Hi Richard, You can very easily include a virus into an EDI file, and is in fact a very good environment of attack since processing EDI files are automated.
Though most users treat EDI files as text files, in actuality they are binary files. Some documents such as HIPAA 275 4050 X150 have mandatory BIN segments. This link shows how a BIN segment in an EDI file is used and processed. (You have to be a programmer, though). http://www.edidev.com/prog_guide_web.htm, then run the 823 Price Catalog (with Image) program.) So an easy way of introducing a virus to your network is simply including virus files to BIN segments of an EDI file. If you are concerned, take the precaution. --- In [email protected], "Richard" <[EMAIL PROTECTED]> wrote: > > Hi all, > > We're fighting quite a battle here at my company with the InfoSec > (information security) folks and I could use some input from the group. > > The core issue is if an EDI file (X.12 format EDI document) could contain > a computer virus, trojan horse, worm, etc.? > > I say that no they can't but our InfoSec folks say "they could". Hence, > they're talking about requiring PGP encryption/decryption, SFTP/SSH > transmittals, full anti-virus scan before use, etc. > > I could see the encrypted transmittal session(s) for security sake, but > must I also pass a decrypted EDI file through an anti-virus software > checker before I can pass it on to my translator and/or before I send it > out? > > I'm curious what you've seen and/or what you're doing, especially if > you've actually had a computer virus try to piggyback onto an EDI file. > > Any comments are much appreciated. > > Richard Jones > ------------------------------------ ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/EDI-L/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/EDI-L/join (Yahoo! ID required) <*> To change settings via email: mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
