INTRODUCTION
Electronic, relational databases are becoming increasingly important, and as their importance grows, there is a concomitant concern about database security. As specialists in every science turn increasingly to the use of databases in their research, each field makes unique demands on the technology that underlies database development. In turn, databases provide special opportunities for every field. Systematics and, for our purposes here, systematic or taxonomic paleontology are characterized by a focus on the historical development of ideas that is unprecedented in other fields. Thus, whereas papers in high-energy physics older than ten or fifteen years are likely to be permanently shelved, and papers on Internet and intranet security have a half-life measured in weeks, paleontologists may need to refer to taxonomic literature, irrespective of its quality, back to the times of Clerck (1758) and Linnaeus (1758).
Systematic paleontologists rely on the history of taxonomic ideas, and, because of the rules of priority, the information of taxonomic paleontology must also be made widely available to enhance communication among systematists. Nothing is gained by excessive secrecy on the taxonomic front; indeed, with secrecy all is lost, including the priority of names and the ideas they represent. It is essential, therefore, that any database prepared in support of taxonomic paleontology be available for a long period of time and be readily accessible to a wide range of potential users, many of whom are likely to be unknown to the owner of the database.
Both requirements spell trouble for the security of databases. Yet security is an aspect of the preparation of databases that has received little attention from the paleontological community. Our purposes here are to present reasons for securing the information in databases and to suggest means of wending ones way through the jargon-laden jumble of security-related matters.
Paying Attention to Security
Three points form the basis of our concerns
regarding security (Figure 1). First, data have value, and this is so
even for paleontological data. Of late, our profession has
experienced some difficulty convincing others of the truth of
this notion. Nevertheless, it is true, as several examples will
make clear. (1) Petroleum companies often share geophysical data,
but they tend to play their biostratigraphical cards rather close
to the chest and typically regard such information as
proprietary. (2) Paleontologists seeking grants from funding
agencies in many instances find data from their previous studies
to be of vital importance in establishing their qualifications.
(3) The business of publishing about fossils is boomingand
here we mean not only publishing books about dinosaurswith
the result that databases with illustrations of fossils are
likely to be especially popular.
Second, anything of value is subject to theft, misuse, and, perhaps worst of all, vandalism. The threat to paleontological data is, of course, nowhere nearly so ominous as the threat to industrial, military, and financial investment data. By the same token, the impecunious paleontological community is ill-prepared fiscally to install security systems that are reliable and that provide effective security. Hackers have managed to break into the secret files of the U. S. Department of Defense, which are protected by an appreciable portion of a $200 billion annual budget. Given this fact, how vulnerable do you suppose the data of paleontology are to similar invasion?
Paleontologists develop databases either through their personal research, from the cooperative work of close colleagues, or by extensive library work and Treatise grazing. Whatever the data source, the paleontologist who develops a database has the right to the first use of those data before broadcasting them to the general public. One often hears the plea to just put it all out on the web. Such pleas too often ignore the fact that data have value and that their supporting infrastructure are sometimes quite costly as well.
Third, in spite of all these concerns, paleontologists need to share information. Data may be shared among close colleagues in the early phases of a research project or at a later stage be made generally available through the Internet. Concomitant with the need to share information is the risk to those data. At the end of the day, sharing is incompatible with security. The issue of securityboth Internet security and intranet securityis emphasized extensively by computer insiders, and a hefty literature on the subject is available. In industry, the principal concern is the access to data by unauthorized persons, especially the theft of economically or militarily valuable information. A secondary concern is vulnerability to vandalism, which can be an equally costly problem.
What is the situation in academia? Things are certainly different in paleontology from what they are in, say, the pharmaceutical or defense industry. If a colleague were to abscond with your data, whether electronically or otherwise, he would soon be found out and would no doubt suffer professional ostracism. Thus, the outright theft of data in paleontology, partly because of its low likelihood, is probably not as troubling as other aspects of the complete security picture.
Herein we compare the issues of database
security in industry, finance, and the military with the issues
facing paleontologists (Figure 2). We identify ten problems of security that
affect databases of every sort, and we propose some kinds of
solutions that paleontologists can apply to help them address
those problems.
Viewed in toto, the
essence of the problem with security for databases is to weigh
concerns about security against requirements for performance,
productivity, and accessibility (Figure 3; Hartley, 1998).
Adopting a thorough approach to security
will help defray the costs of inadequate security: lost time,
lost money, and unnecessary wear and tear on members of the
staff, thereby curtailing their productivity (Figure
4).
Security of Databases: Meanings, Advantages, and Disadvantages
What do we mean when we speak of the
security of a database (Figure 5)? Establishing a definition at the outset
is important because the definition of security that one adopts
will determine in large part the approach one takes to emplacing
appropriate measures of security.TechEncyclopedia has defined security as, "The
protection of data against unauthorized access." This is
quite a narrow definition, but we understand the reason for the
emphasis on unauthorized users. The definition is geared to the
kinds of security problems that are encountered by industry,
wherein the primary concern is access by unwelcome users. It
recognizes that persistent systems programmers and other
technically competent individuals are likely to be able to gain
access to the identification codes and passwords that protect
nearly any system, enabling ingress to an otherwise secure
database.
The special needs facing paleontologists
and their data cause us to favor a much broader definition of
security. The dictionary definition (Mish 1995, p. 1056), always a good starting place,
refers to security as "freedom from danger" or
"freedom from fear or anxiety." An appealing working
definition is that "a computer is secure if you can depend
on it and its software to behave as you expect" (Garfinkel and Spafford
1996, p. 6). This
definition ignores the problems that can result from the access
by unauthorized individuals who use, but do not destroy, your
database. Let us say that a database is secure if it can be
accessed only by authorized users and you can depend on it and
its software to behave as you expect. Dealing with this broader
definition of security has led us to identify the ten areas of
concern (Table 1).
The Downside of Security. Paranoia is stressful. It consumes energy and, where security of data systems is the issue, can devolve into a dreadful time sink. Of greater importance for our profession, excessive attention to matters of security will necessarily diminish communication to the detriment of paleontology as a whole. For this reason, although we must pay careful attention to matters of security, we must do so with an eye to our other goal, fulfilling the obligation of taxonomic paleontologists to communicate freely with each other.
The Upside of Security. The obvious advantage to having in place an effective system of security is that you and your data will be free from danger, fear, and anxiety. In addition, a very thin silver lining is that something good sometimes comes from examining and reexamining computer systems. Given the threats to databases, prudence requires a well-formulated, comprehensive, and appropriate security policy and the performance of all necessary security protocols on a daily or weekly basis. In the long run, systems designed with security in mind are more cost-effective than those that are not, especially if a major breach of security can be avoided.