Skip to main content

security policy <--> system design <--> contents design

Last week end, I went to Tokyo for recruit activity.

After finishing everything, I met with my friend's couple. We enjoyed the time. And we went to showroom for a thing (I should not say more ^^;;;), because we had small time. Then the organization provides a terminal which introduce about their activities. I found security hall in the system, which comes from weak communication when they design the system. The system is following.

The system has only one input device, which is mouse. The system provides full screen web browser. The web browser is limited version for function.  The system has no keyboard. So, users can use only the limited web browser. And the organization uses twitter. The twitter account publishes about their activity with no link or link to inside of there contents. This meaning is that users can not exit from their contents. (usually....) If the system provides only above, then this system is completely perfect. However, the twitter's account profile links to another web site in their organization. And the page links to their facebook account. This is problem. Usually, if user publish something onto facebook and some other user push like button, then all users can go his/her personal timeline on facebook from a list what provide a users who push like button. Even if the organization did not publish any links to other site, however the system user can go out to 3rd parties' page. If the time line has malicious link then the site will have problems.

This problem comes from communication miss. (I think.) There is 4 pages. Homepage on the system, twitter, other official page, and facebook. The system designer considered about only homepage showing. Accidentally, the homepage designer needed to link to their twitter account. And, the twitter account manager was different team from the system manager team. And (maybe) the twitter manager did not know the twitter is linked from such limited system. Then the team linked other official page. Sure, the page manager clearly don't know first homepage. The team linked both of twitter and facebook account for promoting. If at least one engineer or manager knew every services then the error was not occurred.....

When I saw the site, I really felt scared. The system itself, the organization considered about security. However, the contents management can easy break the security policy, if they don't have security concern.......

(maybe) I will write mail to them about this problem.......If I have time and stamina  ^^;;;;;
Labels:

Comments

Post a Comment

Popular posts from this blog

gDisk 0.6.1

Today, I try to use new gDisk version 0.6.1. Before version, I cannot see what files are on the server side. But current version I could do it. I think it is better than before version and it began to useful for backup software. But it has one problem.... When I uploaded more than 10 files at same time, it was clash down. I try to do it at 2-3 times but result was same..... I think it is one of the bag or the documents said about it (Actuary I read no document about it for this version)
Post a Comment
Read more

Bicycle insurance in japan

Long time, I was considering about bicycle insurance. Many japanese are not consider about insurance for bicycle in japan. Because japan is weak country for insurance. Many people considered about when they are attacked by car. They didn't have an idea what they may be going to be individual at fault. However, road bikes are faster than my MTB. And, many of city bikes do not turn on a head light after sunset. The old person has also no idea what the bicycles can ride so fast as 50cc motar bike. Then they easy enter in front of bicycles. Such kind of accident is not few in japan. And, the worst case of such accident, the road bike rider needed to pay 40 millions yen to attacked person. Bicycle ride's bad manner have begun to social issues. Some bicycle riders do not follow the traffic lights or traffic signs. In such background, sometime, I have risks what I will be attacked by such bicycle riders when I ride my MTB. However, as above reason, many riders have no insurance
11 comments
Read more

SSID in japanese?

Usually, we don't use japanese for setting to computer. Because, japaese needs at least two byte. Usually, many computer systems are designed for one byte. So, to use japanese in the system setting was not common way. If he is usual engineer then he will not set japanese for the setting to SSID. I was not do such a thing. Today, i read a tweet written by my friend. He wrote that he could see the japanese ssid from his house. I was really  suprized when i read it. So, I asked prof. Google about this ssid expression in japanese. So, it is  exist. Now, I had no wireless devces for trying it. But,it is so intersting thing for me.
2 comments
Read more