guarantee 100% security!

Rule #3 – increasing security decreases usability (makes things more difficult even for the honest folks)

Rule #4 – like securing atoms, securing bits is best done in layers

Rule #5 – it is harder to know that something you cannot see is secure or not (corollary is – It is easier to secure things you can see)

Rule #6 – securing stuff (bits or atoms) requires being able to think in advance of all the bad things that can happen

It is rule #6 I find to be the most challenging. Consider the events of 9/11. Prior to these events, not many people considered the extreme vulnerability of tall buildings! Now everyone is aware of this. In the early days of web sites which had databases on the backend, not many people considered the extreme vulternability of SQL injection. This is a technique whereby someone can do unexcepted things to your bits in a database – change them, get a listing of them, or simply delete them! Now any developer worth his/her weight in bits is well aware of this problem. In addition, a growing number of tools we use to build web-based software takes this into account to help the developer create systems which avoid this vulnerability. There are hundreds of these types of vulnerabilities to which web applications can be exposed. If you want more details, I recommend CWE/SANS TOP 25 Most Dangerous Programming Errors.

In addition to being concerned about the security of the software, to be totally secure (or as close as the laws of the bit business will allow) the software must be running on a secure network. This topic will be discussed in a blog post coming soon to your browser …….

One of the highlights of my BJU MBA e-commerce class is to have the students take a tour of Worthwhile. I just get out of the way and let several members of the Worthwhile Team (several of whom are products of the BJU MBA program) present our business. They do an outstanding job! Here are some of the comments and lessons learned from this year’s group of 23 bit business up and comings!

• The Worthwhile trip opened my eyes to the nuts and bolts of website development.
• I learned to love the industry more when I met the employees
• I was taken aback by the level of professionalism
• I never imagined a setting staffed with well dressed office workers, a high-end presentation area, and complimented by a hostess that would greet potential clients and communicate with existing customers.
• the tour helped me learn the importance of the bit business and just how valuable the bits and data are to consumers and local firms.
• Worthwhile demonstrated the need for and value of attractive office space, in which significant investment was obvious.
• Encouraging community involvement by the employees was something I had not seen modeled before.
• This seems like a great way to generate leads and generally engender goodwill.
• Chris’s description of Worthwhile’s web strategy process was very enlightening; it provided some concrete, useful concepts to replace a fussy sense of “that should work” or “that looks cheesy.”
• Chris’s Chick-fil-a example was particularly insightful.  He was right when he said, “Chick-fil-a gets it!”
• Sick Amount of Testing:  Although I have enough first hand experience (much of it less than pleasant) to know the importance of testing—and that “enough” testing is never actually enough—I had never heard this phrase before.  I love it.
• my first impression was that of a highly professional, friendly, and knowledgeable company
• It was easy to see how Worthwhile integrates its talents to take raw information from a business and turn it into a state-of-the-art website that provides attraction, functionality, and marketability in a secured and reliable setting.
• I found out what SEO was and did
• The two biggest lessons I learned during the tour was about knowing your customers and doing your best.
• the amount of excitement they had over every customer they told us about was amazing!
• “Do your best” is something we have heard since we were young, but the employees at Worthwhile showed me this applies all through life and is a good business policy to follow.
• The Worthwhile tour coupled with our homework exercise of making our own website, reiterated to me the importance of outsourcing web hosting and design.
• From search engine optimization to drive viewers to your website, to the aesthetic design and practical functionality to keep viewers at your website, to the hosting to keep your website running, outsourcing your website is by far the best, and in most cases, the only way to go.
• Probably one of the more key items that I learned was that the clients tend to want a trip to the moon for the cost of a subway fare.
• The presentation was top-notch, and so the discussion of the first impression team was also very important. If I ever own a company or am a partner in one, I think a first impression team will be something I want to set up as soon as possible because that team can really make the difference for clients’ willingness to go with one team above another.
• The Worthwhile tour was informative, but it was more than a discussion of technology. The Worthwhile team is a unit that works together to implement a successful website or service to every client that they serve.
• One of the best discussions our group had was during the Search Engine Optimization presentation which was lead by Leslie Ciesielski. As she gave her presentation she outlined how she had driven traffic to a company that sold windows in the upstate. I could not believe that SEO was important to a window company, but the traffic statistics which she gave to our group were amazing.
  they desired to pass on and teach us the basics of an e-business and the importance of customer service and implementing SEO with our e-business.
• I could tell they loved what they did and loved partnering with businesses in this way.
• Leslie explained SEO very clearly to us, something I had never really thought about before. I always thought that companies just paid Google a higher fee for having their site ranked higher, but in reality doing things such as targeting key words, linking to other sites, and having relevant information will all boost search engine rankings.
• The tour of Worthwhile greatly enhanced my understanding of what a bit business really does. There is a lot more that goes into web designing than just the creation of the website. People need to be focused on not just creating the product but giving a packaged service of support and design to the customer.

Here I am stuck @ the airport, bad weather in atlanta; denver bound to try and recruit the next generation of bit builders for my computer science program! I’m thankful for free wi-fi!

One of my sources for update to date technical information comes to me daily via my treo pda. Here is an article just out today which fits in perfect with the material you studied in chapter 3. Its about a new domain name extension that ICANN was planning to release, now delayed till year end; one of the challenges with release a new top level domain (.com is a top level domain) is controlling who gets access to registering them first for example. If you own coke.com and a new tld (say .tld) is created, you would expect to have the right to get coke.tld

Interesting to consider the parallel in the atom world – land; perhaps you’ve heard the old adage “they aren’t making any more land”; well the same is not true in the bit space; ICANN can create “new land” anytime they want (well, almost – read the article to find out); sort of like the US government does with money!!!!

NEW YORK – Bids for new Internet addresses to rival “.com” and other suffixes will likely be delayed until the end of the year as a key oversight agency grapples with trademark and security issues.

Draft guidelines for the new suffixes generated so much comment that the Internet Corporation for Assigned Names and Numbers, or ICANN, needs more time to sort out what it terms “overarching issues.”

Those include whether trademark owners could wind up having to register thousands of new domain names simply to protect their intellectual-property rights. For instance, the $185,000 application fee would likely deter casual bidders from seeking, say, a “.disney” Web suffix, but the Walt Disney Co. might feel pressured to register “disney.nyc,” “disney.bank” and scores of others under each of the new names, simply to keep them away from others.

Other concerns include whether new suffixes could encourage more scams involving fake Web sites that look legitimate, and whether new suffixes would even get much use.

Some of the forthcoming discussions should address concerns raised by the US. Commerce Department, which has significant sway because ICANN gets its powers through a government contract. ICANN cannot add any domain names without approval from the department’s National Telecommunications and Information Administration.

ICANN had wanted to start taking applications for new names early this year, but the timetable proved too ambitious given the extent of the feedback. ICANN now expects to open bids around December.

“It is very important to take the time to resolve these overarching issues,” said Paul Twomey, ICANN’s chief executive.

ICANN plans to post a new draft by Thursday clarifying and expanding on some of the proposed guidelines. Among the changes, a new foundation would be set up to collect any money raised through auctions that are planned for resolving conflicts when more than one applicant seeks the same domain name. The foundation would support research and other tasks related to running the domain name system.

By ANICK JESDANUN     AP Technology Writer