Chris Bartram writes:

> Whereas a phone line makes you vulnerable to a (limited area of) phone
>  hackers, few of them will dial long distance to try to break into a system
>  anymore (some yes, but most no). OTOH, an Internet connection is the
>  equivalent of a local phone call from every hacker/miscreant on earth; 24
>  hours a day, 365 days a year.
>
>  While it's pretty easy to trace an incoming caller on a modem (REAL easy if
>  you have callerid on the line) vanilla 3000-security won't help you a lick
>  for Internet-connected villians. What good are 200 lines of "invalid
> password
>  for MANAGER.SYS on ldev#66" when you get back in the next day (if you even
>  see them). First and foremost, add an option logon script that records the
>  source IP address of ALL incoming connections. I have examples if anyone is
>  interested, but it's pretty easy with the new environment variables on 5.5.

Let me stand by my original statement: I still don't see a great deal of
difference in vulnerability or threat posed to a production HP3000 between a
modem connected to the switched telephone network and a internet-based telnet
connection.

Indeed, you could profitably argue that you actually have higher security
capabilities with telnet than you do with the switched network (Chris began to
outline some of the advantages in his posting).

Any vulnerabilities that you face with telnet can be easily duplicated over
the switched network. Phone phreaking allows anyone to call from anywhere,
without incurring charges (as an aside, phone phreaking was Steve Jobs' sole
"occupation" before he teamed up with Steve Wozniak to create Apple). Further,
callerid is no protection. In reaction to the sensitivities of AIDS patients
and others, before callerid was implemented nationwide, it was made mandatory
that each individual subscriber have the right to request that their phone
numbers not be transmitted by callerid. Any reasonable hacker would certainly
request that option.

Using the simple security options of establishing an account, group and user
passwords for every account, group, and user still provides a great deal of
security, especially to someone completely outside your organization.

Further, with telnet-like access attempts, there is the possibility to simply
begin rejecting all incoming packets from any particular address (forged or
not) should the number of logon attempts surpass a preset number in a specific
amount of time. Although this capability doesn't currently exist in the
HP3000, it could. That capability could never be easily put into a modem-based
connection.

Wirt Atmar