Security management of spyware via the authentication of web communication

A continuing Internet information management challenge is the significant prevalence of software that aids in collecting and transmitting information about a person or organization without the information-owner’s consent. This software is popularly known as spyware. The Internet users’ perception is that spyware – like virus infections - should be legislatively outlawed and operationally eradicated. However, whilst virus infections are designed to damage a targeted computer or network – clearly a criminal act – the distribution of spyware is mainly a commercial venture. It is from this fundamental point that spyware control strategies have become problematic. Legislators have even struggled to specifically define spyware. Within this uncertainty, however, the existing spyware research has established three clear premises. Firstly, spyware is proliferating at a significant rate across the Internet. Secondly, spyware produces several security risks – including privacy breaches and identity theft. Thirdly, anti-spyware controls in the areas of legislation, policy, and technology have experienced many hurdles and are still considered problematic for several significant reasons. The spyware research described within this paper has proceeded via a factor and gap analysis of the four major dimensions of spyware control: (1) anti-spyware legislative efforts in the U.S; (2) code signing initiatives that are designed to introduce trust into the use of mobile code; (3) filtering software (e.g. firewalls and proxies), and (4) hybrid solutions. The major result of this research is an information security management framework that strengthens the technological control of spyware. This security management framework, at its core, requires the authentication of each outgoing Web session from each specific software application. The framework facilitates the user-management of all Web communication streams emanating from the host and this in turn must support the better identification of software that engages in the deceptive, misleading, and fraudulent practices already proscribed in existing technology-focused legislation.