SAN DIEGO--At a "town hall" meeting at Gartner's ITxpo this week, the research firm brought out a dozen of its top experts to discuss the impact of the ongoing war with Iraq on business and IT. Unfortunately, only about 25 of the 1,700 conference attendees showed up.
Despite the nearly empty room, the analysts carried on.
Dan Miklovic warned that as the conflict in Iraq wears on, businesses will become more vulnerable. The culprits won't be cyberwarriorscyber warriors from Iraq, Miklovic said, but college students perpetrating cyber attacks as a form of protest.
French Caldwell drew parallels between wartime applications of technology and their use for business. "Technology is operating faster than the human decision loop," Caldwell said. "Technology can help clear up the fog of war, but there is still fog from the pace of operations and it's not thoroughly resolved in the distributed decision business model."
The U.S. government's ability to collect data in real-time, authorize attacks, and coordinate activities via satellite communications on various targets in Iraq was cited as a successful example of the faster decision making process. The best practices of knowledge management, decision support tools and collaboration come into play. For any business depending on distributed operations, the basic tools and practices can reduce the risk of failure.
Vincent Oliva said that the war would not have profound impact on the operations of financial services firms, although he did cite potential problems in currency destabilization and problems related to outsourcing payments flowing back and forth from country to country. Also, he noted that the war could trigger exclusion clauses that cancel insurance coverage related to terrorist activities.
John Dubiel noted that critical infrastructure security focuses on supervisory control and data acquisition, but presents more of a physical security than cyber security risk.
Bob Goodwin cautioned that new regulations that require requiring foreign ports to inspect cargo could add extra time, and costs, into supply chains. "It's still early to know if it will have a significant impact, but problems from a supply chain breakdown could be enormous," Goodwin said.
According to several of the Gartner analysts, many public and private sector companies are not taking the necessary precautions to secure their infrastructures and organizations.
A recent study by Zeichner Risk Analytics LLC found that 36 state governments have failed to prepare, adopt and implement adequate cybersecurity policies, as required by Congress in the Gramm-Leach-Bliley Act of 1999. According to the study, the states have fallen even further behind the Federal government and private industry in the last two years.
Those states may want to take lessons from a report from by Gartner's Victor Wheatman. He developed a list of the top IT security issues that corporations and government agencies need to consider in developing their strategies and compliance with the Gramm-Leach-Bliley Act.
Wheatman attributes some of the problems to the impact of the tough economy on purchase plans and buyer's remorse over failed security initiatives, often with over-hyped solutions. Following is Wheatman's list and issues related to each topic:
- Web services security: The standards for Web service security are emerging, but Wheatman recommends caution in deploying Web services across an extended enterprise in 2003. One of the problems with Web services is that they use HTTP, which usually gets a free ride through corporate firewalls.
- Wireless LAN security: Tales of breached wireless LANs have every enterprise concerned about exposing intellectual property and privileged communications to theft. Emerging wireless security schemes, such as WiFi Protected Access (WPA) and 802.11i, are on the horizon. Wheatman also notes guerilla movements to tap into wireless access locations for free.
- Identity management and provisioning: The majority of cyberattacks come from within an organization. Identity management and provisioning should be considered a first line of defense to deal with identity theft as well as DNS, denial of service and social engineering attacks.
- Role of security platforms and intrusion prevention systems: Security is evolving from point solutions and detection systems to full blown platforms that encompass a suite of functionality focusing more on prevention that merely detection.
- Correlation of events for reporting/monitoring/managing consoles: Several companies offer the ability to correlate information related to attacks from across several devices and parts of a network. This type of security monitoring provides a more intelligent, real-time analysis and the capability to act on the distilled data.
- The next Code Red/Nimda: Enterprise lost billions of dollars due to various worm and virus attacks in the last year. Minimizing risks in this area should be a clear priority.
- Instant messaging security: Instant message and other peer-to-peer networks pervade most enterprises and puts networks at risk, Wheatman said. A new generation of enterprise IM products are coming to market that will provide more secure communications.
- Homeland Security (industry-specific): The Department of Homeland Security is ramping up, and its influence will be apparent in several industry sectors.
- Tactical security to infrastructure security: Wheatman suggest that short-term attention to tactical security solutions give way to a focus on infrastructure security.
- Protecting intellectual property: Protecting digital assets, especially intellectual property, from espionage should be a security priority for any enterprise.
- Transaction trustworthiness/auditability: Wheatman predicts that recent corporate scandals will influence the application of information security techniques to improve the trustworthiness of enterprise transactions and the audit trail.
Wheatman suggests that companies getting back to basics by focusing on defining business needs and prioritizing security threats. The next step is finding the appropriate technology to address the particular security issue.
