TIGHTENING YOUR INFORMATION SYSTEMS SECURITY.

By Dr. Rachna Kumar, associate professor of Information Systems, United States International University, San Diego, California 

Computer viruses and denial of service attacks this year have shown just how vulnerable information systems are to relatively unsophisticated methods of attack. Any server connected to the Internet makes it and the rest of the enterprise network vulnerable to access from unauthorized and malicious users. Indeed, the probability of the occurrence of security breaches has increased phenomenally over the past few years. A 1999 survey by the Computer Security Institute reports system security related losses to the tune of $124 million for the 163 organizations that participated in their survey. Security breaches can come in the form of virus attacks, fraud, or just plain network break-ins. The recent I LOVE YOU virus attack was a resounding warning to organizations of the potential havoc that can be wrecked on their systems by such hackers and virus attacks.

Organizations take several standard measures to protect their Internets and intranets. Installing firewalls, using updated virus checking programs, and using secure transaction protocols such as Secure Sockets Layer (SSL) are some of these measures. Companies in the business of systems security even hire professional hackers, called "black hats," and give them legitimate jobs to work on hacking, changing them into "white hats." The white hat hacker's discoveries can then be used to build security software that includes protection against these new potential threats.

Clearly, information system professionals should know what measures to take in order to protect their networks. This is particularly important for small and midsize organizations because they cannot hire experienced security professionals with top-notch qualifications. However, there are several developments in the security industry, which enable an organization to protect itself simply and cost effectively. One trend is the introduction of security software that provides "self-service" vulnerability assessments. This software can be executed to conduct an audit and risk assessment of the internal network security as well as of an external penetration. MyCIO.com is one such security vendor. A second development is the existence of certification bodies to certify minimum proficiency of security professionals. The International Systems Security Certification Consortium (ISC2) is a non-profit organization that administers the Certified Information Systems Security Professional (CISSP) certification program. The System Administration, Networking and Security organization has established a similar program, certifying professionals for System Network Assurance.

A recent report by the Gartner Group on tightening security for small and midsize enterprises provides advice on how to plug security holes in your organizations. Here are some of their pointers:

* Consider contracting with an outside security company or consultant to conduct a security audit of your networks;

* Ensure proper firewall configurations by focusing on firewall appliances; request quotes for managed firewall and intrusion detection services from your own Internet Service Providers or from security consultant companies;

* Virus scanning of incoming e-mail using server-side antiviral protection software; desktop antiviral protection is also good but it is difficult to keep this software current;

* Consider software to detect and guard against Common Gateway Interface (CGI) scripts and active server code security vulnerabilities;

* Consider using consolidated modem pools instead of desktop modems in order to allow remote login/access with strong authentication using hardware tokens such as RCA Security SecurID;

* Conduct firewall log analysis and e-mail content filtering to detect misuse and alarming usage patterns.

For more information, call [phone] or visit http://www.usiu.edu.