Information Security News: Human genome data in hacker peril shocker

[InfoSec News <isn () C4I ORG>]

http://www.theregister.co.uk/content/4/15675.html

By: John Leyden
Posted: 22/12/2000 at 16:24 GMT

As if the attacks by crackers on credit card databases and even
Microsoft's internal network wasn't bad enough, a firm of ebusiness
integrators has outlined security holes on sites containing genetic
research.

A report issued by BioExchange.com suggests there is lax security at
the half-dozen online genomics companies who provide commercial-grade
research tools and proprietary data sources for the biotechnology
industry.

This might seem like pretty esoteric stuff but BioExchange.com
believes the issue is important because other companies want to
analyze and store personal genomic information for research and
health.

This means data that would point to disease or inherited disorder of
patients and participants in drug trials would be held online -
raising obvious security and privacy issues

BioExchange.com analysed the current online genomics services and
judged the state of their security based upon use of (Secure Socket
Layer) SSL encryption, password protection, and the sensitivity of
information that is transferred via direct e-mail mechanisms.

According to the study, none of the sites reviewed, including those of
Caldera Genomics which is a prime mover behind the Human Genome
project, support encrypted email and easily guessed passwords could be
used. That's it really - no firewall misconfigurations, unpatched
operating system problems or even a Microsoft Internet Information
Server problem in sight.

So why the fuss? Well BioExchange.com is in the electronic marketplace
business so it has a pretty obvious interest in talking up its ability
to provide a secure environment for the exchange of this kind of data.
Leaving aside the hype surrounding electronic marketplaces, we can't
help but wonder if BioExchange.com has scored an own goal by
antagonising the very companies it wants to supply services to, in
particular it might have a hard job selling to Celera, which it
singles out for particular criticism.

BioExchange.com said: "There is no working encryption on the entirety
of the Celera web site, where genomic information is proxied to their
terraflop supercomputers containing their proprietary databases of the
Human Genome."

However when we tried this we found that we had to make a connection
to celera.com through a secure SSL connection, so either the site has
been updated or BioExchange got it wrong.

[http://www.bioexchange.com ]

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".