Security- today and tomorrow. (Viewpoint).

Where does one start when securing an ebusiness system? It would be wonderful to have a green field site and start from the beginning, but most have to start in the real worm with systems already in existence. Moreover, we may have to secure a ebusiness system in an environment where genuine, serious threats exist, alongside the paranoia that arises every time a hacker or virus inflicts major damage on someone else. We also have to keep current with technical advances despite a shortage of skilled staff, and be able to distinguish what measures will genuinely help secure ebusiness systems, from an abundance of security hype.

In this feature, I will be looking at the issues surrounding some key risk areas for ebusiness systems such as extranets, VPNS, email and distributed denial of service (DDOS) attacks, outlining the latest tools and countermeasure techniques available, and consider security issues for the future.

I will also discuss where high availability and load balancing fit into the security equation, as well as examining the crucial role of automation and reporting in the security armoury,

The emphasis on business

Running an ebusiness systerm is primarily about running a business. All the IT infrastructure which surrounds an ebusiness system needs to be designed to support the business itself and not the other way round. The security of ebusiness systems is not only an IT issue, but also a business and management issue.

The security policies that work best for ebusiness are those to which senior management is heavily conmitted. Security works much better (or only works) if it has a champion on the board to promote at the highest level, and show the whole organisation that security is a primary issue in the current business climate.

Companies need to foster a culture in which security is seen as a positive activity, which contributes markedly to the prosperity of the business, and helps safeguard jobs. Training in security awareness and security processes, praise for staff when security succeeds, good communications between management, staff and IT on security measures are all important in creating this culture. Without it, many security measures are rendered useless.

There's an old adage that security is only as strong as the weakest link and it's never truer than when talking about ebusiness. The drive to connect more suppliers, more customers, more remote workers, and more devices to ebusiness systems is ever increasing. Business partners are a key element in the security infrastructure and should be part of a company's culture of security.

A policy sufficient for a small number of business partners and remote users, may become woefully inadequate as more users are added. Suppliers and customers may not have the same concerns about security as your company, so it is sensible to update policies to reflect this.

Extranets and VPNs

The move towards multiple VPNs is gathering pace. Five years ago people had maybe five VPNS, now they might have 500 and tomorrow they may have 5000. While this brings bring better and more secure communications with formalised authentication and encryption over the Internet, it also creates a situation with multiple entry points needing continual supervision and management to ensure security.

Additionally, VPNS, and especially encrypted VPNS, can become an Internet performance bottleneck, making the managment of this environment a corporate nightmare.

In this situation, key VPN features become ease of deployment, ease of management, and the ability to have a comprehensive network and security overview. Centralised management and troubleshooting become crucial, as does good management reporting.

Due to the changing requirements of installing large numbers of VPNS, the product itself has evolved. Combined VPN and firewall appliances, such as that available from WatchGuard, are now more common than software only VPNS, and statistics show this to be a growing trend.

Email

Email is probably the biggest single threat to business existence if it is not managed effectively, and needs to be one of the key elements of a security policy. IDC predicts that by 2005 there will be 1.2 billion email boxes (138% compound growth) and 36 billion person-to-person emails daily. Instant messaging will grow at a rate of 100% compound, with 150 million business users by 2004.

Existing email security problems will be significantly magnified, so we will need to look more carefully at virus defence, email data security, content filtering and SPAM protection.

Contextual searching will help pick up emails which could lay a company open to legal action for sexual or racial discrimination. It could also pick up whether employees are mailing out sensitive information such as customer lists or research data.

There are many solutions available for managing email. The market is moving towards multi-purpose security and management products such as those from Clearswift, including MailGuard and Mimesweeper.

Email solutions can help define and enforce an email security policy, as well as providing filtering, monitoring and reporting. They can work in tandem with anti- virus software, providing additional protection on a company-wide basis.

They can also offer contextual searching, provide protection to help safeguard intellectual property and confidential information, and offer a method of dealing with SPAM.

Distributed Denial of Service attacks 

A third of all UK businesses will suffer a Distributed Denial of Service (DDOS) attack on their web servers during 2002, costing 54 million [pounds sterling] in lost on-the revenues, according to estimates by Internet security specialist, Webscreen Technology. This is forecast to rise to losses of more than 270 million [pounds sterling] by 2005.

Most companies believe they are protected by firewalls and the like. This is technically correct. Most firewalls will shut down during a major DDOS attack to protect systems. But because they have shut down, companies are unable to carry on trading, and the web site is unavailable. The attack has succeeded.

