doc: Add RFC documents

1 files changed, 1851 insertions, 0 deletions

diff --git a/doc/rfc/rfc2504.txt b/doc/rfc/rfc2504.txt
new file mode 100644
index 0000000..97cd940
--- /dev/null
+++ b/doc/rfc/rfc2504.txt
@@ -0,0 +1,1851 @@
+
+
+
+
+
+
+Network Working Group                                        E. Guttman
+Request for Comments: 2504                             Sun Microsystems
+FYI: 34                                                        L. Leong
+Category: Informational                                   COLT Internet
+                                                              G. Malkin
+                                                           Bay Networks
+                                                          February 1999
+
+
+                        Users' Security Handbook
+
+Status of this Memo
+
+   This memo provides information for the Internet community.  It does
+   not specify an Internet standard of any kind.  Distribution of this
+   memo is unlimited.
+
+Copyright Notice
+
+   Copyright (C) The Internet Society (1999).  All Rights Reserved.
+
+Abstract
+
+   The Users' Security Handbook is the companion to the Site Security
+   Handbook (SSH).  It is intended to provide users with the information
+   they need to help keep their networks and systems secure.
+
+Table of Contents
+
+   Part One: Introduction . . . . . . . . . . . . . . . . . . . .  2
+   1.   READ.ME . . . . . . . . . . . . . . . . . . . . . . . . .  2
+   2.   The Wires have Ears . . . . . . . . . . . . . . . . . . .  3
+   Part Two: End-users in a centrally-administered network  . . .  4
+   3.   Watch Out! . . . . . . . . . . . . . . . . . . . .  . . .  4
+   3.1.   The Dangers of Downloading  . . . . . . . . . . . . . .  4
+   3.2.   Don't Get Caught in the Web . . . . . . . . . . . . . .  5
+   3.3.   Email Pitfalls  . . . . . . . . . . . . . . . . . . . .  6
+   3.4.   Passwords . . . . . . . . . . . . . . . . . . . . . . .  7
+   3.5.   Viruses and Other Illnesses . . . . . . . . . . . . . .  7
+   3.6.   Modems  . . . . . . . . . . . . . . . . . . . . . . . .  8
+   3.7.   Don't Leave Me... . . . . . . . . . . . . . . . . . . .  9
+   3.8.   File Protections  . . . . . . . . . . . . . . . . . . .  9
+   3.9.   Encrypt Everything  . . . . . . . . . . . . . . . . . . 10
+   3.10.  Shred Everything Else . . . . . . . . . . . . . . . . . 10
+   3.11.  What Program is This, Anyway? . . . . . . . . . . . . . 11
+   4.   Paranoia is Good  . . . . . . . . . . . . . . . . . . . . 11
+   Part Three: End-users self administering a networked computer  14
+   5.   Make Your Own Security Policy . . . . . . . . . . . . . . 14
+
+
+
+Guttman, et. al.             Informational                      [Page 1]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   6.   Bad Things Happen . . . . . . . . . . . . . . . . . . . . 15
+   6.1.   How to Prepare for the Worst in Advance . . . . . . . . 15
+   6.2.   What To Do if You Suspect Trouble . . . . . . . . . . . 16
+   6.3.   Email . . . . . . . . . . . . . . . . . . . . . . . . . 17
+   7.   Home Alone  . . . . . . . . . . . . . . . . . . . . . . . 17
+   7.1.   Beware of Daemons . . . . . . . . . . . . . . . . . . . 17
+   7.2.   Going Places  . . . . . . . . . . . . . . . . . . . . . 19
+   7.3.   Secure It!  . . . . . . . . . . . . . . . . . . . . . . 20
+   8.   A Final Note  . . . . . . . . . . . . . . . . . . . . . . 20
+   Appendix: Glossary of Security Terms . . . . . . . . . . . . . 21
+   Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 31
+   References . . . . . . . . . . . . . . . . . . . . . . . . . . 31
+   Security Considerations  . . . . . . . . . . . . . . . . . . . 32
+   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 32
+   Full Copyright Statement . . . . . . . . . . . . . . . . . . . 33
+
+Part One:  Introduction
+
+   This document provides guidance to the end-users of computer systems
+   and networks about what they can do to keep their data and
+   communication private, and their systems and networks secure. Part
+   Two of this document concerns "corporate users" in small, medium and
+   large corporate and campus sites.  Part Three of the document
+   addresses users who administer their own computers, such as home
+   users.
+
+   System and network administrators may wish to use this document as
+   the foundation of a site-specific users' security guide; however,
+   they should consult the Site Security Handbook first [RFC2196].
+
+   A glossary of terms is included in an appendix at the end of this
+   document, introducing computer network security notions to those not
+   familiar with them.
+
+1.  READ.ME
+
+   Before getting connected to the Internet or any other public network,
+   you should obtain the security policy of the site that you intend to
+   use as your access provider, and read it.  A security policy is a
+   formal statement of the rules by which users who are given access to
+   a site's technology and information assets must abide.  As a user,
+   you are obliged to follow the policy created by the decision makers
+   and administrators at your site.
+
+   A security policy exists to protect a site's hardware, software and
+   data.  It explains what the security goals of the site are, what
+   users can and cannot do, what to do and who to contact when problems
+   arise, and generally informs users what the "rules of the game" are.
+
+
+
+Guttman, et. al.             Informational                      [Page 2]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+2.  The Wires have Ears
+
+   It is a lot easier to eavesdrop on communications over data networks
+   than to tap a telephone conversation.  Any link between computers may
+   potentially be insecure, as can any of the computers through which
+   data flows.  All information passing over networks may be
+   eavesdropped on, even if you think "No one will care about this..."
+
+   Information passing over a network may be read not only by the
+   intended audience but can be read by others as well.  This can happen
+   to personal Email and sensitive information that is accessed via file
+   transfer or the Web.  Please refer to the "Don't Get Caught in the
+   Web" and "Email Pitfalls" sections for specific information on
+   protecting your privacy.
+
+   As a user, your utmost concerns should, firstly, be to protect
+   yourself against misuse of your computer account(s) and secondly, to
+   protect your privacy.
+
+   Unless precautions are taken, every time you log in over a network,
+   to any network service, your password or confidential information may
+   be stolen.  It may then be used to gain illicit access to systems you
+   have access to.  In some cases, the consequences are obvious:  If
+   someone gains access to your bank account, you might find yourself
+   losing some cash, quickly.  What is not so obvious is that services
+   which are not financial in nature may also be abused in rather costly
+   ways.  You may be held responsible if your account is misused by
+   someone else!
+
+   Many network services involve remote log in.  A user is prompted for
+   his or her account ID (ie. user name) and password.  If this
+   information is sent through the network without encryption, the
+   message can be intercepted and read by others.  This is not really an
+   issue when you are logging in to a "dial-in" service where you make a
+   connection via telephone and log in, say to an online service
+   provider, as telephone lines are more difficult to eavesdrop on than
+   Internet communications.
+
+   The risk is there when you are using programs to log in over a
+   network.  Many popular programs used to log in to services or to
+   transfer files (such as telnet and ftp, respectively) send your user
+   name and password and then your data over the network without
+   encrypting them.
+
+   The precaution commonly taken against password eavesdropping by
+   larger institutions, such as corporations, is to use one-time
+   password systems.
