Kent - If those people are hesitant to use ADSM for security reasons, they
       should be fearful in general of using their networks, as I'm sure
they are already sending passwords and sensitive data over those networks.
You didn't say what kind of networking is involved, but if it's Ethernet,
I would suggest implementing Switched Ethernet technology - which in
addition to sending only a single destination's packets over that leg of
the network can also scramble the data (and greatly improve performance).
There are numerous technologies to address these issues in networking.
    All of this is to say that ADSM is not the issue: the networking is,
as the conduit for the data from all manner of protocols and applications.
             Richard Sims, Boston University OIT

______________________________ Reply Separator _________________________________
Subject: (Fwd) ADSM data security
Author:  ADSM-L (ADSM-L AT VM.MARIST DOT EDU) at unix,mime
Date:    6/19/97 1:16 PM


We have some people at our university who are hesitant to use ADSM because of
security reasons.  I believe that they are concerned of the possiblity that
ethically-challenged people may sniff networks, intercept the backup data,
and recreate files containing sensitive data.

My response to this concern is the following.

1) I presume that file data and ADSM specific data is packed into an ADSM
non-public domain protocol.  So, anybody sniffing would have to understand
and/or re-engineer this protocol.

2) We force the client to compress the data, so no clear text is transferred
on the network.  So, anyone trying to intercept that data would have to
collect complete data transmissions, understand the protocol, and uncompress
the files, in order to gain access to any sensitive data.

o Is there an official response addressing security of ADSM data on the
network?
o Are there any stronger arguments showing that security is not a concern?
o What are valid concerns for security exposure of ADSM data?

Responses anyone?

Kent

--
Kent Johnson                        Internet: johnsk6 AT rpi DOT edu
Kent Johnson                        Internet: johnsk6 AT rpi DOT edu
Unix Systems Programmer (VCC 323)      Phone: (518) 276-8175
Rensselaer Polytechnic Institute         Fax: (518) 276-2809