The majority of attacks, however, are minor ones and will not trigger a firewall to close. They will, however, significantly downgrade performance, giving poor service to staff, suppliers and customers. There are some solutions now that will actually allow trading to continue while dealing with attacks, both major and minor. Webscreen Technology's WS 100 uses `CHARM' technology to assign scores to web site visitors. When a DDOS attack occurs, it will let the best customers in, while repelling the attack. It is possible to continue trading during attacks, while maintaining

normal performance for key users, in addition to immediately identifying attacks.

DDOS attacks do have to be taken very seriously. At the beginning of 2002, the ISP Cloud Nine ceased trading due to a series of devastating DDOS attacks, which left it unable to provide a service to customers. The role of reporting and automation Security threats to ebusiness are continually increasing, while the number of solutions is growing. Unfortunately, the number of skilled IT security staff is not increasing at the same rate, creating a lot of problems.

An answer for companies in this situation, is to employ reporting and automation techniques.. This enables skilled staff to be involved with overseeing and planning security, and not its the day to day details. Looking at how to tackle future threats, instead of loading the latest anti-virus update.

The key to good internal security is accurate intelligence, knowing exactly what is happening on a network. Once you understand what is happening, you know where you are most vulnerable, and therefore, which area you need to protect first.

Security is not just about the obvious issues like anti-virus, firewalls, hacking, fraud and DDOS attacks. Good security is about maintaining 24x7 availability of ebusiness systems and a good standard of performance.

Research by Iowatch, in 2001 established that UK businesses suffer from 57,500 Internet crashes per day. The average UK business experiences 97 minutes of downtime a month and 17 different downtime periods--so repeated non-availability of ebusiness systems is a very real possibility.

Poor performance and non-availability of systems (because of ISP failure or perhaps due to equipment failure) will have the same effect as poor performance and non availability due to one of the more obvious security risks. Companies could just as easily lose money, lose customers and potentially lose their business. There are now high availability tools from companies such as Radware and FS which ensure that ebusiness systems can provide continued availability and the best performance. Radware, for example, has failsafe solutions for firewall or ISP failure, which allow companies to switch seamlessly from one firewall to another in the event of failure, or from one ISP to another in the event of an ISP going off line.

Internal security is still the most dangerous threat to companies, with FBI statistics regularly showing around 70% of security problems are from within. Solutions providing centralised configuration, implementation, auditing and reporting of the majority of network security issues are available from a number of companies including RedHand.

Such solutions can also lock down desktops, as well as preventing unauthorised downloads and uploads. They will also manage laptop security remotely. Some of the automated tools which can lighten the security load are:-

* Firewall Reporting

Firewall reports can give a blow by blow account of everything that goes through a firewall and can highlight attempts to breach security. Technical and management reports are available from companies such as netIQ.

* Vulnerability Testing

Vulnerability testing tools, such as netIQ's Security Analyzer, can regularly throw a battery of tests at a system to sec how it responds..

* Intrusion Detection 

Intrusion detection lets users identify and respond rapidly to intrusion attempts. There are a wide range of solutions available.

* Web filtering 

The legal risks and productivity costs of web abuse means that web filtering is very important Filtering tools are widely available such as the software based solution from WebSense, or the appliance based filtering tool from NetPure.

* Honey pot systems

One proactive way of ensuring a second line of defence for ebusiness systems is to set up a honey pot trap. Honey pots are decoy servers or systems set up to gather information regarding an attacker or intruder. Honey pot traps can be set up for internal, external and remote access systems.

Conclusions

There are some discernible trends in ebusiness security. Appliances are becoming more widespread, with a move away from server-based software. This is because appliances are often easier to protect, easier to deploy and easier to manage, with a low cost of ownership.

Maintaining the best possible performance and high availability is becoming increasingly important as businesses apply the same rules to the security of their ebusiness as they apply to the rest of their business.

There will be a move towards collating data into one source from all security devices to give an overview of the whole security environment Tools such as netIQ's Security Manager will be increasingly used alongside enterprise products such as OpenView, Tivoli and UniCenter.

Absolute security is unfortunately absolutely impractical. No company is ever likely to have all the time and all the resources needed to be 100% secure. You can only do the best you can with the resources and time you have available.

Security is always going to be a difficult issue, but it doesn't have to be a total nightmare. Automated tools and reporting will flee IT staff to enable them to take a security overview, rather than focus on details of individual point solutions.

They can then ensure that security serves not just a company's ebusiness systems, but the company's business as a whole. www.wickill.com

Ian Kilpatrick, Wick Hill Group