* More security implications of external links
Last time, I mentioned a friend’s problem at his university, where all links to outside Web sites are forbidden. I pointed out that there is generally no technical vulnerability caused by simple links. However, a more serious issue is the possibility that someone will create a link from an official Web site (read: stuffy, reserved, decent) to an informal Web site (read: exciting, expansive, pornographic).
I recall one security case I worked on back in the 1990s in which a system administrator for a law firm had placed a link from the official home page of the firm’s Web site to his or her personal Web site; I say “his or her” because this person (“Jules”) was male on Mondays, Wednesdays and Fridays and female (“Julie”) on Tuesdays and Thursdays (I am not making this up). I am not criticizing the administrator’s personal lifestyle, but I do understand the law firm’s partners’ concern when they realized that their home page was exactly two clicks away from quite a number of, shall we say, vivid Web sites about transvestism and transgenderism.
I think there is a straightforward method for insulating the university from the personal values of individual faculty members without having to forbid all links to personal Web pages. Many Web sites, especially government sites, have automatic disclaimer pages that flash an announcement when one clicks on a hyperlink that points outside the site.
For example, on the National Institutes of Standards and Technology (NIST) site, there’s a list of links to academic institutions at: https://csrc.nist.gov/csrc/academic.html
The first link happens to be for George Mason University’s Center for Security Information Systems, whose URL is http://csis.gmu.edu
However, the link is embedded in another link as follows:
https://www.nist.gov/cgi-bin/exit_nist.cgi?url=https://csis.gmu.edu
That link goes to a page that includes the following text:
“Thank you for visiting. We hope your visit was informative and enjoyable.
“We have provided a link to this site because it has information that may be of interest to our users. NIST does not necessarily endorse the views expressed or the facts presented on this site. Further, NIST does not endorse any commercial products that may be advertised or available on this site.
“Click on the following link to go to: http://csis.gmu.edu (or you will be taken there in 15 seconds)”
I think that this approach pretty well insulates the NIST site from the outside links, and I think that the same method can be used to insulate my friend’s university from any problems resulting from their faculty members’ personal proclivities as expressed on their Web sites.
