Availability and Security

• Overview
• Security Capabilities
  Physical Security
  Trustworthiness
  Fault Tolerance
  
• Future Security Features

Overview of Availability and Security

How does availability and general environmental security differ from the basic GWD features?

Availability and general environmental security are properties which differ from other features due to the fact that the administrative features are features within the GWD and affect the collaborative functions of the Global Web Developer as a Web development tool. The level of availability and general security are partly functions of cost.

Availability refers to the percentage of time an application is up and running. High availability would be expected for GWD in optimal conditions. Downtimes are not expected unless they are scheduled, as fo upgrades and general maintenance, or are due to non-GWD related factors such as power failures. However, as databases grow and traffic congestion increases, hardware and equipment variables may hinder the availability of GWD. Availability can also vary depending on the organization. For example, many smaller government-affiliated organizations in Japan keep their websites online only during Japanese business hours to limit their use of electricity and communication lines. For an organization to minimize utility costs, the public server portion of GWD can be de-coupled from the development portion to allow organizations to keep the public server up and turn off select development servers during times when web development is not taking place.

 

Environmental Security refers to the reliable operation of the system and protection of confidential information in the face of malicious behavior. This is also an area dependent on the organization weighing the value of the collaborative information and cost required for security. The GWD features do not address these environmental security concerns because they are not directly involved with web development. These cost-varying security measures may include, but are not limited to, creating backups for the complete databases, hiring reliable network security operators, or using an extensive authentication system based on digital certificates.

Another environmental security concern outside of the scope of GWD depends on the security of the different web browsers and email applications used in conjunction with GWD. Security of these application and GWD is determined by their respective levels of security protection. Therefore, the security of the browsers and email applications will be dependent on their respective application distributors as well as the internal administration maintaining these applications.

 

top

Important Security Capabilities

Physical Security

Access Control refers to the conditional access of users depending on their group affiliation and their status as a website developer. This requires a secure GWD user database with the user authentication password and the information pertaining to the permissions of the user. In GWD, access control differentiates users of a particular website in terms of a having quality authority for publicizing documents, having the ability to edit and create webpages within the given website group, and having the right to read and annotate without the ability to edit. The intranet portion of GWD will be maintained by firewalls.

GWD Administration refers to the protocol for a particular user or two who is responsible for maintaining the different websites, work groups, and users. These people have an enormous responsibility because they have the power to change accessibility information and have direct access to sensitive password information.

Quality Authorization refers to the protocol where a particular user has the authority to do a final check before a webpage, developed under GWD is placed on a public domain. This is a security measure to verify that a webpage meets the website's stylistic criteras as well as fulfill the organization's expectation.

 

Trustworthiness

Authentication refers to the verification of user identity and will be based on the use of passwords. For security purposes, two separate databases have been created for different types of users. One type of user is the general Web-browsing public and the second is the developing users who will utilize the GWD application.

Tighter security measures are taken for the GWD users database as this database includes information pertaining to access privileges. In the case of the GWD user authentication, a double barrier will be implemented where a group identity will be required as a password along with the personal password.

 

Confidentiality in the context of the GWD relies heavily to the group-based restrictions given to the collaborative authoring groups to maintain confidentiality. Users not among a specific group should not have access to read or write on the given unless agreed upon by the other group members. Encryption is used to maintain the confidential nature across the Internet.

Data Integrity refers to the accurate representation of data insuring that the data has not been modified since its last intentional modification. Although high integrity is important for editting and creating the Web documents, from the point of collaborative authoring, integrity in annotation is one of the more important.

Non-repudication refers to the inability to deny an act that had taken place. In GWD non-repudiation is maintained by automatically dating and noting the user annotation flags as well as keeping a user log with information pertaining to labor tracking.

 

Fault Tolerance

Data Replication refers to keeping replicated copies of data in the case that data is lost. The most obvious form of data replication is the backup feature. A form of data replication is used in the version control feature and the feature on replication-reconciliation which creates a copy of a document for editing.

Data Persistence refers to data outliving the program creating it. This concept can be loosely applied to the version control feature. The version control feature creates an archive of a particular website and depending on circumstances an older version is brought back and implemented.

 

top

Future Security Features

Digital certificates and secret keys are features that are not be implemented in GWD at this time.

These security features are essential if the information exchange involves sensitive, personal, or financial information. Because GWD is focused on collaborative Web development, GWD inherently includes many features allowing user interaction and provides an environment for checks and balance.

In general, for Web development collaborations, the above authentication and message integrity protocols will be sufficient. However, if an organization feels the need for these extra security, GWD will be able to accomodate applications offering certificate authentication systems as well as applications for secret key-related encryption/decryption geared toward group users. GWD will remain open to incorporating digital certificates in the authentication procedure as their usage become more widely spread and accepted.

top

[Milestone 5 Home]