+
+
+
+
+Guttman, et. al.             Informational                      [Page 3]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Until recently, it has been far too complicated and expensive for
+   home systems and small businesses to employ secure log in systems.
+   However, an increasing number of products enable this to be done
+   without fancy hardware, using cryptographic techniques.  An example
+   of such a technique is Secure Shell [SSH], which is both freely and
+   commercially available for a variety of platforms.  Many products
+   (including SSH-based ones) also allow data to be encrypted before it
+   is passed over the network.
+
+Part Two: End-users in a centrally-administered network
+
+   The following rules of thumb provide a summary of the most important
+   pieces of advice discussed in Part Two of this document:
+
+    - Know who your security point-of-contact is.
+    - Keep passwords secret at all times.
+    - Use a password-locked screensaver or log out when you leave your
+      desk.
+    - Don't let simply anyone have physical access to your computer or
+      your network.
+    - Be aware what software you run and very wary of software of
+      unknown origin.  Think hard before you execute downloaded
+      software.
+    - Do not panic.  Consult your security point-of-contact, if
+      possible, before spreading alarm.
+    - Report security problems as soon as possible to your security
+      point-of-contact.
+
+3. Watch Out!
+
+3.1. The Dangers of Downloading
+
+   An ever expanding wealth of free software has become available on the
+   Internet.  While this exciting development is one of the most
+   attractive aspects of using public networks, you should also exercise
+   caution.  Some files may be dangerous.  Downloading poses the single
+   greatest risk.
+
+   Be careful to store all downloaded files so that you will remember
+   their (possibly dubious) origin.  Do not, for example, mistake a
+   downloaded program for another program just because they have the
+   same name.  This is a common tactic to fool users into activating
+   programs they believe to be familiar but could, in fact, be
+   dangerous.
+
+
+
+
+
+
+
+Guttman, et. al.             Informational                      [Page 4]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Programs can use the network without making you aware of it.  One
+   thing to keep in mind is that if a computer is connected, any program
+   has the capability of using the network, with or without informing
+   you.  Say, for example:
+
+     You download a game program from an anonymous FTP server. This
+     appears to be a shoot-em-up game, but unbeknownst to you, it
+     transfers all your files, one by one, over the Internet to a
+     cracker's machine!
+
+   Many corporate environments explicitly prohibit the downloading and
+   running of software from the Internet.
+
+3.2. Don't Get Caught in the Web
+
+   The greatest risk when web browsing is downloading files.  Web
+   browsers allow any file to be retrieved from the Internet.  See "The
+   Dangers of Downloading".
+
+   Web browsers are downloading files even when it is not entirely
+   obvious.  Thus, the risk posed by downloading files may be present
+   even if you do not actively go out and retrieve files overtly.  Any
+   file which you have loaded over the network should be considered
+   possibly dangerous (even files in the web browser's cache).  Do not
+   execute them by accident, as they may be malicious programs.
+   (Remember, programs are files, too.  You may believe you have
+   downloaded a text file, when in fact it is a Trojan Horse program,
+   script, etc.)
+
+   Web browsers may download and execute programs on your behalf, either
+   automatically or after manual intervention.  You may disable these
+   features.  If you leave them enabled, be sure that you understand the
+   consequences.  You should read the security guide which accompanies
+   your web browser as well as the security policy of your company.  You
+   should be aware that downloaded programs may be risky to execute on
+   your machine.  See "What program is this, anyway?".
+
+   Web pages often include forms.  Be aware that, as with Email, data
+   sent from a web browser to a web server is not secure.  Several
+   mechanisms have been created to prevent this, most notably Secure
+   Sockets Layer [SSL].  This facility has been built into many web
+   browsers.  It encrypts data sent between the user's web browser and
+   the web server so no one along the way can read it.
+
+   It is possible that a web page will appear to be genuine, but is, in
+   fact, a forgery.  It is easy to copy the appearance of a genuine web
+   page and possible to subvert the network protocols which contact the
+   desired web server, to misdirect a web browser to an imposter.
+
+
+
+Guttman, et. al.             Informational                      [Page 5]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   That threat may be guarded against using SSL to verify if a web page
+   is genuine.  When a 'secure' page has been downloaded, the web
+   browser's 'lock' or 'key' will indicate so.  It is good to
+   double-check this: View the 'certificate' associated with the web
+   page you have accessed.  Each web browser has a different way to do
+   this.  The certificate will list the certificate's owner and who
+   issued it.  If these look trustworthy, you are probably OK.
+
+3.3 Email Pitfalls
+
+   All the normal concerns apply to messages received via Email that you
+   could receive any other way.  For example, the sender may not be who
+   he or she claims to be.  If Email security software is not used, it
+   is very difficult to determine for sure who sent a message.  This
+   means that Email itself is a not a suitable way to conduct many types
+   of business.  It is very easy to forge an Email message to make it
+   appear to have come from anyone.
+
+   Another security issue you should consider when using Email is
+   privacy.  Email passes through the Internet from computer to
+   computer.  As the message moves between computers, and indeed as it
+   sits in a user's mailbox waiting to be read, it is potentially
+   visible to others. For this reason, it is wise to think twice before
+   sending confidential or extremely personal information via Email.
+   You should never send credit card numbers and other sensitive data
+   via unprotected Email.  Please refer to "The Wires Have Ears".
+
+   To cope with this problem, there are privacy programs available, some
+   of which are integrated into Email packages.
+
+   One service many Email users like to use is Email forwarding.  This
+   should be used very cautiously.  Imagine the following scenario:
+
+      A user has an account with a private Internet Service Provider and
+      wishes to receive all her Email there.  She sets it up so that her
+      Email at work is forwarded to her private address.  All the Email
+      she would receive at work then moves across the Internet until it
+      reaches her private account.  All along the way, the Email is
+      vulnerable to being read.  A sensitive Email message sent to her
+      at work could be read by a network snoop at any of the many stops
+      along the way the Email takes.
+
+   Note that Email sent or received at work may not be private.  Check
+   with your employer, as employers may (in some instances) legally both
+   read your Email and make use of it.  The legal status of Email
+   depends on the privacy of information laws in force in each country.
+
+
+
+
+
+Guttman, et. al.             Informational                      [Page 6]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Many mail programs allow files to be included in Email messages.  The
+   files which come by Email are files like any other.  Any way in which
+   a file can find its way onto a computer is possibly dangerous.  If
+   the attached file is merely a text message, fine.  But it may be more
+   than a text message.  If the attached file is itself a program or an
+   executable script, extreme caution should be applied before running
+   it.  See the section entitled "The Dangers of Downloading".
+
+3.4 Passwords
+
+   Passwords may be easily guessed by an intruder unless precautions are
+   taken.  Your password should contain a mixture of numbers, upper and
+   lower case letters, and punctuation.  Avoid all real words in any
+   language, or combinations of words, license plate numbers, names and
+   so on.  The best password is a made-up sequence (e.g., an acronym
+   from a phrase you won't forget), such as "2B*Rnot2B" (but don't use
+   this password!).
+
+   Resist the temptation to write your password down.  If you do, keep
+   it with you until you remember it, then shred it!  NEVER leave a
+   password taped onto a terminal or written on a whiteboard.  You
+   wouldn't write your PIN code on your automated teller machine (ATM)
+   card, would you?  You should have different passwords for different
+   accounts, but not so many passwords that you can't remember them.
