I've actually had a similar discussion with our SOX auditors. The question can be also interpreted as not so much *can* it be included, but what is the risk and how many layers does this have to get through to be effective?
In the example given, unless you use generic envelopes (which I don't use any more), a hacker would have to create the enveloping, numbering, etc. of a known customer in order to get to the point where the translator would be dealing with the BIN segment. Our auditors decided that the number of layers involved were so many that the risk was so low as to be almost non-existent. Just my .02, your mileage may vary. Charlotte ________________________________ From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of rh.edidev Sent: Monday, July 14, 2008 7:03 PM To: [email protected] Subject: [EDI-L] Re: Has anyone seen a virus in an EDI file? Hi Richard, You can very easily include a virus into an EDI file, and is in fact a very good environment of attack since processing EDI files are automated. Though most users treat EDI files as text files, in actuality they are binary files. Some documents such as HIPAA 275 4050 X150 have mandatory BIN segments. This link shows how a BIN segment in an EDI file is used and processed. (You have to be a programmer, though). http://www.edidev.com/prog_guide_web.htm, <http://www.edidev.com/prog_guide_web.htm,> then run the 823 Price Catalog (with Image) program.) So an easy way of introducing a virus to your network is simply including virus files to BIN segments of an EDI file. If you are concerned, take the precaution. --- In [email protected] <mailto:EDI-L%40yahoogroups.com> , "Richard" <[EMAIL PROTECTED]> wrote: > > Hi all, > > We're fighting quite a battle here at my company with the InfoSec > (information security) folks and I could use some input from the group. > > The core issue is if an EDI file (X.12 format EDI document) could contain > a computer virus, trojan horse, worm, etc.? > > I say that no they can't but our InfoSec folks say "they could". Hence, > they're talking about requiring PGP encryption/decryption, SFTP/SSH > transmittals, full anti-virus scan before use, etc. > > I could see the encrypted transmittal session(s) for security sake, but > must I also pass a decrypted EDI file through an anti-virus software > checker before I can pass it on to my translator and/or before I send it > out? > > I'm curious what you've seen and/or what you're doing, especially if > you've actually had a computer virus try to piggyback onto an EDI file. > > Any comments are much appreciated. > > Richard Jones > [Non-text portions of this message have been removed] ------------------------------------ ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/EDI-L/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/EDI-L/join (Yahoo! ID required) <*> To change settings via email: mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
