JOHN LAMB: What kind of IT securityrisks are businesses facing?TOM KING: They face threats from manydifferent angles – from insiders who workfor the business, from malicious code(viruses and worms) and from hackerswho can be anywhere in the world. Themost significant threats are from theInternet, which has become businesscritical for most enterprises. Here the chiefdanger is malicious software code –viruses, worms and trojans – which infectmachines, slowing them down, interferingwith their running and even resulting in the theft or loss of data.

JL: How does this malicious computersoftware work?TK: Viruses or worms can flood anetwork, bringing it to a halt. For example,in 2003 a virus called SQL Slammerspread from the Far East and causeddevastating effects on enterprisenetworks. Another malicious code calledthe Blaster worm caused systems toreboot (to stop and start up) over and overagain. Some of these codes also carry athreat to confidential business information.When infected with the Sircam virus, forexample, it will attempt to mail out randomdocuments from your hard-drive.

129

INFORMATION TECHNOLOGYZe

fa

Is IT safe?

With tech-relatedsecurity threats on

the rise, owner-managers need to

be armed withstrategies to avoidthem. John Lamb

speaks to IT securityexpert Tom King

>

JL: There seems to be a bewilderingnumber of threats. What is spyware?TK: Spyware is software that installs itselfon your computer without yourknowledge. When browsing, it can beresponsible for pop-ups appearing on yourscreen, it can change your home pageand take you to a porn site instead of thepage you selected. Spyware can trackyour browsing habits and can be used forsending documents out of your PC.

But no discussion of security would becomplete without a mention of phishing.Phishing attacks often come in the form ofan email that purports to come from yourbank and directs you to a false site thatasks you to enter information about youraccount. If you do that the criminal canthen access your account and transfermoney out of it.

JL: You mentioned emails. Manyorganisations are worried about therisks here. Can anything be done tocontrol email use?TK: Yes, you need to be sure that peoplearen’t emailing out corporate secrets.However, there’s the question of privacyand how acceptable it is to monitoremails. It is absolutely vital to get advicefrom a local legal body.

Spam, or unsolicited incoming email, is a real headache, but there are somepartial answers to the problem. Thirdparties, such as Message Labs, canremove spam for you by scanning youremail and automatically stop mailentering your system.

Internet Service Providers (ISPs) arebeginning to clamp down on spammers,but in turn they (the spammers) arefinding new ways to spread spam. There are worrying connections betweenvirus writers and spammers. Viruses are now in circulation that can take over systems and use them to relaythousands of spam emails all over theworld. There is a knock-on effect too –high volumes of spam can prevent usersaccessing the web.

JL: Are systems at risk from people aswell as malicious software?TK: Yes, there are threats from hackersand crackers that could be financial,could involve trying to steal data or could

be corporate espionage. So far asinsider attacks are concerned,disgruntled employees can causesignificant disruption by deleting files orcausing disruption to your systems. It isimportant to ensure you manageemployees’ access rights so that theycannot get into your systems after theyhave left the company.

JL: How much do security breachescost business?TK: Around a half of all businesses suffer asecurity breach of one kind or anothereach year costing them an average of€40,000 for each serious security breach.The bill runs into billions for virus attacks,hacking and fraud – and it’s growing.

JL: Does the size of a business make itmore or less vulnerable?TK: Size does make a difference. Theway you conduct your business makes a difference too. If you sell over theInternet it could be catastrophic if youlose your website. If you are small itdoesn’t mean you can avoid the threat

131

INFORMATION TECHNOLOGY

>

“Disgruntled employees can cause significantdisruption … ensure you manage employees’access rights so that they cannot get into yoursystems after they have left the company”

Get appropriate legal advice tosafeguard your business against

employees emailing outcorporate secrets – you’ll need

to find a balance betweencontrolling email use without

compromising privacy

either. It remains the same whether youare a two-man partnership or employ20,000 people. It is less likely a smallbusiness would be targeted by hackers,but viruses affect everyone.

JL: How aware are businesses of allthese dangers?TK: I am constantly amazed at whatpeople are doing, or rather what they are failing to do. A considerable proportionof businesses take few precautions,particularly when introducing newtechnology. For instance, wirelesstechnology is a quick and easy way toextend a network.