+   You should change your passwords periodically.
+
+   You should also NEVER save passwords in scripts or login procedures
+   as these could be used by anyone who has access to your machine.
+
+   Be certain that you are really logging into your system.  Just
+   because a login prompt appears and asks you for your password does
+   not mean you should enter it.  Avoid unusual login prompts and
+   immediately report them to your security point-of-contact.  If you
+   notice anything strange upon logging in, change your password.
+
+   Unless precautions have been taken to encrypt your password when it
+   is sent over the network, you should, if possible, use "one-time
+   passwords" whenever you log in to a system over a network.  (Some
+   applications take care of that for you.)  See "The Wires Have Ears"
+   for more information on the risks associated with logging in over a
+   network.
+
+3.5 Viruses and Other Illnesses
+
+   Viruses are essentially unwanted pieces of software that find their
+   way onto a computer.  What the virus may do once it has entered its
+   host, depends on several factors:  What has the virus been programmed
+   to do?  What part of the computer system has the virus attacked?
+
+
+
+Guttman, et. al.             Informational                      [Page 7]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Some viruses are 'time bombs' which activate only when given a
+   particular condition, such as reaching a certain date.  Others remain
+   latent in the system until a particular afflicted program is
+   activated.  There are still others which are continually active,
+   exploiting every opportunity to do mischief.  A subtle virus may
+   simply modify a system's configuration, then hide.
+
+   Be cautious about what software you install on your system.  Use
+   software from "trusted sources", if possible.  Check your site policy
+   before installing any software:  Some sites only allow administrators
+   to install software to avoid security and system maintenance
+   problems.
+
+   Centrally-administered sites have their own policy and tools for
+   dealing with the threat of viruses.  Consult your site policy or find
+   out from your systems administrator what the correct procedures are
+   to stay virus free.
+
+   You should report it if a virus detection tool indicates that your
+   system has a problem.  You should notify your site's systems
+   administrators as well as the person you believe passed the virus to
+   you.  It is important to remain calm.  Virus scares may cause more
+   delay and confusion than an actual virus outbreak.  Before announcing
+   the virus widely, make sure you verify its presence using a virus
+   detection tool, if possible, with the assistance of
+   technically-competent personnel.
+
+   Trojan Horse programs and worms are often categorized with viruses.
+   Trojan Horse programs are dealt with in the "What Program is This,
+   Anyway?" section.  For the purposes of this section, worms should be
+   considered a type of virus.
+
+3.6 Modems
+
+   You should be careful when attaching anything to your computer, and
+   especially any equipment which allows data to flow.  You should get
+   permission before you connect anything to your computer in a
+   centrally-administered computing environment.
+
+   Modems present a special security risk.  Many networks are protected
+   by a set of precautions designed to prevent a frontal assault from
+   public networks.  If your computer is attached to such a network, you
+   must exercise care when also using a modem.  It is quite possible to
+   use the modem to connect to a remote network while *still* being
+   connected to the 'secure' net.  Your computer can now act as a hole
+   in your network's defenses.  Unauthorized users may be able to get
+   onto your organization's network through your computer!
+
+
+
+
+Guttman, et. al.             Informational                      [Page 8]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Be sure you know what you are doing if you leave a modem on and set
+   up your computer to allow remote computers to dial in.  Be sure you
+   use all available security features correctly.  Many modems answer
+   calls by default.  You should turn auto-answer off unless you are
+   prepared to have your computer respond to callers.  Some 'remote
+   access' software requires this.  Be sure to turn on all the security
+   features of your 'remote access' software before allowing your
+   computer to be accessed by phone.
+
+   Note that having an unlisted number will not protect you from someone
+   breaking into your computer via a phone line.  It is very easy to
+   probe many phone lines to detect modems and then launch attacks.
+
+3.7 Don't Leave Me...
+
+   Do not leave a terminal or computer logged in and walk away.  Use
+   password-locked screensavers whenever possible.  These can be set up
+   so that they activate after the computer has been idle for a while.
+
+   Sinister as it may seem, someone coming around to erase your work is
+   not uncommon.  If you remained logged in, anyone can come by and
+   perform mischief for which you may be held accountable.  For example,
+   imagine the trouble you could be in for if nasty Email were sent to
+   the president of your company in your name, or your account were used
+   to transfer illegal pornography.
+
+   Anyone who can gain physical access to your computer can almost
+   certainly break into it.  Therefore, be cautious regarding who you
+   allow access to your machine.  If physically securing your machine is
+   not possible, it is wise to encrypt your data files kept on your
+   local hard disk.  If possible, it is also wise to lock the door to
+   one's office where the computer is stored.
+
+3.8 File Protections
+
+   Data files and directories on shared systems or networked file
+   systems require care and maintenance.  There are two categories of
+   such systems:
+
+    - Files to share
+
+      Shared files may be visible to everyone or to a restricted group
+      of other users.  Each system has a different way of specifying
+      this.  Learn how to control sharing permissions of files and
+      implement such control without fail.
+
+
+
+
+
+
+Guttman, et. al.             Informational                      [Page 9]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+    - Protected files
+
+      These include files that only you should have access to, but
+      which are also available to anyone with system administrator
+      privileges.  An example of this are files associated with the
+      delivery of Email.  You don't want other users to read your Email,
+      so make sure such files have all the necessary file permissions
+      set accordingly.
+
+3.9 Encrypt Everything
+
+      Additionally, there are files that are private.  You may have files
+      which you do not wish anyone else to have access to.  In this case,
+      it is prudent to encrypt the file.  This way, even if your network is
+      broken into or the systems administrator turns into Mr. Hyde, your
+      confidential information will not be available.  Encryption is also
+      very important if you share a computer.  For example, a home computer
+      may be shared by room mates who are friends but prefer to keep their
+      Email and financial information private.  Encryption allows for
+      shared yet private usage.
+
+      Before you encrypt files, you should check your site's security
+      policy.  Some employers and countries expressly forbid or restrict
+      the storing and/or transferring of encrypted files.
+
+      Be careful with the passwords or keys you use to encrypt files.
+      Locking them away safely not only helps to keep them from prying eyes
+      but it will help you keep them secure too; for if you lose them, you
+      will lose your ability to decrypt your data as well!  It may be wise
+      to save more than one copy.  This may even be required, if your
+      company has a key escrow policy, for example.  This protects against
+      the possibility that the only person knowing a pass phrase may leave
+      the company or be struck by lightning.
+
+      Whilst encryption programs are readily available, it should be noted
+      that the quality can vary widely.  PGP (which stands for "Pretty Good
+      Privacy") for example, offers a strong encryption capability.  Many
+      common software applications include the capability to encrypt data.
+      The encryption facilities in these are typically very weak.
+
+      You should not be intimidated by encryption software.  Easy-to-use
+      software is being made available.
+
+3.10 Shred Everything Else
+
+      You would be surprised what gets thrown away into the waste-paper
+      basket:  notes from meetings, old schedules, internal phone lists,
+      computer program listings, correspondence with customers and even
+
+
+
+Guttman, et. al.             Informational                     [Page 10]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+      market analyses.  All of these would be very valuable to competitors,
+      recruiters and even an overzealous (hungry?) journalist looking for a
+      scoop.  The threat of dumpster diving is real - take it seriously!
+      Shred all potentially useful documents before discarding them.
