IT in focus
These applications result in a number of systems being integrated and connected, which is both positive and negative. It's positive because efficiency, productivity and cooperation are all increased; it's negative because it opens systems up to cyber crime, viruses and hackers. The reality is that if a business wants to protect itself from the potential dangers of progress, then a proportion of its budget must be spent on IT security.
Although companies know this, they are bewildered by the IT security industry. At what point do the requirements of networking cross over into being a security issue? And how much should be spent on security? At a seminar on Trustworthy Computing in the autumn of 2003, Microsoft suggested that eight percent of a corporate budget should be spent on IT security. But when several security vendors and integrators were asked the same question, they said that about 30 percent of the budget should be dedicated to security. It's no wonder that companies are confused - and the confusion begins before they even enter the world of IT security options available.
Some of these options are, in actual fact, not options at all: firewalls, user identification and authorization, logging, spam control and anti-virus measures are no longer choices. If you go beyond these basic IT security measures, then things depend on a company's individual needs. If the password system is deemed insufficient to protect confidential data, then magnetic strip cards or chip cards are two possible options. Another method of identification is the biometric system. This system makes use of biometrics (personal characteristics) of a specific person, such as fingerprints or voice.
The interesting thing to note about all of these security systems is that their aim is to keep intruders and threats out of the system. But it's critical to point out that most attacks come from inside the system - either due to employee error or malicious intent - and these measures will not adequately deal with an internal threat. Firewall, for example, is an excellent first-line of defense for hackers, but generally leaves a network unprotected from internal intrusions. Many businesses believe that firewalls are the final answer to all their problems, and do not take further steps to protect themselves. One system often used to handle threats from within is the Intrusion Detection System (IDS).
IDS basically looks for deviations from 'normal' activity. What is 'normal' is based on historical data; this data sets expected values, amounts and activities. Therefore, if a user, file or server behaves in a way that is 'abnormal', it's noticed. Also, IDS compares activities performed internally against known patterns of attack, and determines if these attacks and activities share any similarities. Any pattern detected is deemed a potential threat and is noticed immediately.
If a company handles extremely sensitive information, and fears attacks both internally and externally, then the most effective way to ensure its safety is encryption. This is a process that scrambles plain text (ordinary text, or clear text) into cipher text (a process called encryption), then back again (known as decryption). Cryptography ensures that the information cannot be understood by anyone but the person for whom it was intended, and it isn't possible to alter the information - either in storage or transit between sender and intended receiver - without the alteration being detected. It is one of the most sophisticated ways of protecting information, and is used in governments, large banks and the military.
If you're an SME, you won't be needing such advanced IT security, but this doesn't mean that you don't need any. Better safe than sorry, and with so many options out there, you'll find some that are ideal for you - and won't cost 30 percent of your annual budget.
Although companies know this, they are bewildered by the IT security industry. At what point do the requirements of networking cross over into being a security issue? And how much should be spent on security? At a seminar on Trustworthy Computing in the autumn of 2003, Microsoft suggested that eight percent of a corporate budget should be spent on IT security. But when several security vendors and integrators were asked the same question, they said that about 30 percent of the budget should be dedicated to security. It's no wonder that companies are confused - and the confusion begins before they even enter the world of IT security options available.
Some of these options are, in actual fact, not options at all: firewalls, user identification and authorization, logging, spam control and anti-virus measures are no longer choices. If you go beyond these basic IT security measures, then things depend on a company's individual needs. If the password system is deemed insufficient to protect confidential data, then magnetic strip cards or chip cards are two possible options. Another method of identification is the biometric system. This system makes use of biometrics (personal characteristics) of a specific person, such as fingerprints or voice.
The interesting thing to note about all of these security systems is that their aim is to keep intruders and threats out of the system. But it's critical to point out that most attacks come from inside the system - either due to employee error or malicious intent - and these measures will not adequately deal with an internal threat. Firewall, for example, is an excellent first-line of defense for hackers, but generally leaves a network unprotected from internal intrusions. Many businesses believe that firewalls are the final answer to all their problems, and do not take further steps to protect themselves. One system often used to handle threats from within is the Intrusion Detection System (IDS).
IDS basically looks for deviations from 'normal' activity. What is 'normal' is based on historical data; this data sets expected values, amounts and activities. Therefore, if a user, file or server behaves in a way that is 'abnormal', it's noticed. Also, IDS compares activities performed internally against known patterns of attack, and determines if these attacks and activities share any similarities. Any pattern detected is deemed a potential threat and is noticed immediately.
If a company handles extremely sensitive information, and fears attacks both internally and externally, then the most effective way to ensure its safety is encryption. This is a process that scrambles plain text (ordinary text, or clear text) into cipher text (a process called encryption), then back again (known as decryption). Cryptography ensures that the information cannot be understood by anyone but the person for whom it was intended, and it isn't possible to alter the information - either in storage or transit between sender and intended receiver - without the alteration being detected. It is one of the most sophisticated ways of protecting information, and is used in governments, large banks and the military.
If you're an SME, you won't be needing such advanced IT security, but this doesn't mean that you don't need any. Better safe than sorry, and with so many options out there, you'll find some that are ideal for you - and won't cost 30 percent of your annual budget.
