Answer the following questions in one word.
A. Wireless networking, using the so-called Wi-Fi protocol, has become immensely popular over the past two years, the technology crash notwithstanding . Many companies and individuals leave their access-points open deliberately to enable passers-by to share their Internet connections. Open a laptop in New York, San Francisco, Seattle or many other large cities around the world and you may well be able to get online free. But although Wi-Fi is liberating for users, it can cause security problems.
B. Adding an access-point to a network costs less than $200 and is very simple-so simple, in fact, that ‘rogue' access-points have started to sprout on corporate networks without the knowledge of management.
A survey by Computer world, an industry magazine, found that 30% of American companies had identified rogue access-points on their networks. And if these are left open, they provide a back door past the firewall into the company’s network. Rob Clyde, chief technology officer at Symantec, says that half of the chief executives at a recent round table event cited Wi-Fi as a top security concern.
This is just one example of how a new technology can bring security problems in its wake. There arc plenty of others. Some firms are opening up their networks through online business-to-business exchanges, for example, where they list what they' want to buy or sell and invite bids. Everything from paper clips to car components is bought or sold in this way. There is widespread agreement that ‘web services’, in which companies open up their core business processes directly to other firms over the Internet, will become increasingly important in the next few years. But by opening its systems to outsiders, a company may also attract unwanted visitors, or attacks from nosy competitors.
C. Joint ventures, in which two firms collaborate and share information, can also cause problems. A recent report by Vista Research cites the example of an American car maker that established a joint venture with a Japanese firm and opened up its network to allow in employees of its Japanese partner. But the design of the American firm's network allowed access only on an ‘all or nothing’ basis, so the Japanese firm's employees ended up with access to everything.
Hand-held computers are another problem.
D. They are often used to store sensitive data such as passwords, bank details and calendars. ‘The calendar is a fundamental loophole, 'says Doug Dcdo of Microsoft’s mobile devices division, because it may contain entries such as meeting with company X re merger'. Another problem associated with hand-held computers is that their users carry them into the office and plug them into their computers, bypassing anti-virus systems and firewalls. A virus-infected document stored on a hand-held computer could then start spreading. Similarly, peer-to-peer file-swapping networks such as Gnutella, instant-messaging services that zap messages and files across the Internet, and web-based e-mail systems such as Hotmail all provide new routes into a company’s network that can be exploited by attackers.
E. There are plenty of technical fixes available. Handheld scanners can be used to track down rogue access-points, and legitimate access-points can be secured against outsiders by using virlual-private-network (VPN) software. A lot of work is being done to ensure that web services arc secure, including, improbably, a joint initiative by rivals Microsoft and IBM. Anti-virus and firewall software exists for hand-held computers, which can also be password-protected. And firewalls can be configured to prevent unauthorised use of peer-to-peer and instant-messaging services. Its home page resides and the private core (which is accessible only to employees) is quickly eroding. 'The cultural and technological trend is towards more porous companies, ’says Gene Hodges, president of Network Associates, a large security-software firm. As firms connect with their suppliers and customers, 'the more you open up, the more you are exposed.’
F. ‘His classic notion of perimeter security, in short, is fast becoming obsolete. Alan Henricks, chief executive of Cenzic, says the shift is 'from keeping people out to bringing people is in a trusted fashion’. Nand Mulchnndani, co-founder of Oblix, another security firm, puts it more colorfully: the ‘big walls, moat and crocodiles' approach of the past few years, he says, is now outdated.
The latest thinking is that rather than seeing their networks as castles, large organisations should regard them as airports. People go in and out all the time, some areas arc more secure than others, and as people pass from one area to another they have to present their credentials: tickets, boarding passes or passports. Apply this approach to computer security, and instead of an ‘exclusive’ model in which you try to prevent people from doing things they shouldn’t, you have an 'inclusive' model that lays down who can do what, and only lets certain people do certain things.
According to the new model of network security, what will users have to do to pass from one area to another?
Who is authorized to access the private area of a company network?
The latest thinking is that rather than seeing their networks as .
A document stored on a hand-held computer could then start spreading.
all provide new routes into a company’s network that can be exploited by attackers.