+
+      You should also be aware that deleting a file does not erase it in
+      many cases.  The only way to be sure that an old hard disk does not
+      contain valuable data may be to reformat it.
+
+3.11 What Program is This, Anyway?
+
+      Programs have become much more complex in recent years.  They are
+      often extensible in ways which may be dangerous.  These extensions
+      make applications more flexible, powerful and customizable.  They
+      also open the end-user up to all sorts of risks.
+
+    - A program may have "plug-in" modules.  You should not trust the
+      plug-ins simply because you are used to trusting the programs
+      they plug into.  For example: Some web pages suggest that the
+      user download a plug-in to view or use some portion of the web
+      page's content.  Consider: What is this plug-in?  Who wrote it?
+      Is it safe to include it in your web browser?
+
+    - Some files are "compound documents".  This means that instead of
+      using one single program, it will be necessary to run several
+      programs in order to view or edit a document.  Again, be careful
+      of downloading application components.  Just because they
+      integrate with products which are well-known does not mean that
+      they can be trusted.  Say, you receive an Email message which can
+      only be read if you download a special component.  This component
+      could be a nasty program which wipes out your hard drive!
+
+    - Some programs are downloaded automatically when accessing web
+      pages.  While there are some safeguards to make sure that these
+      programs may be used safely, there have been security flaws
+      discovered in the past.  For this reason, some centrally-
+      administered sites require that certain web browser capabilities
+      be turned off.
+
+4.  Paranoia is Good
+
+   Many people do not realize it, but social engineering is a tool which
+   many intruders use to gain access to computer systems.  The general
+   impression that people have of computer break-ins is that they are
+   the result of technical flaws in computer systems which the intruders
+   have exploited.  People also tend to think that break-ins are purely
+   technical.  However, the truth is that social engineering plays a big
+
+
+
+
+Guttman, et. al.             Informational                     [Page 11]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   part in helping an attacker slip through security barriers.  This
+   often proves to be an easy stepping-stone onto the protected system
+   if the attacker has no authorized access to the system at all.
+
+   Social engineering may be defined, in this context, as the act of
+   gaining the trust of legitimate computer users to the point where
+   they reveal system secrets or help someone, unintentionally, to gain
+   unauthorized access to their system(s).  Using social engineering, an
+   attacker may gain valuable information and/or assistance that could
+   help break through security barriers with ease.  Skillful social
+   engineers can appear to be genuine but are really full of deceit.
+
+   Most of the time, attackers using social enginering work via
+   telephone.  This not only provides a shield for the attacker by
+   protecting his or her identity, it also makes the job easier because
+   the attacker can claim to be a particular someone with more chances
+   of getting away with it.
+
+   There are several types of social engineering.  Here are a few
+   examples of the more commonly-used ones:
+
+    - An attacker may pretend to be a legitimate end-user who is new to
+      the system or is simply not very good with computers.  This
+      attacker may approach systems administrators and other end-users
+      for help.  This "user" may have lost his password, or simply can't
+      get logged into the system and needs to access the system
+      urgently.  Attackers have also been known to identify themselves
+      as some VIP in the company, screaming at administrators to get
+      what they want.  In such cases, the administrator (or it could be
+      an end-user) may feel threatened by the caller's authority and
+      give in to the demands.
+
+    - Attackers who operate via telephone calls may never even have seen
+      the screen display on your system before.  In such cases, the
+      trick attackers use is to make details vague, and get the user to
+      reveal more information on the system.  The attacker may sound
+      really lost so as to make the user feel that he is helping a
+      damsel in distress.  Often, this makes people go out their way to
+      help.  The user may then reveal secrets when he is off-guard.
+
+    - An attacker may also take advantage of system problems that have
+      come to his attention.  Offering help to a user is an effective
+      way to gain the user's trust.  A user who is frustrated with
+      problems he is facing will be more than happy when someone comes
+      to offer some help.  The attacker may come disguised as the
+      systems administrator or maintenance technician.  This attacker
+      will often gain valuable information because the user thinks that
+      it is alright to reveal secrets to technicians.  Site visits may
+
+
+
+Guttman, et. al.             Informational                     [Page 12]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+      pose a greater risk to the attacker as he may not be able to make
+      an easy and quick get-away, but the risk may bring fruitful
+      returns if the attacker is allowed direct access to the system by
+      the naive user.
+
+    - Sometimes, attackers can gain access into a system without prior
+      knowledge of any system secret nor terminal access.  In the same way
+      that one should not carry someone else's bags through Customs, no user
+      should key in commands on someone's behalf.  Beware of attackers who
+      use users as their own remotely-controlled fingers to type commands on
+      the user's keyboard that the user does not understand, commands which
+      may harm the system.  These attackers will exploit system software
+      bugs and loopholes even without direct access to the system.  The
+      commands keyed in by the end-user may bring harm to the system, open
+      his own account up for access to the attacker or create a hole to
+      allow the attacker entry (at some later time) into the system.  If you
+      are not sure of the commands you have been asked to key in, do not
+      simply follow instructions.  You never know what and where these could
+      lead to...
+
+   To guard against becoming a victim of social engineering, one
+   important thing to remember is that passwords are secret.  A password
+   for your personal account should be known ONLY to you.  The systems
+   administrators who need to do something to your account will not
+   require your password.  As administrators, the privileges they have
+   will allow them to carry out work on your account without the need
+   for you to reveal your password.  An administrator should not have to
+   ask you for your password.
+
+   Users should guard the use of their accounts, and keep them for their
+   own use.  Accounts should not be shared, not even temporarily with
+   systems administrators or systems maintenance techinicians.  Most
+   maintenance work will require special privileges which end-users are
+   not given.  Systems administrators will have their own accounts to
+   work with and will not need to access computer systems via an
+   end-user's account.
+
+   Systems maintenance technicians who come on site should be
+   accompanied by the local site administrator (who should be known to
+   you).  If the site administrator is not familiar to you, or if the
+   technician comes alone, it is wise to give a call to your known site
+   administrator to check if the technician should be there.  Yet, many
+   people will not do this because it makes them look paranoid and it is
+   embarrassing to show that they have no, or little trust in these
+   visitors.
+
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 13]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Unless you are very sure that the person you are speaking to is who he
+   or she claims to be, no secret information should ever be revealed to
+   such people.  Sometimes, attackers may even be good enough to make
+   themselves sound like someone whose voice you know over the phone.  It
+   is always good to double check the identity of the person.  If you are
+   unable to do so, the wisest thing to do is not to reveal any secrets.
+   If you are a systems administrator, there should be security
+   procedures for assignment and reassignment of passwords to users, and
+   you should follow such procedures.  If you are an end-user, there
+   should not be any need for you to have to reveal system secrets to
+   anyone else.  Some companies assign a common account to multiple
+   users.  If you happen to be in such a group, make sure you know
+   everyone in that group so you can tell if someone who claims to be in
+   the group is genuine.
+
+Part Three:  End-users self administering a networked computer
+
+   The home user or the user who administers his own network has many of
+   the same concerns as a centrally-administered user.  The following is
+   a summary of additional advice given in Part Three:
+
+    - Read manuals to learn how to turn on security features, then turn
+      them on.
+    - Consider how private your data and Email need to be.  Have you
+      invested in privacy software and learned how to use it yet?
+    - Prepare for the worst in advance.
