The World Bank InfoDev Program has set itself a goal of helping computer
users in developing countries avoid security problems. To that end, it has
published the
Information
Technology Security Handbook; it can be downloaded from the site in PDF
format. It is a very introductory-level book on security threats to
computers and their users; if users at that level can be convinced to read
the whole thing, it may well do some good. Unfortunately, however, this
book does the developing world a disservice by being strongly biased toward
proprietary software.
The "Security for Individuals" section, for example, contains a couple of
pages on "non-traditional and non-commercial software." Topics covered
are, in this order, shareware, open source software, and pirated software.
The open source discussion gives a brief overview of the "which is more
secure?" debate, and informs us:
The update processes for Open Source products tend to be more
difficult that [sic] those for Windows, but are in line with other
Unix products and the installation procedures for the original Open
Source products.
The fact of the matter, of course, is that the major distributors have all
made the application of security updates into a trivially easy task, which
can even be automated. The above statement might have been true
some years ago; it certainly is not true now.
The discussion of free software pretty much ends there. So, for example,
we get a long
section on email problems; infection via email is said to be "highly
likely." Six rules are given for protecting a system from email-borne
malware ("Do not open an attachment from someone you do know
and trust unless you are sure that they sent it deliberately
"), but
there is no mention of the fact that email-borne malware is, for all
practical purposes, unknown outside of the Windows world.
The "security for organizations" chapter is written in an entirely
different voice. It covers a wide range of topics, including regulatory
compliance, wireless security, personnel threats, etc. There is a lot of
useful material there for somebody who is beginning to think about security
in an organizational context, but no specifics at all. There is a section
on government policy which has mostly to do with bureaucratic organization
and the crafting of security-related legislation.
The final and largest section is aimed at technical administrators.
Interestingly, this section is mostly oriented around Unix and Unix-like
systems. The coverage is strange, however; NIS netgroups warrant several
pages, while PAM is breezed over in a single page. There is a long section
full of rules on writing safe CGI scripts, but nothing about web server
setup. The chapter contains some good stuff, but it looks like it was
gathered together from several different sources.
This handbook looks like a useful resource in many ways. It falls short of
what a book on security for the developing world could be, however. Like
the rich world, the developing world has no need to rely on expensive and
insecure proprietary software. A book on information security on
developing countries really owes it to its readers to point out that, with
free software, they can take greater control over their systems and not
have to rely on the good intentions of a large, foreign company.
Comments (1 posted)
