security and the Computer Emergency Response Team

People who manage, administer, and support networks of computers know the trade-off between security and usability: The more secure a system becomes, the more difficult it is for your users to do certain things. The trick is to establish a reasonable level of internal security and still provide an appropriate level of service.

If your network is connected to any outside networks--for example, to the Internet through AlterNet or the NSFNet--you'll want to have a pretty solid security wall between your network and the outside world.

This article is about how to get and share information on known security vulnerabilities. Part of good security involves keeping up to date on what others in the larger community have found.

obtaining information through CERT
InDecember 1988, as part of its response to the Internet Worm, DARPA formed the Computer Emergency Response Team, also known as CERT. Based at the Software Engineering Institute at Carnegie-Mellon University, CERT is charged with "addressing computer security concerns of research users of the Internet. . . ."

CERT acts as a clearinghouse for nonclassified security-related information. The team works with the Internet user community and the many vendors of equipment in use on the Internet to collect, coordinate, and disseminate information relating to perceived and actual threats to the security of the Internet.

NeXT works closely with CERT, informing them of vulnerabilities we've discovered, responding to concerns our customers have raised, and coordinating the dissemination of information about NeXT-related vulnerabilities.

reporting a vulnerability
If you find what you think is a security hole, feel free to contact CERT or NeXT. The best way to do this is by sending electronic mail both to CERT and NeXT. If you think your information is extremely sensitive and shouldn't be sent by e-mail, just say that in your mail message, and we'll arrange for an appropriately secure transfer.

You can reach CERT by telephone at 412-268-7090 and by e-mail at cert@cert.org.

You can reach NeXT Technical Support using normal support channels or, if you prefer, at the e-mail address security_info@NeXT.COM. Please do not send security-related information to bug_next, even if you think the problem is a bug. Rather, use ask_next or security_info.

getting on CERT's mailing list
CERT maintains a distribution list for information on reported vulnerabilities. As the need arises, they publish advisories to this list. If you're interested in network security, e-mail certadvisory-request@cert.org and ask CERT to add you to their "CERT Advisory" distribution list. The advisories include information about many different vendors' systems and about general threats.

In addition to CERT's publication, information regarding NeXT-specific issues is typically published in a Technical Alert or in the support bulletin.