+    - Keep yourself informed about what the newest threats are.
+
+5.  Make Your Own Security Policy
+
+   You should decide ahead of time what risks are acceptable and then
+   stick to this decision.  It is also wise to review your decision at
+   regular intervals and whenever the need to do so arises.  It may be
+   wise to simply avoid downloading any software from the network which
+   comes from an unknown source to a computer storing business records,
+   other valuable data and data which is potentially damaging if the
+   information was lost or stolen.
+
+   If the system has a mixed purpose, say recreation, correspondence
+   and some home accounting, perhaps you will hazard some downloading of
+   software.  You unavoidably take some risk of acquiring stuff
+   which is not exactly what it seems to be.
+
+   It may be worthwhile installing privacy software on a computer if it
+   is shared by multiple users.  That way, a friend of a room mate won't
+   have access to your private data, and so on.
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 14]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+6.  Bad Things Happen
+
+   If you notice that your files have been modified or ascertain somehow
+   that your account has been used without your consent, you should
+   inform your security point-of-contact immediately.  When you do
+   not know who your security point-of-contact is, try calling
+   your Internet service provider's help desk as a first step.
+
+6.1 How to Prepare for the Worst in Advance
+
+    - Read all user documentation carefully.  Make sure that it is clear
+      when services are being run on your computer.  If network services
+      are activated, make sure they are properly configured (set all
+      permissions so as to prevent anonymous or guest logins, and so
+      on).  Increasingly, many programs have networking capabilities
+      built in to them.  Learn how to properly configure and safely use
+      these features.
+
+    - Back up user data.  This is always important.  Backups are
+      normally thought of as a way of ensuring you will not lose your
+      work if a hard disk fails or if you make a mistake and delete a
+      file.  Backing up is also critical to insure that data cannot be
+      lost due to a computer security incident.  One of the most vicious
+      and unfortunately common threats posed by computer viruses and
+      Trojan Horse programs is erasing a computer's hard disk.
+
+    - Obtain virus checking software or security auditing tools.  Learn
+      how to use them and install them before connecting to a public
+      network.  Many security tools require that they be run on a
+      "clean" system, so that comparisons can be made between the
+      present and pristine states.  Thus, it is necessary for some work
+      to be done ahead of time.
+
+    - Upgrade networking software regularly.  As new versions of
+      programs come out, it is prudent to upgrade.  Security
+      vulnerabilities will likely have been fixed.  The longer you wait
+      to do this, the greater the risk that security vulnerabilities of
+      the products will be become known and be exploited by some network
+      assailant.  Keep up to date!
+
+    - Find out who to contact if you suspect trouble.  Does your
+      Internet Service Provider have a security contact or Help Desk?
+      Investigate this before trouble happens so you won't lose time
+      trying to figure it out should trouble occur.  Keep the contact
+      information both online and offline for easy retrieval.
+
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 15]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   There are 3 ways to avoid problems with viruses:
+
+      1. Don't be promiscuous
+
+      If at all possible, be cautious about what software you install on
+      your system. If you are unaware of or unsure of the origin of a
+      program, it is wise not to run it.  Obtain software from trusted
+      sources.  Do not execute programs or reboot using old diskettes
+      unless you have reformatted them, especially if the old diskettes
+      have been used to bring software home from a trade show and other
+      potentially security-vulnerable places.
+
+      Nearly all risk of getting infected by viruses can be eliminated
+      if you are extremely cautious about what files are stored on your
+      computer.  See "The Dangers of Downloading" for more details.
+
+   2. Scan regularly.
+
+      Give your system a regular check-up.  There are excellent
+      virus checking and security audit tools for most computer
+      platforms available today.  Use them, and if possible, set them to
+      run automatically and regularly.  Also, install updates of these
+      tools regularly and keep yourself informed of new virus threats.
+
+   3. Notice the unusual.
+
+      It's not true that a difference you cannot detect is no difference
+      at all, but it is a good rule of thumb.  You should get used to
+      the way your system works.  If there is an unexplainable change
+      (for instance, files you believe should exist are gone, or strange
+      new files are appearing and disk space is 'vanishing'), you should
+      check for the presense of viruses.
+
+   You should take some time to be familiar with computer virus
+   detection tools available for your type of computer.  You should use
+   an up-to-date tool (i.e. not older than three months).  It is very
+   important to test your computer if you have been using shared
+   software of dubious origin, someone else's used floppy disks to
+   transfer files, and so on.
+
+6.2 What To Do if You Suspect Trouble
+
+   If you suspect that your home computer has a virus, that a malicious
+   program has been run, or that a system has been broken into, the
+   wisest course of action is to first disconnect the system from all
+   networks.  If available, virus detection or system auditing software
+   should be used.
+
+
+
+
+Guttman, et. al.             Informational                     [Page 16]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Checking vital system files for corruption, tampering or malicious
+   replacement is very tedious work to do by hand.  Fortunately there are
+   many virus detection programs available for PCs and Macintosh
+   computers.  There are security auditing programs available for
+   UNIX-based computers.  If software is downloaded from the network, it
+   is wise to run virus detection or auditing tools regularly.
+
+   If it becomes clear that a home system has been attacked, it is time
+   to clean up.  Ideally, a system should be rebuilt from scratch.  This
+   means erasing everything on the hard disk.  Next, install the
+   operating system and then all additional software the system needs.
+   It is best to install the operating system and additional software
+   from the original distribution diskettes or CD-roms, rather than from
+   backup storage.  The reason for this is that a system may have been
+   broken into some time ago, so the backed up system or program files
+   may already include some altered files or viruses.  Restoring a system
+   from scratch is tedious but worthwhile.  Do not forget to re-install
+   all security related fixes you had installed before the security
+   incident.  Obtain these from a verified, unsuspicious source.
+
+6.3 Email
+
+   Remember to be careful with saved Email.  Copies of sent or received
+   Email (or indeed any file at all) placed in storage provided by an
+   Internet service provider may be vulnerable.  The risk is that
+   someone might break into the account and read the old Email.  Keep
+   your Email files, indeed any sensitive files, on your home machine.
+
+7. Home Alone
+
+   A home system can be broken into over the Internet if a home user is
+   unwary.  The files on the home system can be stolen, altered or
+   destroyed.  The system itself, if compromised, could be accessed
+   again some time in the future.  This section describes issues and
+   makes recommendations relevant to a home user of the Internet.
+
+7.1 Beware of Daemons
+
+   A home system which uses PPP to connect directly to the Internet is
+   increasingly common.  These systems are at the greatest risk if they
+   run certain kinds of programs called "services".  If you run a
+   service, you are in effect making your computer available to others
+   across the network.  Some services include:
+
+   - File servers (an NFS server, a PC with 'file sharing' turned on)
+   - An FTP server
+   - A Web server
+
+
+
+
+Guttman, et. al.             Informational                     [Page 17]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   There are, in general, two types of programs which operate on the
+   Internet:  Clients (like web browsers and Email programs) and Servers
+   (like web servers and mail servers).
+
+   Most software which runs on home systems is of the client variety;
+   but, increasingly, server software is available on traditionally
+   client platforms (e.g., PCs).  Server software which runs in the
+   background is referred to as a "daemon" (pronounced dee-mon).  Many
+   Internet server software programs that run as daemons have names that
+   end in `d', like "inetd" (Internet Daemon) and "talkd" (Talk Daemon).
