Solution Overview: Information SecurityThe right IT security strategy will save your company money, protect your network, and reassure your staff.
This shift also recognizes the fact that information security threats come from employees as well as people outside an organization, either due to intentional malice or through unintentional security lapses and errors. According to Gartner Group, more than 70% of unauthorized access to information systems is committed by employees, as are more than 95% of intrusions that result in significant financial losses. Whether internal or external, such threats represent a growing risk to firms of all sizes. "Network attacks are getting more sophisticated, and at the same time, they're getting much easier to deploy," says Kevin Flynn, senior manager of security marketing at Cisco Systems®. These security breaches can compromise a firm's data confidentiality and integrity; they may also disrupt a firm's business operations, imposing potentially enormous costs. The bottom line is that many companies are not as secure as they'd like to be, and the problem is escalating. For example, Computer Security Institute found that 70% of companies that suffered a security breach reported defaced Web sites or similar malicious acts in 2002, up from 64% in 2000. In addition, 55% reported denial-of-service attacks, and a remarkable 40% detected system penetration from the outside. [ Return to Top ] Challenge In addition, firms need to defend against network attacks that move far more quickly than they did in the past. These include "zero-day" vulnerabilities, which are network attacks that exploit previously unknown vulnerabilities in an organization's network infrastructure. "This is a change. Previously, security personnel had often been aware of a vulnerability before it was exploited," says John Stewart, information security director for Cisco. These network attacks typically happen faster than staffs can facilitate counter-measures, making it difficult for organizations to react to these threats using established response protocols. Finally, as more firms store their intellectual property and other valuable data in networked storage systems, they increase their vulnerability to unauthorized data access. "The growth of data storage systems, combined with new methods for moving data across networks, makes it much easier for a firm to lose control of its intellectual property," Stewart said. As these examples suggest, firms face numerous difficulties in trying to protect against every possible threat. "Network security is only as good as each individual component," Flynn said. "It requires a number of different technologies that must be tightly woven into the entire enterprise security structure." "Every network is vulnerable, and security is a prime concern," said Laura Koetzle, an analyst for Forrester Research. "An organization that doesn't take network security seriously can find itself crippled by attacks and other threats." She divides potential assaults into two categories: internal and external. Employees, consultants, and visitors make up the former category, while hackers and unwitting accomplices–whose e-mail programs infect personal computers with viruses or other types of malicious code–are included in the latter category. [ Return to Top ] Solution Network security technology is also evolving away from its traditional emphasis on perimeter defense, with its focus upon creating virtual barriers between a corporate network and the outside world. Instead, new security technologies often include host-based protection systems that operate at the server or desktop level, and emphasize flexibility and defense in depth. "This approach relies on systems that allow every host to protect, police, and control itself," Stewart said. "These systems can adapt to meet emerging threats by adapting to the circumstances and reacting in order to protect themselves from attack." At the same time, however, firms continue to rely on established networking products to create a multitier security infrastructure, including:
[ Return to Top ] Benefits The difference, Stewart noted, is that in the electronic world, the stakes are much higher. "You have a lot more to lose, and you can lose it much more quickly. In that sense, the return on a security investment is not losing what your company can't afford to lose," he says. Nevertheless, it is also possible to calculate a specific return on a security investment by considering the losses a company would suffer if it lost access to critical systems or data. "Given that Cisco takes more than 90% of its orders online, the cost of even a five-minute outage is considerable," Stewart says. "You're protecting your ability to offer services consistently and reliably. When you use electronic systems to offer those services, even a minute amount of downtime is unacceptable." Another technological advantage the system provided was one that Nolan had anticipated since he began his career in law enforcement. "We've always been frustrated by the lack of interoperability between different police and fire department radio systems," he explains. "We can't talk to our own fire department or neighboring county officers because we're on different radio frequencies. When Montgomery County switched to 800-MHz radio systems to solve that problem, Delaware County and Chester County purchased different brands of equipment, so we still couldn't talk to each other." [ Return to Top ] Next Steps What Cisco Offers
Cisco expertise also extends into related security specialties, including critical infrastructure assurance and homeland security, ensuring that Cisco customers receive the broadest possible range of services and professional experience. Further Reading Key Findings The Computer Security Institute's 2002 Computer Crime and Security Survey is based on responses from more than 500 security experts in U.S. corporations, government agencies, financial and medical institutions, and universities. Some of the survey's key findings include:
[ Return to Top ] |
Background
