Hello,
--- In [email protected], "Richard" <[EMAIL PROTECTED]> wrote:
> We're fighting quite a battle here at my company with the InfoSec
> (information security) folks and I could use some input from
> the group.
I know this battle quite well. There is huge barrier of
missunderstanding between both groups. Especially Malware scanning is
a best bractise of InfoSec groups which is highly doubtfull but
seldomly questioned since buying scanner software is so easy.
> The core issue is if an EDI file (X.12 format EDI document) could
contain
> a computer virus, trojan horse, worm, etc.?
They cannot (and if they do, a malware scanner would not recognize the
EDI encoding of binaries). However the files can contain malware and
not be valid EDI or XML Data. In this case they would trigger a
conversion error and lay around on a archive.
> I say that no they can't but our InfoSec folks say "they could". Hence,
> they're talking about requiring PGP encryption/decryption, SFTP/SSH
> transmittals, full anti-virus scan before use, etc.
Anti Virus scans (on Demand) can be integrated quite easyly in a EDI
processing chain, so you should cosider to give in if your InfoSec
folks dont follow allong: another option is to describe them that EDI
translators will verify the content and error out on Viruses. You just
need to define a policy which curantees that the few EDI operators who
can access the File spool are educated about malware and know how to
handle those files.
NOTE: as soon as you also route or forward application specific files,
the risk of active content gets bigger and bigger. For example
engineering Data might not only contain CAD drawings.
One Big Warning: do not never ever use On-Access Scanners on
production EDI Servers - neither Application Servers nor Database.
This is prone to performance problems and stability disasters. The
rate of false positives is very high.
> I could see the encrypted transmittal session(s) for security sake,
Actually this is a good thing to do, but it depends highly on your
partners. And it will introduce a lot of additional work. EDI
scenarios are typically quite "optimistic" for the possible savings
which comes with this risk.
> but
> must I also pass a decrypted EDI file through an anti-virus software
> checker before I can pass it on to my translator and/or before I send it
> out?
Personally I think this is not a question of facts. It will be just a
question of negotiation and power between EDI group and InfoSec. (And
sorry that is not the answer you wanted to hear :)
EDI Servers are usually a highly controlled environment. If InfoSec
agrees on that Exceptions can be made. Otherwise they will enforce
their rules - which is in itself somewhat useful to them because
standardizations reduces the amount of exceptions you have to manage.
You need to see both sides, and the fact if Virus can be contained in
EDI data or not is just a minor point.
Greetings
Bernd
------------------------------------
...
Please use the following Message Identifiers as your subject prefix: <SALES>,
<JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC>
Job postings are welcome, but for job postings or requests for work: <JOBS> IS
REQUIRED in the subject line as a prefix.Yahoo! Groups Links
<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/EDI-L/
<*> Your email settings:
Individual Email | Traditional
<*> To change settings online go to:
http://groups.yahoo.com/group/EDI-L/join
(Yahoo! ID required)
<*> To change settings via email:
mailto:[EMAIL PROTECTED]
mailto:[EMAIL PROTECTED]
<*> To unsubscribe from this group, send an email to:
[EMAIL PROTECTED]
<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