+   When set to run, these programs wait for clients to request some
+   particular service from across the network.
+
+   There are four very important things to keep in mind as far as the
+   security implications of running services on a home computer are
+   concerned.
+
+    - First and most important, if a server is not properly configured,
+      it is very vulnerable to being attacked over a network.  It is
+      vital, if you run services, to be familiar with the proper
+      configuration.  This is often not easy, and may require training
+      or technical expertise.
+
+    - All software has flaws, and flaws exploited deviously can be used
+      to breach computer security.  If you run a server on your home
+      machine, you have to stay aware.  This requires work:  You have to
+      stay in touch with the supplier of the software to get security
+      updates.  It is highly recommended that you keep up with security
+      issues through on-line security forums. See [RFC2196] for a list
+      of references.
+
+      If security flaws in your server software are discovered, you will
+      need to either stop using the software or apply "patches" or
+      "fixes" which eliminate the vulnerability.  The supplier of the
+      software, if it is a decent company or freeware author, will
+      supply information and updates to correct security flaws.  These
+      "patches" or "fixes" must be installed as soon as possible.
+
+    - As a rule of thumb, the older the software, the greater the chance
+      that it has known vulnerabilities. This is not to say you should
+      simply trust brand new software either!  Often, it takes time to
+      discover even obvious security flaws in servers.
+
+    - Some servers start up without any warning.  There are some web
+      browsers and telnet clients which automatically start FTP servers
+      if not explicitly configured to not do so.  If these servers are
+      not themselves properly configured, the entire file system of the
+      home computer can become available to anyone on the Internet.
+
+
+
+Guttman, et. al.             Informational                     [Page 18]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   In general, any software MAY start up a network daemon.  The way to
+   be safe here is to know the products you are using.  Read the manual,
+   and if any questions arise, call the company or mail the author of
+   free software to find out if you are actually running a service by
+   using the product.
+
+   A home user running a remote login service on his home machine faces
+   very serious risks.  This service allows the home user to log in to
+   his home machine from other computers on the Internet and can be
+   quite convenient.  But the danger is that someone will secretly
+   observe the logging in and then be able to masquerade as the user
+   whenever they choose to do so in the future.  See "The Wires Have
+   Ears" which suggests precautions to take for remote log in.
+
+   If possible, activate all "logging" options in your server software
+   which relate to security.  You need to review these logs regularly in
+   order to gain any benefit from this logging.  You should also be
+   aware that logs often grow very quickly in size, so you need to be
+   careful they don't fill up your hard disk!
+
+7.2 Going Places
+
+   Remote logins allow a user privileged access onto physically remote
+   systems from the comfort of his own home.
+
+   More and more companies are offering their employees the ability to
+   work from home with access to their computer accounts through dial-up
+   connections.  As the convenience of Internet connectivity has led to
+   lowered costs and wide-spread availability, companies may allow
+   remote login to their systems via the Internet.  Customers of
+   companies with Internet access may also be provided with remote login
+   accounts.  These companies include Internet service providers, and
+   even banks.  Users should be very careful when making remote logins.
+
+   As discussed in "The Wires have Ears" section, Internet connections
+   can be eavesdropped on.  If you intend to use a remote login service,
+   check that the connection can be done securely, and make sure that
+   you use the secure technologies/features.
+
+   Connections may be secured using technologies like one-time
+   passwords, secure shell (SSH) and Secure Sockets Layer (SSL).  One-
+   time passwords make a stolen password useless to steal, while secure
+   shell encrypts data sent over the connection.  Please refer to "Don't
+   Get Caught in the Web" for a discussion on SSL.  Secure services such
+   as these have to be made available on the systems to which you log in
+   remotely.
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 19]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+7.3 Secure It!
+
+   Administering your own home computer means you get to choose what
+   software is run on it.  Encryption software provides protection for
+   data.  If you keep business records and other sensitive data on your
+   computer, encryption will help to keep it safe.  For example, if you
+   ran a network service from your home computer and missed setting
+   restrictions on a private directory, a remote user (authorized or
+   not) may gain access to files in this private directory.  If the
+   files are encrypted, the user will not be able to read them.  But as
+   with all forms of encryption running on any system, the keys and
+   passwords should first be kept safe!
+
+8.  A Final Note
+
+   This document has provided the reader with an introduction and as
+   much concise detail as possible.  Present security issues go out of
+   date quickly, and although effort has been made to keep discussions
+   general, examples given may not be relevant in the future as the
+   Internet and computer industry continue to grow.
+
+   Just as home-owners are now taking increased cautions at the expense
+   of convenience, to secure their homes in the changing world we live
+   in, computer network users should not ignore security.  It may be
+   inconvenient, but it is always better to be safe than sorry.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 20]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+Appendix: Glossary of Security Terms
+
+   Acceptable Use Policy (AUP)
+
+      A set of rules and guidelines that specify in more or less detail
+      the expectations in regard to appropriate use of systems or
+      networks.
+
+   Account
+
+      See (Computer) Account
+
+   Anonymous and Guest Log In
+
+      Services may be made available without any kind of authentication.
+      This is commonly done, for instance, with the FTP protocol to
+      allow anonymous access.  Other systems provide a special account
+      named "guest" to provide access, typically restricting the
+      privileges of this account.
+
+   Auditing Tool
+
+      Tools to analyze computer systems or networks in regard to their
+      security status or in relation to the set of services provided by
+      them.  COPS (Computer Oracle Password and Security analyzer) and
+      SATAN (Security Administrator's Tool for Analyzing Networks) are
+      famous examples of such tools.
+
+   Authentication
+
+      Authentication refers to mechanisms which are used to verify the
+      identity of a user.  The process of authentication typically
+      requires a name and a password to be supplied by the user as proof
+      of his identity.
+
+   Centrally-Administered Network
+
+      A network of systems which is the responsibility of a single group
+      of administrators who are not distributed but work centrally to
+      take care of the network.
+
+   Certificate
+
+      Certificates are data which is used to verify digital signatures.
+      A certificate is only as trustworthy as the agency which issued
+      it.  A certificate is used to verify a particular signed item,
+      such as an Email message or a web page.  The digital signature,
+      the item and the certificate are all processed by a mathematical
+
+
+
+Guttman, et. al.             Informational                     [Page 21]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+      program. It is possible to say, if the signature is valid, that
+      "According to the agency which issued the certificate, the signer
+      was (some name)".
+
+   Clean System
+
+      A computer which has been freshly installed with its operating
+      system and software obtainied from trusted software distribution
+      media.  As more software and configuration are added to a
+      computer, it becomes increasingly difficult to determine if the
+      computer is 'clean' or has been compromised by viruses, trojan
+      horse or misconfiguration which reduces the security of the
+      system.
+
+   Client
+
+      Depending on the point of view, a client might be a computer
+      system which an end-user uses to access services hosted on another
+      computer system called a server.  'Client' may also refer to a
+      program or a part of a system that is used by an end-user to
+      access services provided by another program (for example, a web
+      browser is a client that accesses pages provided by a Web Server).
+
+   Compound Documents
+
+      A 'document' is a file containing (a set of) data.  Files may
+      consist of multiple parts: a plain document, an encrypted
+      document, a digitally-signed documents or a compressed document.
