acker 10 minutes to spoof an e-mail (send an e-mail with a false sender). E-mail is used extensively today for business communication, although it uses plain text messages that almost anyone can read and/or manipulate. This vulner- ability makes it an untrusted network, which must be borne in mind when planning for services directed to the public. Untrusted means that it is fairly easy to wiretap and/or alter information. Web services offer another type of mobility: service mobility. When applications are composed by service elements from many sources, a reliable authentication and autho- rization of the sources is crucial. Turning to the crimes, it seems there are Internet users for which bypassing security barriers, either for fraud, sabotage or pure fun purposes, is a reason of proud and increased self-esteem (hackers' phenomenon). Violating security systems has become more a chal- lenge than an action that is socially condemned. Obviously there are also people using the Internet for child pornography and extrem- ist propaganda. The overall cost for Internet criminality is hard or even impossible to calculate. What was the cost of Sobig F? Klez? Love bug? We are talking about millions of infected computers and billions of US dollars per virus. A hacker can invest a year in development and launching a specific virus attack. The conclusion is that a cloud of uncertainty and threat will remain for a long time over Internet-based communication. In a way it is a race between development of security enablers and security 'disablers'. Security is one of the fastest growing IT areas, measured in annual investments. 6.3.2 CONFIDENTIALITY AND AUTHORIZATION PROBLEMS AND INTRUSION Figure 6.3 shows an example of a case where we have problems with confidentiality. Eve, the intruder, is in this case a passive intruder. She just listens or records the communication between Alice and Bob. Reading other people's e-mail is an example of Eve (Intruder) Alice Figure 6.3 Eve has unauthorized access to the communication between Alic