A couple of months ago I went on awireless patrol in a boat up and down the Thames. We detected over 3,000networks and more than half werecompletely open, including thosebelonging to high profile companies. We could have got into those networksfrom the boat. It was like setting up anetwork with the ports dangling out ofthe window. Businesses should be verycareful to follow best practice. By default,all wireless is unsafe.

JL: What kind of defences are there?TK: Education is very important. It is vitalto explain what the dangers are to youremployees. But threat vectors change.The way different threats manifestthemselves alters over time. A few yearsago people were advised not to open anemail attachment that came fromsomeone they didn’t know. Now you canbe infected without even opening anemail. Similarly, phishing may change. Itmay well be that when you try and visityour bank’s website you’ll be taken off to afake one without doing anything

JL: What advice do you have forreaders of Managing Growth on how tosecure their systems?TK: Following best practice is critical.Make sure your anti-virus software is onevery computer and kept up-to-date.Four or five years ago it was okay if youupdated your systems on a monthlybasis. Now you should consider updatingyour signatures (details of individualviruses) daily or even hourly. Someviruses spread so quickly that your

anti-virus software will be ineffective if youdon’t update frequently. SQL Slammerinfected 90 per cent of the machinesvulnerable to it within 15 minutes. It is not as arduous as it sounds becausemost software can be configured toupdate itself automatically.

No one should consider connecting tothe Internet without a properly configuredfirewall. It’s security suicide.

The third and final point is that youshould look at applying patches to yoursystem regularly. Security patches fixerrors in software that worms, viruses and so on can take advantage of.

132

INFORMATION TECHNOLOGY

>

“On a wireless patrol in a boat up and down theThames, we detected over 3,000 networks andmore than half were completely open – includingthose belonging to high profile companies”

The industry is becoming more organised.For example, the latest version ofWindows XP provides automatic updates.

JL: How important is education? TK: All businesses should haveacceptable use policies on howemployees use the Internet. For instance,you may ask users only to visit businesscritical sites. Policies need to bepragmatic, brief and be enforced.

The idea of education, anti-virussoftware patches and firewalls is that theyprovide defence in depth like the medievalcastle. First castles were built on a hill,then surrounded with a moat, lines of wallsand finally, if all else fails, the defenderscan withdraw into the keep.

JL: That’s all very well, but it soundsrather costly.TK: Traditionally some of these thingshave been time consuming butautomatic routines are cutting down the amount of effort companies have to put in to keeping systems secure,

particularly those that don’t employ ITspecialists. The cost of anti-virusmeasures has been an issue. But it ispossible to provide protection for under€50 per year per workstation.

JL: Would you advise readers to seekoutside advice?TK: It depends on the IT skills andresources that each organisation has.Some companies can do it in-house. Butyou don’t want to take any risks. A goodexample is firewall configuration – if youget it wrong it can be very damaging forsmall businesses. A poorly or improperlyconfigured firewall can open up yournetwork to all sorts of attacks from theInternet. The reason the SQL Slammerworm affected the world’s IT systems to

such an extent in 2003 was largely due topoorly configured firewalls.

JL: Do you think these security threatswill ever be eliminated?TK: I don’t see them disappearingovernight. It’s a cat and mouse game andalways has been. Defences are gettingsmarter, but then so are the bad guys. For instance, there are now new virusesthat can bypass current anti-virus software.My personal view is that they will evolveinto different threats. We will see blendedattacks with viruses working with othermalicious programs. Software companiesare very aware of this and they are workinghand-in-hand with hardware manufacturersto counter the danger.

The industry is coming up with newideas already. McAfee, for example, ischanging the way its anti-virus softwareworks. It scans for viruses, but also has a firewall and can detect intrusions. Itrepresents a consolidation of techniques.

Ultimately the best defence is to take thethreat seriously, deploy a range of countermeasures – anti-virus software, softwarepatches and firewalls – and make sure youremployees understand the dangers.

135

INFORMATION TECHNOLOGY

“Defences are getting smarter, but then so are thebad guys. My personal view is that they will evolveinto different threats … blended attacks withviruses working with other malicious programs”