+      Multi-part files are known as compound documents and may require a
+      variety of programs to be used in order to interpret and
+      manipulate it.  These programs may be used without the user's
+      knowledge.
+
+   (Computer) Account
+
+      This term describes the authorization to access a specific
+      computer system or network.  Each end-user has to use an account,
+      which consists most probably of a combination of user name and
+      password or another means of proving that the end-user is the
+      person the account is assigned to.
+
+   Configuring Network Services
+
+      The part of an administrator's task that is related to specifying
+      the conditions and details of network services that govern the
+      service provision.  In regard to a Web server, this includes which
+      Web pages are available to whom and what kind of information is
+      logged for later review purposes.
+
+
+
+Guttman, et. al.             Informational                     [Page 22]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Cookies
+
+      Cookies register information about a visit to a web site for
+      future use by the server.  A server may receive information of
+      cookies of other sites as well which create concern in terms of
+      breach of privacy.
+
+   Cracker
+
+      This term is used to describe attackers, intruders or other bad
+      guys that do not play by the rules and try to circumvent security
+      mechanisms and/or attack individuals and organisations.
+
+   Daemons (inetd, talkd, etc.)
+
+      These are processes that run on computer systems to provide
+      services to other computer systems or processes.  Typically,
+      daemons are considered "servers".
+
+   Decrypting
+
+      The process of reversing the encryption of a file or message to
+      recover the original data in order to use or read it.
+
+   Default Account
+
+      Some systems and server software come with preconfigured accounts.
+      These accounts may be set up with a predefined (user name and)
+      password to allow anyone access and are often put there to make it
+      convenient for users to login initially.  Default accounts should
+      be turned off or have their predefined passwords changed, to
+      reduce the risk of abuse to the system.
+
+   Dial-in Service
+
+      A way of providing access to computer systems or networks via a
+      telecommunications network.  A computer uses a modem to make a
+      telephone call to a another modem, which in turn provides 'network
+      access service'.  See also: PPP.
+
+   Digital Signature
+
+      A digital signature is created by a mathematical computer program.
+      It is not a hand-written signature nor a computer-produced picture
+      of one.  The signature is like a wax seal that requires a special
+      stamp to produce it, and is attached to an Email message or file.
+      The origin of the message or file may then be verified by the
+      digital signature (using special tools).
+
+
+
+Guttman, et. al.             Informational                     [Page 23]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Downloaded Software
+
+      Software packages retrieved from the Internet (using, for example,
+      the FTP protocol).
+
+   Downloading
+
+      The act of retrieving files from a server on the network.
+
+   Email Packages
+
+      To communicate via electronic mail, an end-user usually makes use
+      of an Email client that provides the user-interface to create,
+      send, retrieve and read Email. Various different Email packages
+      provide the same set of basic functions but have different user-
+      interfaces and perhaps, special/extra functions.  Some Email
+      packages provide encryption and digital signature capabilities.
+
+   Email Security Software
+
+      Software which provides security through digital signatures and
+      encryption (and decryption) to enable the end-user to protect
+      messages and documents prior to sending them over a possibly
+      insecure network.  PGP is an example of such software.
+
+   Encrypting / Encryption
+
+      This is a mathematical process of scambling data for privacy
+      protection.
+
+   Encryption Software
+
+      The software that actually provides the needed functionality for
+      end users to encrypt messages and files. PGP is one example.
+
+   End-User
+
+      An (human) individual that makes use of computer systems and
+      networks.
+
+   Files (programs, data, text and so on)
+
+      Files include user data, but also programs, the computer operating
+      system and the system's configuration data.
+
+
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 24]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   File Server
+
+      A computer system that provides a way of sharing and working on
+      files stored on the system among users with access to these files
+      over a network.
+
+   File Transfer
+
+      The process of transferring files between two computer systems
+      over a network, using a protocol such as FTP or HTTP.
+
+   Fixes, Patches and installing them
+
+      Vendors, in response to the discovery of security vulnerabilities,
+      provide sets of files that have to be installed on computer
+      systems.  These files 'fix' or 'patch' the computer system or
+      programs and remove the security vulnerability.
+
+   FTP (File Transfer Protocol)
+
+      A protocol that allows for the transfer of files between an FTP
+      client and FTP server.
+
+   Group of Users
+
+      Security software often allow permissions to be set for groups (of
+      users) as opposed to individuals.
+
+   Help Desk
+
+      A support entity that can be called upon to get help with a
+      computer or communication problem.
+
+   Internet
+
+      A collection of interconnected networks that use a common set of
+      protocols called the TCP/IP stack to enable communication between
+      the connected computer systems.
+
+   Key Escrow
+
+      Keys are used to encrypt and decrypt files.  key escrow is used to
+      store keys for use by third parties to access the data in
+      encrypted files.
+
+
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 25]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Keys Used to Encrypt and Decrypt Files
+
+      To make use of encryption, an end-user has to provide some secret,
+      in the form of some data, usually called a key.
+
+   Log In, Logging into a System
+
+      This is an action performed by an end-user, when he authenticates
+      himself to a computer system.
+
+   Log In Prompt
+
+      The characters that are displayed when logging into a system to
+      ask for user name and password.
+
+   Logged In
+
+      If an end-user has successfully proven to have legitimate access
+      to a system, he is considered to be logged in.
+
+   Logging
+
+      Systems and server software often provide the ability to keep
+      track of events.  Events may be configured to be written out to a
+      file known as a log.  The log file can be read later and allows
+      for system failures and security breaches to be identified.
+
+   Masquerade (see Remote Log In)
+
+      Anyone who pretends to be someone they are not in order to obtain
+      access to a computer account is said to be in 'masquerade'.  This
+      may be accomplished by providing a false user name, or stealing
+      someone else's password and logging in as him.
+
+   Network File System (NFS, file sharing with PCs, etc.)
+
+      NFS is an application and protocol suite that provides a way of
+      sharing files between clients and servers. There are other
+      protocols which provide file access over networks.  These provide
+      similar functionality, but do not interoperate with each other.
+
+   Networking Features of Software
+
+      Some software has features which make use of the network to
+      retrieve or share data.  It may not be obvious that software has
+      networking features.
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 26]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Network Services
+
+      Services which are not provided on the local computer system the
+      end-user is working on but on a server located in the network.
+
+   One-Time Passwords (OTP)
+
+      Instead of using the same password over and over again, a
+      different password is used on each subsequent log in.
+
+   Passphrase
+
+      A passphrase is a long password.  It is often composed of several
+      words and symbols to make it harder to guess.
+
+   Password-Locked Screensaver
+
+      A screen saver obscures the normal display of a monitor.  A
+      password-locked screensaver can only be deactivated if the end-
+      user's password is supplied.  This prevents a logged-in system
+      from being abused and hides the work currently being done from
+      passers-by.
+
+   Patch
+
+      See "Fixes, Patches and installing them"
+
+   Permissions
+
+      Another word for the access controls that are used to control the
+      access to files and other resources.
+
+   PGP (Pretty Good Privacy)
+
+      PGP is an application package that provides tools to encrypt and
+      digitally sign files on computer systems.  It is especially useful
+      to encrypt and/or sign files and messages before sending them via
+      Email.
+
+   Plug-in Modules
+
+      Software components that integrate into other software (such as
+      web browsers) to provide additional features.
