In theory, if the data is coming from a Windows platform, the server could have been hijacked and the document could contain commands that would invoke a virus.
________________________________ From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of Shawn Aker Sent: Monday, July 14, 2008 4:19 PM To: Hurd, Richard [SLCUS] Cc: [EMAIL PROTECTED]; [email protected] Subject: Re: [EDI-L] Has anyone seen a virus in an EDI file? Oh, it's not time. It's billable hours. :) Shawn On Mon, Jul 14, 2008 at 1:01 PM, Hurd, Richard [SLCUS] <[EMAIL PROTECTED] <mailto:rhurd3%40cscus.jnj.com> > wrote: > Unless you're sending and storing binary objects, that's the most > ridiculous thing I ever heard. > > EDI is textual information and needs to run through a translator. I sure > don't see how a virus/trojan/etc. can make it through the transformational > steps. > > Can you get some sort of certification from your EDI translator vendor that > they don't execute the code, they only translate it? > > Can you also get certification from your VAN that your connection is > secured? > > I would sure push the burden of this up to your service providers. > > Sheesh. Talk about an infosec group with Too Much Time On Their Hands. > > > -----Original Message----- > From: [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com> [mailto: > [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com>]On Behalf Of > Richard > Sent: Monday, July 14, 2008 3:49 PM > To: [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com> > Subject: [EDI-L] Has anyone seen a virus in an EDI file? > > Hi all, > > We're fighting quite a battle here at my company with the InfoSec > (information security) folks and I could use some input from the group. > > The core issue is if an EDI file (X.12 format EDI document) could contain > a computer virus, trojan horse, worm, etc.? > > I say that no they can't but our InfoSec folks say "they could". Hence, > they're talking about requiring PGP encryption/decryption, SFTP/SSH > transmittals, full anti-virus scan before use, etc. > > I could see the encrypted transmittal session(s) for security sake, but > must I also pass a decrypted EDI file through an anti-virus software > checker before I can pass it on to my translator and/or before I send it > out? > > I'm curious what you've seen and/or what you're doing, especially if > you've actually had a computer virus try to piggyback onto an EDI file. > > Any comments are much appreciated. > > Richard Jones > > ------------------------------------ > > ... > Please use the following Message Identifiers as your subject prefix: > <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> > > Job postings are welcome, but for job postings or requests for work: <JOBS> > IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links > > > [Non-text portions of this message have been removed] This message contains information proprietary to our company. It is intended to be read only by the individual or entity named above or their designee. Any distribution of this message or the information contained herein without written permission from our company is strictly prohibited. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail, and delete the original message. [Non-text portions of this message have been removed] ------------------------------------ ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/EDI-L/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/EDI-L/join (Yahoo! ID required) <*> To change settings via email: mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
