Secure Hardware Support

On the other hand, one must take care that the complete computation is done on these devices. For instance, if the devices have no keyboard and display, like current smartcards, and all the inputs and outputs are transmitted through a device under someone else s control, like a point-of-sale terminal, the signer has no control 

Most people will need a device not only for computations, but even to store some secret data that they would otherwise have to remember and most of the remaining people with a very good memory may not want to type so much data into the device for each signature. In this case, even a correct and helpful device becomes dangerous if it is lost or stolen or, e.g., with a normal size personal computer, if someone else simply gains access to it. One must therefore try to safeguard it against two kinds of attacks. 

The second kind of attack is that thieves can try to extract the secrets fi om the device by other means. (Accidental finders are not likely to do so.) They are successful if they find either the password, with the device still intact, or the secret data for signing, without the device. Devices like smartcards are constructed with some measures for tamper-resistance, but their effectiveness is not clear, at least against attackers with access to a laboratory. 

---

LIMS as rented service— The application service provision provider (ASP) is a means of obtaining access to software applications without the need to acquire expensive licenses and hardware or employ high-cost support resources [7]. The application is hosted on a third-party site with system maintenance, backup, and recovery provided by a third party. Products and services can be rented for a contract period on a fixed cost per user/per month basis. The advantages of obtaining LIMS in this fashion include reduced cost in initial investment and reduced requirement of resources for maintaining the LIMS. The continued security and integrity of the data transferred over the Internet is a major concern for this type of LIMS. 

The requirements for hardware validation are identical to those of any other equipment in use, comprising the OQ/IQ/PQ cycle, except that in the PQ, it is the test of software used. The software validation comprises functional testing, in which defined inputs produce outputs that meet expectations or specifications a thorough examination of source codes, database designs, programming standards, control methods, and support documentation or a quality-assurance program that includes alternate plans, contingency practices, record retrieval, and security practices... 

Procedures and plans supporting business continuity (Disaster Recovery Plans and Contingency Plans) must be specified, tested, and approved before the system is approved for use. Business Continuity Plans will normally be prepared for a business or an operational area rather than for individual computer systems. It is likely that the only way to verify the plan is to walk through a variety of disaster scenarios. Topics for consideration should include catastrophic hardware and software failures, fire/flood/lightning strikes, and security breaches. Alternative means of operation must be available in case of failure if critical data is required at short notice (e.g., in case of drug product recalls). Reference to verification of the Business Continuity Plans is appropriate during OQ/PQ. 

Procedures and plans supporting business continuity must be specified, tested, and approved before the system is approved for use. Topics for consideration should include catastrophic hardware and software failures, fire/flood/lightning strikes, and security breaches. Procedures need to address ... 

The server-based model is better than the peer-to-peer model for large networks (say 25 users or more) that need a more secure environment and centralized control. Server-based networks use a dedicated, centralized server. All administrative functions and resource sharing are performed from this point. This makes it easier to share resources, perform backups, and support an almost unlimited number of users. It also offers better security. However, it does need more hardware than that used by the typical workstation/server computer in a peer-to-peer resource model. Additionally, it requires specialized software (the NOS) to... 

A. Support for large files or complex programs was the specialty of Windows NT, and its mantle has now been passed to Windows 2000. These operating systems are designed to support more and faster hardware and to provide greater stability and security. 

All existing Network Access Control architectures include a NAC software agent at the client, policy and authority servers to handle policy and posture validation, and enforcers to grant or deny access to the network. However, TNC has higher interoperability since it is an open architecture and it provides better security with its support for trusted hardware. 

The activities associated with data curation include storing them while we are using them as well as when we are finished with them. The data should be stored on a secure server rather than on a flash drive and should also be described or documented [10]. This description is called metadata and includes components such as title of the research, creator, language, dates, and file formats. The provenance of this data must also be established by appropriate instruments and research methods to produce the data. The purpose of these activities is to add clarity and supportive information to our data so that these can be interpreted by others. If others are using the data, they should be able to identify these for the purpose of citation, for example. Finally, to ensure that the data survive, it is important to archive the related software and hardware in secure repositories. Some repositories can be general, while others are subject based [11]. 

On the other hand, Security Usability according to [5] deals with how security information should be handled in the UI. Both usability and security can vary depending on the context of use that includes user profiles (i.e., who are the users), task characteristics, hardware (including network equipment), software, and physical or organizational environments [6], Usability is imperative from the user s perspective (e.g., complete a task correctly without errors that could result in a security problem), from the developer s perspective (e.g., success or breakdown of a system), and from management s perspective (e.g., software with weak security support can be a major constraint to the usability of the system). 

---