Corporate Officers And Directors Need To Take Responsibility For Securing Corporate Information Assets, Report Says.

Business Editors/High-Tech Writers

REDWOOD CITY, Calif.--(BUSINESS WIRE)--July 30, 2001

Recourse Technologies(TM) Report, Written by Tech Industry Legal Expert, Finds Evidence That Directors/Officers Can be Held Liable for

Loss of Data Due to Hacking

Corporate officers and directors are legally responsible--and potentially liable--for the protection of a company's information systems and corporate data, according to a study made available today by Recourse Technologies(TM), Inc., the leader in network security threat management systems. The report, written by Daniel J. Langin, a respected technology industry attorney and cyber-security legal expert, concludes that companies, their officers, and their boards of directors are vulnerable to lawsuits due to the growing number of statutes and business contracts requiring adequate IT data protection, as well as case law established in related legal territory.

Entitled "Out of the NOC(a) and Into the Boardroom: Director and Officer Responsibility for Information Security," the paper lays out the specific opinions and evidence supporting the need for D&O supervision of a company's information assets. Among the report's findings:

-- 85% of the 538 companies surveyed in a 2000 Computer Security Institute/FBI
computer crime study reported an intrusion or exploit of their corporate data,
with 64% suffering a loss;

-- Directors and Officers, as in the Y2K scare, are assumed to have sufficient
knowledge about hacker attacks today to make information asset protection a
matter of fiduciary duty;

-- Far-reaching legislation, including Gramm-Leach-Bliley and the Health
Information Portability and Accountability Act (HIPAA), require companies to
employ strong information security to protect sensitive information, and allow
for consumer lawsuits for damages resulting from non-compliance;

-- Most contracts that establish strategic alliances, partnerships and joint
ventures between companies now contain clauses stipulating security for shared
information;

-- Juries will soon be tempted to apply established product liability and
premises liability standards to cases where losses to information assets are
suffered on a party's systems due to a company's failure to maintain adequate
data security.

"At one time, the most valuable assets of a company were considered to be its buildings, inventories, equipment, vehicles, and so on. Today, non-physical corporate assets are number one--especially a company's vital information," said Frank Huerta, president and CEO of Recourse Technologies. "In the information age, companies must recognize and protect their critical resources, not only for their own sake, but also for the sake of their customers, shareholders, partners, even the general public."

"Ask almost any corporate officer or director to provide you with the location of the company's physical assets and describe how they are protected from loss, and they can either tell you or simply point you to a copy of the company's Annual Report," said Daniel Langin, author of the report. "Ask any corporate officer or director to provide you with the location of the company's physical assets and describe how they are protected from loss, however, and it's a different story. Although a company's information assets may seem less "real" than physical assets like buildings, vehicles and inventory, the duty of an officer or director to ensure that these information assets are protected is no less "real" than the duty to protect tangible corporate assets."

Intrusion Protection As Effective Deterrent

In the increasingly hazardous hacker environment faced by organizations today, intrusion protection is fast becoming a leading method for corporate boards to reliably secure information assets. A recent market report, "Gaining Control over Infrastructure: Intrusion Detection and Vulnerability Assessment" issued by International Data Corporation (IDC), a leading technology industry research firm, states that corporate purchases of intrusion protection solutions are growing at twice the rate of category-leading vulnerability assessment products. Reasons for such growth, according to the study, include the ability of intrusion detection products to identify intruders, the desire to cover corporate infrastructure with a last-chance safety net, and the growth of anomaly detection technology, which can flag a potential attack even if an intruder's "signature" cannot be identified.

Langin, in his report, describes Recourse Technologies ManHunt(TM) and ManTrap(R) as powerful and effective software solutions to help companies protect their information assets from harm. ManHunt is the first comprehensive threat management system that protects networks from intrusions and denial of service (DoS, DDoS) attacks. The software analyzes and aggressively responds to both known and novel data network attacks, logging and analyzing attack activities at speeds up to one gigabit per second and detecting intruders through detailed protocol anomaly analysis.

If an attack is detected, ManHunt instantly shares information across networks for examination and response, then quickly responds via a number of pre-determined methods including termination of malicious connections, sending alerts to security administrators, tracking that establishes the precise attack entry point, and launching custom response code.

ManTrap is the industry's leading secure deception system. Employing advanced honeypot technology, ManTrap works covertly to trap hackers within a deception host, then tracks their moves in order to contain, monitor, and identify the intruder. With ManTrap, network administrators have the time and information needed to respond appropriately to the attempted security breach, simply by preventing the intruder from coming back again or actually using the data to apprehend the intruder.

"Out of the NOC(a) and Into the Boardroom: Director and Officer Responsibility for Information Security" provides full references and other industry information. The copyrighted white paper can be found free of charge at http://www.recourse.com.

(a) Network Operations Center

About Recourse

Recourse Technologies(TM) is the leading provider of threat management solutions that contain, control, and respond to both known and novel threats, including intrusions, internal attacks and denial of service (DoS, DDoS) attacks. With Recourse, businesses gain the time and information critical for enabling secure and uninterrupted business operations. ManHunt(TM) is the first comprehensive threat management system that goes beyond traditional intrusion detection to provide a scalable and effective solution for detecting, analyzing and responding to attacks. ManTrap(R) is the industry's leading secure deception system (based on honeypot technology) that provides a realistic and flexible way to identify internal and external security threats. To learn more about managing network threats, visit the Web site at www.recourse.com or call 1-877-786-9633. Recourse Technologies, Inc. headquartered in Redwood City, California, is privately held and is funded by Canaan Partners, Doll Capital Management (DCM), Intel Capital, and Menlo Ventures.

Recourse Technologies and ManHunt are trademarks of Recourse Technologies. ManTrap is a registered trademark of Recourse Technologies. All other trademarks belong to their respective owners.