NCJ Number
36104
Date Published
1976
Length
108 pages
Annotation
THIS REPORT OFFERS ALTERNATIVE SOLUTIONS TO SECURITY, ACCURACY, AND PRIVACY QUESTIONS AND POINTS OUT THE POSSIBLE IMPLICATIONS OF EMPLOYING SPECIFIC PREVENTION MEASURES.
Abstract
IT ALSO SHOWS HOW THERE CAN BE AN ORDERLY AND DISCIPLINED EVOLUTION OF THESE MEASURES CONSISTENT WITH SYSTEM NEEDS AT ANY GIVEN POINT IN TIME. A MODEL SYSTEM IS CONSTRUCTED FROM THE FUNCTIONAL EFT SYSTEM COMPONENTS AND THE TYPICAL TRANSACTION MESSAGE IS DIVIDED INTO ITS BASIC ELEMENTS. EACH MESSAGE ELEMENT IS THEN ANALYZED AT EACH FUNCTIONAL POINT IN TERMS OF SAFEGUARDS NEEDED FOR EACH OF MANY FRAUD SCENARIOS. THE RESULTS SHOWING WHICH DATA ELEMENTS SHOULD HAVE THEIR MEANING CONCEALED FROM POTENTIAL EAVESDROPPERS AND WHICH ONES SHOULD BE PROTECTED FROM ALTERATION WERE THEN USED AS BOUNDARY CONDITIONS IN THE INVESTIGATION OF SECURITY, ACCURACY, AND PRIVACY REQUIREMENTS BEING PLANNED. THE BASIC FINDINGS OF THIS APPROACH ARE THAT NEW FRAUD PREVENTION STANDARDS ARE NEEDED IN EVERY AREA, A UNIQUE COUNTERFEIT PROOF CODE GENERATED AT THE TERMINAL OR TERMINAL CONTROLLER SHOULD BE ATTRACTED TO ALL MESSAGES RELATING TO A SPECIFIC TRANSACTION, AND THAT SPECIFIC DATA ELEMENTS SHOULD BE SELECTED FOR CONCEALMENT AND PROTECTION AGAINST ALTERATION. IN ADDITION, IT WAS FOUND THAT PROCEDURES FOR CONTROLLING PREVENTION SECURITY, FRAUD DETECTION, AND AUDIT TRAILS SHOULD BE SEPARATE FROM THE NORMAL SYSTEM PROCESSING FUNCTION AND THAT FALLBACK FROM ON-HOST OPERATION SHOULD BE A PLANNED SYSTEM FUNCTION RATHER THAN A SPONTANEOUS REACTION TO IMMEDIATE REQUIREMENTS. A DISCUSSION ON THE USE OF CIPHERS TO CONCEAL DATA AND GENERATE CODES IS APPENDED. (AUTHOR ABSTRACT MODIFIED)