Enterprises worried about cybersecurity should pay more attention to their own employees than to the as-yet unrealised threat of cyberterrorism, two cybersecurity experts warned a group of IT professionals yesterday.
Speaking at the Gartner IT Security Summit 2003, representatives of Gartner and the Center for Strategic and International Studies (CSIS) suggested that enterprises should worry more about their intellectual property leaking out through employees or small-time hackers.
CSIS director James Lewis said he has seen no evidence of large cyberterrorist attacks yet. "Kinetic weapons are much more effective right now," he added.
However, enterprises should be worried about attacks, whether they are from inside employees or outsiders because they have more property than individuals, and fewer ways to protect themselves than nations.
Enterprises are where the money is in cyber attacks, whether it be intellectual property, extortion or financial data, Lewis said, with loss of intellectual property and sensitive data the fastest growing cybersecurity loss.
"You get a lot of attention on cyberterrorism and Osama bin Laden sitting in front of a keyboard, but you ought to be more worried about insiders," Lewis said to close to 1,000 attendees of the Gartner conference. "The primary target is companies, and we probably put not enough effort into thinking about how to protect them."
Individual hackers will increasingly become another threat to both security and privacy because of their access to ever more powerful technology, added Richard Hunter, a vice president at Gartner and co-chairman of the conference.
By 2008, Gartner estimates home computers will have 40-GHz processors and 1.3Tbytes of storage, he said, leading to both beneficial and dangerous uses of home computers.
"That's enough to do data mining at home," Hunter said. "When we think about an environment that involves governments collecting information, that involves enterprises gathering information, we now have to think about an environment in which individuals are going to have significant power to gather and analyse and use information."
An enterprise's greatest strength and greatest weakness are often its employees, whether they make mistakes in not following security best practices or they have malicious intent, added Casey Dunlevy, project lead at the Cert Analysis Center at Carnegie Mellon University. Because of that, it's difficult for companies to come up with accurate threat models that can show them where to put their resources.
Dunlevy recommended that companies needed to prioritise their critical assets and should look into creating multidisciplinary teams that consider other security challenges such as physical security when drawing up a plan to protect critical assets. No company has enough money to "take the fortress mentality and protect everything", he added.
Dunlevy agreed with Lewis that cyberterrorism on its own may not be the top worry of most enterprises, but he suggested that cyber attacks could be a way for terrorists to supplement physical attacks. For example, shutting down a major city's traffic lights would be an effective way to create gridlock and multiply the impact of a physical attack.
David Perry, the global director of education for security company Trend Micro, said that small businesses and individuals should look for the same security protection and attention from suppliers as enterprises.
He recommended that small- and medium-sized businesses should demand that their internet service providers act as their enterprise when getting deals with large security companies.
Separately, Gartner released a study yesterday which said that 2003 will be the first year in history in which most industries will spend 5% of their IT budgets on security. Security spending will have grown at a compound annual rate of 28% between 2001 and the end of 2003, Gartner said, while IT budgets overall will have grown only 6% during the same time.
Perry added that it was in security companies' best interest to focus on selling their products to enterprises, not to individuals or smaller businesses.
"They say [enterprise security] is where the danger is, but what they mean is that's where the money is to sell their products," Perry added.
Grant Gross writes for IDG News Service