Enterprises worried about cybersecurity should pay more
attention to their own employees than to the as-yet unrealised
threat of cyberterrorism, two cybersecurity experts warned a group
of IT professionals yesterday.
Speaking at the Gartner IT Security Summit 2003, representatives of
Gartner and the Center for Strategic and International Studies
(CSIS) suggested that enterprises should worry more about their
intellectual property leaking out through employees or small-time
hackers.
CSIS director James Lewis said he has seen no evidence of large
cyberterrorist attacks yet. "Kinetic weapons are much more
effective right now," he added.
However, enterprises should be worried about attacks, whether they
are from inside employees or outsiders because they have more
property than individuals, and fewer ways to protect themselves
than nations.
Enterprises are where the money is in cyber attacks, whether it
be intellectual property, extortion or financial data, Lewis said,
with loss of intellectual property and sensitive data the fastest
growing cybersecurity loss.
"You get a lot of attention on cyberterrorism and Osama bin Laden
sitting in front of a keyboard, but you ought to be more worried
about insiders," Lewis said to close to 1,000 attendees of the
Gartner conference. "The primary target is companies, and we
probably put not enough effort into thinking about how to protect
them."
Individual hackers will increasingly become another threat to both
security and privacy because of their access to ever more powerful
technology, added Richard Hunter, a vice president at Gartner and
co-chairman of the conference.
By 2008, Gartner estimates home computers will have 40-GHz
processors and 1.3Tbytes of storage, he said, leading to both
beneficial and dangerous uses of home computers.
"That's enough to do data mining at home," Hunter said. "When we
think about an environment that involves governments collecting
information, that involves enterprises gathering information, we
now have to think about an environment in which individuals are
going to have significant power to gather and analyse and use
information."
An enterprise's greatest strength and greatest weakness are often
its employees, whether they make mistakes in not following security
best practices or they have malicious intent, added Casey Dunlevy,
project lead at the Cert Analysis Center at Carnegie Mellon
University. Because of that, it's difficult for companies to come
up with accurate threat models that can show them where to put
their resources.
Dunlevy recommended that companies needed to prioritise their
critical assets and should look into creating multidisciplinary
teams that consider other security challenges such as physical
security when drawing up a plan to protect critical assets. No
company has enough money to "take the fortress mentality and
protect everything", he added.
Dunlevy agreed with Lewis that cyberterrorism on its own may not be
the top worry of most enterprises, but he suggested that cyber
attacks could be a way for terrorists to supplement physical
attacks. For example, shutting down a major city's traffic lights
would be an effective way to create gridlock and multiply the
impact of a physical attack.
David Perry, the global director of education for
security company Trend Micro, said that small businesses and
individuals should look for the same security protection and
attention from suppliers as enterprises.
He recommended that small- and medium-sized businesses should
demand that their internet service providers act as their
enterprise when getting deals with large security companies.
Separately, Gartner released a study yesterday which said that 2003
will be the first year in history in which most industries will
spend 5% of their IT budgets on security. Security spending will
have grown at a compound annual rate of 28% between 2001 and the
end of 2003, Gartner said, while IT budgets overall will have grown
only 6% during the same time.
Perry added that it was in security companies' best interest to
focus on selling their products to enterprises, not to individuals
or smaller businesses.
"They say [enterprise security] is where the danger is, but what
they mean is that's where the money is to sell their products,"
Perry added.
Grant Gross writes for IDG News Service