Impact of Internet Security
The Internet has become a vital resource for many companies around the world. By connecting to the Internet, a company can share information, send and receive files and emails, and provide an online shopping experience to the company’s customers. Some might say that in order for businesses to “hold their own in the global marketplace” (Wienclaw, 2008, p. 1), they must be connected to the Internet. In this article, I will show some of the security risks that are introduced or increased by the Internet, and I will try to give some suggestions for mitigating those risks.
Impact of Internet Security
One of the most significant risks companies face is the risk of unauthorized access to sensitive information. This risk is not new for companies, but with the Internet, this risk has increased. According to Dictionary.com, hackers are defined as “a microcomputer user who attempts to gain unauthorized access to proprietary computer systems” (dictionary.com, 2009). Before the Internet, hackers had to gain access to a company’s computer system from the company’s premises. Companies could reduce this risk with physical security mechanisms such as access cards and guards. The Internet has opened up this risk to hackers outside the company as well. Unauthorized access can lead to regulatory issues for companies as well as theft of intellectual property. Disruption to the company can also threaten customer confidence, which can lead to lost sales. According to Linda Mustaler, some “organizations that have experienced data breaches have been compelled by law to report the event” (2008, para. 1).
There was a time when software patches were only needed to fix software functionality. Now that companies are connected to the Internet, security vulnerabilities inherent in software must also be patched. The Internet is an exceptional means of communication. Just as companies use the Internet to find and communicate the latest information, hackers also use this medium. According to Ruth Wienclaw, “research has found that the average time between the announcement of a software vulnerability and the time an attack is made against that vulnerability is 5.8 days” (Wienclaw, 2008, p.2). Most recently, in October 2008, “Microsoft released a patch outside of its normal Tuesday patch cycle” (Johnston, 2009, para. 2). This hotfix was released because “targeted attacks exploited” (2009, paragraph 1) the vulnerability according to Stuart Johnston.
Computer viruses were not new to the world of computers when the Internet appeared. Computer viruses are software programs that are designed to harm the computer environment and spread from computer to computer. Before the Internet, computer viruses were spread by sharing drives from one computer to another. What better way to improve the spread of computer viruses than to connect all the computers to each other.
Many solutions can be implemented to minimize the risks that were mentioned above. An important thing to mention, however, is that a company may not be able to eliminate all risks. The first recommendation I would make for any company trying to implement an internet security program is to try to understand the assets the company is protecting. Assets can be physical assets, but here I mean data assets. The impact of risk on these assets is important to understand in terms of costs. This is a general approach to risk management. If the company does not understand the risk from a cost perspective, it may be difficult to justify the cost of mitigating the risk. The second most important recommendation I would make is that no single solution will mitigate all risks. According to Roark Pollock, “to effectively protect against attacks from worms, hackers, and other forms of malware that target software vulnerabilities, enterprises should consider a ‘layered’ approach to security” (2004, para. 6) .
Most experts agree that implementing an anti-virus/anti-malware solution, as well as a hardware-based firewall, are the basic building blocks of internet security. Anti-malware software will continuously scan the computers and servers in the company’s environment to identify and block distribution attempts by viruses, spyware and other malicious code. Firewalls, on the other hand, will help prevent unauthorized computers from gaining access to company networks, helping prevent a hacker from gaining access.
Firewalls and anti-malware solutions are not themselves without vulnerabilities. These products have software code that is susceptible to security breaches and new malware where the malware definition files have not yet been updated. This is why I believe that a comprehensive patch management practice is implemented as part of the internet security solution. According to Linda Mustaler, “Eighteen percent of hacks used a specific known vulnerability. In more than 71% of these cases, a patch for the vulnerability had been available for months” (2008, para. 4). In my opinion, one of the best investments a company can make is an automated patch management solution where known security patches are automatically downloaded and deployed to the appropriate devices as soon as the patch is released. At Interval International, my team signs up for a third-party notification service that provides us with immediate notification of security patch releases and rates the releases on a scale of one to five. A score of one is the least important to implement and five is the most critical. In my department, I have established guidelines for how quickly a correction should be implemented based on the output provided. Our patch management product allows us to deploy score five patches within one day to all our systems worldwide.
Since remote login or remote access is a common requirement for companies that access the Internet, a two-factor authentication solution is another important recommendation. Where a firewall will help ensure that only authorized systems will have access to internal company resources, an authentication system will ensure that only authorized users have access. Two-factor authentication forces the user to enter a password based on a password policy set by the company. It also forces the user to provide another credential based on something they have. Interval International, users have a password stored in memory and users receive an RSA security token where they have a digital key that changes regularly. In order for a user to access an Interval system from the Internet, the user is prompted for a user ID, password, and RSA security token number. This two-factor authentication approach reduces the risk of unauthorized access because an attacker would need to have a matching password and token.
The last recommendation I would make is for the company to sign up for an annual penetration test. This test is when the company gives a third party the authority to try to breach security and gain access to the company’s systems. These tests exploit known vulnerabilities and provide the company with the findings and actions to improve security. This type of testing is required by the Payment Card Industry/Data Security Standard (PCI/DSS) if the company is a credit card processing company.
There is no silver bullet for internet security. The basic building blocks of an Internet security solution are a hardware-based firewall and an anti-malware solution. These two solutions are only as good as their support. Internet threats change rapidly, and to ensure that a company remains protected against new threats, a comprehensive patch management practice must be implemented. Remote users will need to access company assets. To ensure that the right users get access, the company should invest in a two-factor authentication solution. Finally, a third-party security check is never a bad idea. This can be done with a penetration test and is a requirement for PCI/DSS compliance.
Dictionary.com, (2009). Hacker Definition, Dictionary.com. Retrieved January 24, 2009, from http://dictionary.reference.com/browse/hacker
Johnston, SJ, (January 2009). PCWorld, errata and corrections, retrieved January 25, 2009, from the EBSCOhost database.
Kilpatrick, I., (January 2009). http://www.trainingjournal.com, 12 Tips for Staying Safe on the Internet. Retrieved January 23, 2009, from EBSCOhost database.
Musthaler, L., (December 2008). Network World Asia, the real cause of data breaches. Retrieved January 26, 2009, from EBSCOhost database.
Pollock, R. (April 2004). Communications News, Secure Networks. Retrieved January 24, 2009, from EBSCOhost database.
Wienclaw, RA, (2008). Copyright EBSCO Publishing Inc., Research Starters: Internet Security. Retrieved January 24, 2009, from EBSCOhost database.
#Impact #Internet #Security