Fortunately, just a week before the attack, Parker had downloaded ZoneAlarm, a free personal firewall package made by Zone Labs Inc., of San Francisco. The firewall was configured to restrict access to applications from the outside and to alert the user when access was requested. Thus, the worm couldn't get in.
|Lessons learned about off-site Internet security |
| || |
Install personal firewall software on all home-based and mobile PCs that contain corporate data or that will be connecting to the corporate network.
| || |
Disable file sharing on telecommuter's PCs so no unauthorized person can enter a computer that has an always-on connection.
| || |
Monitor the use of firewall software, either through centralized management features built into some products or via in-person checks.
| || |
Install anti-virus software and ensure that updates reach remote users.
| || |
Institute encryption for secure messaging.
| || |
Institute secure authentication to prevent hackers from stealing passwords to the corporate network.
| || |
Create a clear and concise statement of corporate data security policies. Review the policy with employees frequently.
"It was a close call," Parker says. "By the next day, I'll tell you, every one of my associates had the program installed. In addition, we created a rule that stated that every e-mail attachment had to have a note attached to it that, by its tone and content, would signal to the recipient that it was legitimate and safe." A cat-and-mouse game
Unfortunately, in larger, more traditionally structured corporations, managing and monitoring security may not always be as simple.
"Most medium to large corporations have at least a working understanding of security needs," says Richard Karon, a Plano, Texas-based analyst with Perot Systems Corp., who consults with companies on security issues. "Security is far more than just technology; it's a process and it's diligence. Sure, corporations have firewalls on their servers. But are they watching the logs every day? Do they have written security procedures and policies for their employees? Even more, are they actually making sure employees understand the procedures?"
Karon stresses the need for companies to take a centralized approach to security, no matter how decentralized their environments, thereby removing the onus for software installation from busy users with other things on their minds. For that reason, he promotes the use of firewall software that can be installed and monitored from a central location, such as VPN-1 SecuRemote from Check Point Software Technologies Ltd., of Redwood City, Calif.
"By setting policy centrally and pushing it to the desktop through the corporate VPN, you avoid much of the human factor," Karon says. "You'll always have users who are not adept at installing software, are too lazy or busy to, or who are downright rebellious. With centralized installation, you can often make it entirely transparent to them; they don't need to know how to configure it," he says.
"The hard fact is that security will always be a cat-and-mouse game. You can come up with a new fix for a security breach, but the bad guys are always finding new ways around it," says Karon. Connectivity marches on
None of the industry experts expect security concerns to reverse the movement toward greater use of technologies like DSL or cable connections, or to prompt companies to cut back on telecommuting. They do expect, however, to see security features bundled into other products and services and to become nearly ubiquitous.
"Soon, IT managers will be able to say to users, 'Here, take this piece of software and use it to connect to the corporate network from anywhere via any sort of connection,'" says IDC's Germinow. "That software would encompass a VPN client, a personal firewall, intrusion detection, and file encryption."
In addition, Germanow predicts that by 2005, the cost of providing security technology to remote users will decrease dramatically or disappear, as security features increasingly are bundled into connectivity solutions offered by Internet service providers or cable-service providers.
"The real reason IT managers have to think about providing firewall technology is because whoever they're buying connectivity from isn't providing it," Germinow says. "But that will change. Soon, users will receive the technology as part of an integrated solution, first for an extra fee, but eventually just as part of the base price."