The enemy within. (Security).

These days security is often top of the IT Manager's to-do list with most businesses, regardless of size, implementing firewalls to protect the company network from outside hackers, encryption to safeguard data sent externally and group policies to control who has network access and when. However, too many companies are overlooking the very real threat to IT security that comes from within the company itself.

According to recent research commissioned by Oracle, internal security breaches present the largest threat to compromising data within a company. More than half of the sample surveyed felt internal security breaches were a bigger threat to business than external ones. This is not really surprising: who knows most about the company's computer system, it's security loopholes and points of penetration? Its (former) employees. Over the past 18 months the IT industry has seen a spate of layoffs and with it, a rise in 'work rage', usually manifested in attacks on the company's IT system. Last year it was reported that three local government websites in Wales were the victims of simultaneous hacking attempts carried out by disgruntled employees, when obscene messages were posted across the councils' homepages. In America, a third of San Francisco was recently plunged into darkness after an employee sabotaged an electricity substation, and in yet another case, a worker stood trial after allegedly planting a computer 'bomb" that deleted software, costing his employees more than $10million in sales and contracts.

Internal security breaches are not always an act of revenge. Human nature is naturally curious and if employees know that confidential information is stored on the corporate network, most will probably attempt to access it. An American company was reported to have set up a fake server in an experiment to attract the attention of hackers, but IT bosses were shocked to discover that the company's CEO had paid a visit. One of the main factors responsible for the high occurrence of internal security breaches is often just pure stupidity. A common sight in any business, large or small, is a post-it note stuck to the computer screen with the computer username and password written on it. Other typical security errors include failing to change a password from the default, encrypting data but leaving it on a machine in an unencrypted format or locking it with a blank password, or failing to change system passwords during updates. Such simple errors can cost a company dearly.

What's more, with the current trend towards remote working, huge amounts of confidential information are being stored on portable computers, PDAs, etc., which are taken outside the protection of corporate security. This creates even more security risks as these devices are often lost or stolen. There's also the possibility of these portable devices being able to bring malicious software straight back into the corporate network because the user is a trusted party..

How, therefore, can companies safeguard against so many potential internal threats? The following five, easy steps, should be enough to cut down significantly on internal errors:

1. Analyse The Risk

The first step in combating internal security breaches is to know the risks, and how the company network is exposed to those risks. Who has access to what and when? Is remote access provided for mobile workers, if so, who and how many? How are those remote users authenticated? A simple audit of your network and its usage patterns will soon identify the key internal threats it faces.

2. In code

A simple way to protect sensitive or confidential data from prying eyes, is to employ some form of data or file encryption solution. The easiest to deploy is a software-only encryption method, which can be used across multiple sites giving end-to-end encryption. Some software-only methods are also platform independent, which means your choice of firewall, routing, switches and other security measures, is not being dictated.

3. The Tool Kit

There is a range of vulnerability assessment tools on the market that can perform rigorous system examinations, to identify potential security violations. In addition, intrusion detection tools can provide supplementary layers of protection by monitoring system and user activity, statistically analysing abnormal activity and recognising activity patterns reflecting known attacks. In order to get complete protection from viral threats, it is also worth investing in an anti-virus scanner that monitors all tiers of your corporate network including workstations, file servers, email and laptops. This will ensure that you pick up on any infections brought into the system by email or by users of portable machines.

4. Security As A Service

With so many potential security risks, companies need security that can he distributed easily. Security should he provided as a service that is completely transparent, integrated, automatic and reliable for the end-user, and at the same time centrally administered and defined by the system administrator. In effect security should be a utility service like electricity, gas or water: it's there without users needing to know how it works or how it's delivered.

5. Maintenance

Once a secure system has been set up, it is vital that the organisation maintain the hardware and software. New forms of attack are continually evolving, finding new and more damaging ways to infiltrate the network. It's no use simply introducing a system and hoping for the best. If you are to stand any chance of remaining secure in the face of technological advancements, the system needs to be upgraded as quickly as the new attacks are being invented. www.f-secure.com