|
Computer crimes cost U.S. companies roughly $10 billion last year alone
according to the FBI. A startling 69 percent
of information technology professionals at Fortune 500 companies experienced computer
breaches in 2001 according to a survey by the Computer Security Institute and the FBI. Despite the fact that U.S.
business-to-business online transactions are expected to reach $1.3 trillion in the year
2003, online businesses remain vulnerable to electronic warfare, including fraud,
sabotage, espionage, piracy, and identity theft. While
securing web-based business is a critical new area of management, most information
security manuals serve only the technical community.
In her timely and easy-to-follow new book, SAFETY NET: Protecting Your Business on the Internet
(John Wiley & Sons, Inc.; $29.95; April 2002), Kathleen Sindell, Ph.D., offers
today’s managers a guide written in plain English that will allow them to assess
their current systems and create an effective security policy tailored to their online
business.
According to Sindell, the very infrastructure of the Internet is
vulnerable to hackers since the Internet was not originally designed for commercial
transactions. In fact, some of the most
reliable Internet-based business veterans have recently succumbed to security breaches. CNN, Yahoo!, Amazon.com, eBay, e-Trade,
Travelocity, Citibank, and World Economic Forum have each suffered monetary and production
losses, not to mention a loss in customer confidence, at the hands of hackers. Ironically, an Internet security firm, Network
Associates, recently had two of its web sites defaced by hackers who spattered
cyber-graffiti over the Brazilian-based web sites. This proves, according to Sindell, that
the question for today’s online business managers isn’t whether an intruder will
attack, but rather how the inevitable attack will be made.
Filled with workable strategies and practical advice, SAFETY NET also identifies products and vendors
online businesses can use to safeguard their operations.
Here are three suggestions Sindell says managers can implement today:
When purchasing a new computer or
upgrading an operating system, make certain not to leave the entry password blank. Computer users unwittingly make security holes by
not changing vendor produced default passwords or not creating passwords.
When changing offices or
computers, employees should use a “cookie crumbler” program such as Cookie Cop
so the next computer user can’t pirate another employees cookies used as passwords.
The average virus infection rate
of computers in 1999 was 80 in 1,000. Therefore
it is wise to use an anti-virus software or Web-based technology, such as MicroTrends
HouseCall to protect business data, application programs and hardware. Employees can give their personal computer a free
check-up by visiting http://housecall.antivirus.com/housecall/start_pcc.asp.
Despite the fact that roughly 72.4
million web servers are connected to the Internet and about 25 million servers are
dedicated to commercial web sites, online security is too often dealt with in an ad hoc
fashion and without corporate vision. With large corporations now doing business
online and the surviving dot.com companies maturing into serious businesses that need
steady management, SAFETY NET fills a critical
void in a new area of business management. Whether it is a matter of protecting
customers’ credit card data and personal information or confidential business
processes and intellectual property, without effective security online businesses cannot
compete.
Sindell also offers concise
definitions of technical jargon. Because of her working knowledge of the way
businesses create and maintain their online operations, Sindell is an invaluable aid to
managers in the analysis and evaluation of security risks. Her book also offers
managers a clearer understanding of prevention, detection, and recovery countermeasures.
SAFETY NET presents expert advice for
managers in a wide range of areas, including:
Becoming familiar with the top security issues for online businesses. Gaining an understanding of common Internet
security mistakes and recognizing why security is important for web-based businesses.
Assessing the security level of your web-based business. Identifying threats and potential business losses. Determining and documenting what assets need
protection.
Determining the impact of security on your bottom line. Deciding how much security is too much and
determining how much risk your online business can take.
Protecting your system from intruders.
Safeguarding data transmitted on the Internet.
Understanding intrusion detection systems and what kind of intrusion detection
software is best for your type of enterprise.
Understanding the security risks to
your web server. Gaining an understanding of
the common vulnerabilities of web servers and the anatomy of a typical intrusion.
Guarding your wireless operations. Recognizing
the impact of wireless commerce on your web-based business.
Reducing the likelihood of denial of service attacks. Gaining an understanding of the different types of
denial of service attacks and calculating the severity of an attack.
Understanding insider threats. Discovering
how social engineering can lead to data losses and how insiders may represent internal
threats.
Handling public relations after a cyber-attack. Preparing and planning for crisis communications. Looking into the guidelines for making a press
release.
Protecting your web-based business from invisible crimes and frauds. Taking stock of your intellectual assets and
digital rights management.
Determining what you can expect from a firewall. Creating a network connection policy. Understanding the various attributes of different
firewalls.
Safeguarding customer privacy and personal information. Learning how some customers react to the use of
cookies. Finding out how some cookies can be
pirated.
Protecting your web-based business with antivirus technology. Uncovering the different types of viruses. Recognizing virus hoaxes and developing a user
antivirus policy.
Developing an effective security policy.
Learning how a good security policy supports your business goals. Gaining an understanding of what makes security
policies fail and looking into the life cycle of security policies.
SAFETY NET breaks
through the technical jargon and demystifies the complex field of information security.
Managers will walk away form this book with no only a greater understanding of the issues
and the hardware and software tools at their disposal, but with a greater sense of the
actionable and logical protocols that will protect their networks and web-based
enterprises against security breaches.
|