+
+
+
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 27]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Point-of-Contact, Security
+
+      In case of security breaches or problems, many organisations
+      provide a designated point-of-contact which can alert others and
+      take the appropriate actions.
+
+   PPP (Point to Point Protocol)
+
+      PPP is the mechanism which most end-users establish a network
+      connection between their PC and their Internet service provider
+      with.  Once connected, the PC is able to transmit and receive data
+      to any other system on the network.
+
+   Privacy Programs
+
+      Another term for encryption software that highlights the use of
+      this software to protect the confidentiality and therefore privacy
+      of the end-users that make use of it.
+
+   Remote Access Software
+
+      This software allows a computer to use a modem to connect to
+      another system.  It also allows a computer to 'listen' for calls
+      on a modem (this computer provides 'remote access service'.)
+      Remote access software may provide access to a single computer or
+      to a network.
+
+   Remote Log In
+
+      If an end-user uses a network to log in to a system, this act is
+      known as remote log in.
+
+   Security Features
+
+      These are features which provide protection or enable end-users
+      and administrators to assess the security of a system, for
+      example, by auditing it.
+
+   Security Policy
+
+      A security policy is written by organisations to address security
+      issues, in the form of "do's" and "don'ts".  These guidelines and
+      rules are for users with respect to physical security, data
+      security, information security and content (eg. rules stating that
+      sites with sexual content should not be visited, and that
+      copyrights should be honoured when downloading software, etc).
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 28]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Server
+
+      A server is a computer system, or a set of processes on a computer
+      system providing services to clients across a network.
+
+   Shared Account
+
+      A common account is one which is shared by a group of users as
+      opposed to a normal account which is available to only one user.
+      If the account is misused, it is very difficult or impossible to
+      know which of users was responsible.
+
+   Sharing Permissions
+
+      Many computer systems allow users to share files over a network.
+      These systems invariably provide a mechanism for users to use to
+      control who has permission to read or overwrite these files.
+
+   Site
+
+      Depending on the context in which this term is used, it might
+      apply to computer systems that are grouped together by
+      geographical location, organizational jurisdiction, or network
+      addresses.  A Site typically refers to a network under a common
+      administration.
+
+   SSH (Secure Shell)
+
+      SSH provides a protocol between a client and server, allowing for
+      encrypted remote connectivity.
+
+   SSL (Secure Sockets Layer)
+
+      This protocol provides security services to otherwise insecure
+      protocols which operate over a network.  SSL is typically used by
+      web browsers to encrypt data sent to and downloaded from a server.
+
+   Systems Administrator
+
+      The individual who maintains the system and has system
+      administrator privileges. In order to avoid errors and mistakes
+      done by this individual while not acting as an administrator,
+      he/she should limit the time he/she acts as an administrator (as
+      known to the system) to a minimum.
+
+
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 29]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   System Administrator Privileges
+
+      System administrators have more rights (greater permissions) as
+      their work involve the maintenance of system files.
+
+   System Files
+
+      The set of files on a system that do not belong to end-users,
+      which govern the functionality of the system.   System files have
+      a great impact on the security of the system.
+
+   Telnet
+
+      A protocol that enables remote log in to other computer systems
+      over the network.
+
+   Terminal
+
+      A dumb device that is connected to a computer system in order to
+      provide (text-based) access to it for users and administrators.
+
+   Terms of Service (TOS)
+
+      See "Acceptable Use Policy (AUP)".
+
+   Threats
+
+      The potential that an existing vulnerability can be exploited to
+      compromise the security of systems or networks. Even if a
+      vulnerability is not known, it represents a threat by this
+      definition.
+
+   Trojan Horse
+
+      A program which carries within itself a means to allow the creator
+      of the program access to the system using it.
+
+   Virus
+
+      A program which replicates itself on computer systems by
+      incorporating itself (secretly and maliciously) into other
+      programs.  A virus can be transferred onto a computer system in a
+      variety of ways.
+
+   Virus-Detection Tool
+
+      Software that detects and possibly removes computer viruses,
+      alerting the user appropriately.
+
+
+
+Guttman, et. al.             Informational                     [Page 30]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+   Vulnerability
+
+      A vulnerability is the existence of a weakness, design, or
+      implementation error that can lead to an unexpected, undesirable
+      event compromising the security of the system, network,
+      application, or protocol involved.
+
+   Web Browser Cache
+
+      This is the part of the file system that is used to store web
+      pages and related files.  It can be utilized to reload recently
+      accessed files from the cache instead of loading it every time
+      from the network.
+
+   Web Browser Capabilities
+
+      The set of functionalities on a web browser for use by the end-
+      user.  This includes the set of plug-ins available.
+
+   Web Server
+
+      A server program that provides access to web pages.  Some web
+      servers provide access to other services, such as databases, and
+      directories.
+
+   Worm
+
+      A computer program which replicates itself and is self-
+      propogating.  Worms, as opposed to viruses, are meant to spawn in
+      network environments.
+
+Acknowledgments
+
+   The User Security Handbook was a collaborative effort of the Site
+   Security Handbook Working Group of the IETF.  There were also others
+   who made significant contributions --- Simson Garfinkle and Eric
+   Luiijf provided very helpful feedback on this document.  The Glossary
+   contribution by Klaus-Peter Kossakowski is much appreciated.
+
+References
+
+   [GLOSSARY] Malkin, G., Ed., "Internet User's Glossary", FYI 18, RFC
+              1983 August 1996.
+
+   [RFC2196]  Fraser, B., Ed., "Site Security Handbook", FYI 8, RFC 2196
+              September 1997.
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 31]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+Security Considerations
+
+   This document discusses what computer users can do to improve
+   security on their systems.
+
+Authors' Addresses
+
+   Erik Guttman
+   Sun Microsystems
+   Bahnstr. 2
+   74915 Waibstadt
+   Germany
+
+   Phone: +49 7263 911701
+   EMail: erik.guttman@sun.com
+
+
+   Lorna Leong
+   COLT Internet
+   250 City Road
+   City Forum, London
+   England
+
+   Phone: +44 171 390 3900
+   EMail: lorna@colt.net
+
+
+   Gary Malkin
+   Bay Networks
+   8 Federal Street
+   Billerca, MA 01821
+   USA
+
+   Phone: +1 508 916 4237
+   EMail: gmalkin@baynetworks.com
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 32]
+
+RFC 2504                Users' Security Handbook           February 1999
+
+
+Full Copyright Statement
+
+   Copyright (C) The Internet Society (1999).  All Rights Reserved.
+
+   This document and translations of it may be copied and furnished to
+   others, and derivative works that comment on or otherwise explain it
+   or assist in its implementation may be prepared, copied, published
+   and distributed, in whole or in part, without restriction of any
+   kind, provided that the above copyright notice and this paragraph are
+   included on all such copies and derivative works.  However, this
+   document itself may not be modified in any way, such as by removing
+   the copyright notice or references to the Internet Society or other
+   Internet organizations, except as needed for the purpose of
+   developing Internet standards in which case the procedures for
+   copyrights defined in the Internet Standards process must be
+   followed, or as required to translate it into languages other than
+   English.
+
+   The limited permissions granted above are perpetual and will not be
+   revoked by the Internet Society or its successors or assigns.
+
+   This document and the information contained herein is provided on an
+   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
+   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
+   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
+   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
+   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Guttman, et. al.             Informational                     [Page 33]
+