You don’t want to read this column.  You would probably rather buy life insurance or visit the dentist for a checkup than read about Computer Security.  Unfortunately, lack of knowledge about security does not protect you from technology threats any more than procrastinating about the dentist protects you from cavities.

What is computer security?

Computer security means ensuring that your business’ data, networks, and hardware are used the way you intended them to be used.  Under this definition, an employee cruising the Internet during business hours is as much a security violation as a hacker stealing your customers’ bank accounts.

In an ideal secure environment, computers would be used for only sanctioned activities.  While this unrealistic goal is neither practical nor economically feasible, we cannot afford to ignore security.  Many companies choose the “it won’t happen to me” path, but once their computers have been compromised there is no way to put the genie back in the bottle.

What can be done?

Implementing computer security takes planning, dedication, and constant effort.  You must build the goal of perfect security into everything you do because many threats come from unexpected sources.  In fact, trusted individuals rather than strangers commit the vast majority of security breaches.  Let’s examine the threat posed by five different risk groups: employees, contracts, trusted partners, deliberate attackers, and random attackers.

Employees

Employees are your greatest security risks because they already know the most about your security measures and have physical access to the computers.  They know exactly where the important information is kept, whose computers are easily accessed, and what information is most valuable.  They will know usernames and may even know passwords.  In some cases, they may simply be in the right place at the right time to take advantage of another employee’s accidental security breach.  

Sadly, employees generally have strongest motives for committing security violations.  They tend to be emotionally and financially involved in the information you want to protect.  The most hazardous security risk are fired employees: they can wreak havoc on your systems while cleaning out their desk or dialing-in to “PC Anywhere” modem that was overlooked during the termination process.  In other cases, your competition could be recruiting your employees and offering a bonus for collected information. 

I knew someone who happened to find a complete salary listing that an intern had saved into the wrong directly.  He reported the error, but not after looking up some salaries.  In another example, a computer security professional on an audit was able to retrieve username and passwords by posing as an IT staff and calling company executives from an outside extension.

Contractors

Contractors, temps, and interns are an even greater security risk than employees for three distinct reasons.  First, they are often given access to critical parts of the network.  Second, they have no loyalty or obligation to your company.  And third, they are not familiar with your security policies and practices.  The risk escalates even more since you have very little information about the background of contractors.

Contractors are given amazing amounts of security information.  This is especially true for executive secretaries that have access to everything their temporary boss may need and for rented technology professionals who come to help administer networks, servers, and databases.  In addition to privileged access, there is very little to stop a contractor from leaving backdoors open for future intrusions or outright theft. 

I am aware of a developer who was acting as a contractor to a larger contractor who was hired by a software writer to help design an interface for a bank.  This loosely linked in developer was given a username, password, and phone number to connect directly to the bank’s test servers.  That sounds reasonable except that the test server contained a complete and unaltered record every customer’s name, social security number, address, and date of birth.  In a simpler example, a temp helping catch-up on accounting chores conveniently passed a copy of corporate credit card numbers to her boyfriend.  Imagine the impact for your business if someone copied the file with all your customer’s personal information or credit card data!

Trusted Partners

Trusted partners are part of your supply chain or provide services to your company such as banking, Internet connections, or phone access.  In order to facilitate information exchange, they are usually given special access to some part of your computer systems.  For example, your suppliers may have dial-up access to your AS/400 so they can check inventory levels or your customers may be able to check order status on your Extranet.

Trusted partners are not only given access to sensitive information, they generally use a single access identity even if there are many people working for an individual trusted partner.  This means that one rogue at your Internet Service Provider (ISP) could use their access codes to compromise your entire network.  In another scenario, poor security on your Extranet could allow customers checking their order and invoice status to discover the prices you are charging their competitors.

Deliberate Attackers

A deliberate attack occurs when someone targets your company for specific information and actually tries to bypass your security.  Tools like Firewalls and encryption help protect you from these attacks.  Unfortunately you can deter or slow many attacks, but no system is completely impenetrable.    For example, hackers using stolen laptops bypass the external security gates by using legitimate users’ access codes.

A deliberate attacker’s goal is to damage your computer system or simply steal information.  A competitor can hire a hacker to retrieve information about your new products, marketing campaigns, or customers.  Unfortunately, your competitor may opt for a simpler approach: coerce an employee or contractor to misuse their trusted status to get the desired information.  In either case, you may never know your computers were infiltrated.  Even when companies can prove it, they are often too afraid of the negative publicity to call the FBI.

Random Attackers

Random attacks are the least probable, but generate the most publicity.  Random attackers are motivated by bravado or stealth.  The bravado attack’s goal is the like a gang initiation to prove the attacker can bypass security.  Theses attacks range from embarrassing (your web site is altered) to devastating (your data is wiped out).  The stealth attack is more devious: a hacker gains access to your systems as a base for future attacks.  The stealth attacker can then look for buyers for your corporate information or use your computers as a smoke screen to attack another target.  This is a very common approach to hide the source of unsolicited email (a.k.a. SPAM).

What can you do?

Unfortunately, implementing computer security is not as simple as visiting the dentist.  Security is a complex and multi-tiered puzzle that demands special equipment and training; consequently, you should hire a security professional to provide a comprehensive audit and review of your computer security.  Now that you understand your exposure, take steps to reduce it.

Sidebar 1: Your digital identity

The first step of every computer security processes is user identification.  User identification lets someone who wants access to a resource (for example: data on a server or a network connection to a web site) prove they have a right to use the resource.  Good security relies on a computer’s ability to distinguish between welcome visitors and unwanted intruders.

There are many ways to identify a user and the more certain methods are the most complex and expensive.  This list ranks them from least to most effective:

Use of digital signatures (a.k.a. public key infrastructure or PKI) currently offers the best combination of features and is being aggressively pursued by many vendors.  Unfortunately, vendor’s rush to implement PKI has resulted in mixed standards and interfaces.  According to Mike Rothman, Executive Vice President of SHYM Technology (www.shym.com), many companies see PKI complexity as an implementation hurdle.  Products like those offered by SHYM Technology bring the standards together to extend PKI’s impact and reduce implementation costs.

While some of these methods provide strong methods for user identification, they all have a major flaw.  It can be very difficult to quickly withdraw privileges from a user in any of these models.  Since internal users pose the greatest security risk, system administrators inherit a tremendous burden: they must be able to disable access quickly at the first sign of trouble.

Sidebar 2: Security sites