4. Discounting internal security threats
IT managers focusing on external threats can easily lull themselves into a sense of false security. According to Gartner,
70 percent of security incidents that incur actual losses are inside jobs, making the insider threat arguably the most critical
one facing the enterprise.
Of course, not all insider threats are born of malicious intent. In September 2004, HFC Bank, one of the United Kingdom’s
largest banks, sent to 2,600 customers an e-mail that, due to an internal operator error, made recipients’ e-mail addresses
visible to everyone else on the list. The problem was compounded when customers’ out-of-office messages -- containing home
and mobile phone numbers -- responded to the mailing.
Even malicious acts are often carried out using very little technical sophistication. In a joint study released this year
by CERT and the Secret Service, 87 percent of insider security breaches were found to have been achieved using simple, legitimate
user commands, suggesting that IT needs to be vigilant about granting only necessary privileges to end-users. Identity management
with specific permissions can help.
5. Failing to secure a fluid perimeter
IT’s responsibility now extends to Starbucks and beyond. The increasing mobility of workers, combined with the proliferation
of public wireless hotspots and broadband in the home, means that IT is now responsible for securing systems on networks it
does not control. In this environment, solid security means implementing host-based firewalls that will provide some level
of protection on an unsecured broadband connection at home or at sites with public Wi-Fi access.
If you’re an experienced IT manager, you might feel comfortable with the top-of-the-line firewall you purchased three years
ago. You configure it to block all incoming traffic except port 25 for inbound e-mail, and your employees generally make outbound
WAN connections to the Web via ports 80 and 443. This is a common approach, but in a more decentralized IT environment, centralized
approaches to network security are no longer sufficient. By encrypting traffic on your internal LAN, you will better protect
your network from insider threats and from intruders who might have hopped onto your network via rogue wireless access points.
6. Ignoring security for handhelds
Although even inexperienced IT managers recognize the need for username/password authentication on network resources and desktop
and laptop PCs, most IT shops still seem to be in a “wild West” phase when it comes to handheld devices.
A CTO of a wireless software company tells us about a venture capitalist who lost his BlackBerry on a business trip while
he was in the middle of closing a highly sensitive, confidential deal. The BlackBerry wasn’t password-protected, so even after
the panicked venture capitalist contacted his IT department to have e-mail delivery to the device stopped, anyone who happened
to pick up the lost BlackBerry could read e-mails already received.
In this case, the minor convenience of not requiring a password had major implications. Ignoring the security of easily lost
devices, particularly those belonging to key executives that traffic in confidential information, is a recipe for disaster.
7. Promoting the wrong people
As CTO or CIO, rewarding your top technologist with a promotion to a management position might seem like the right thing to
do. But when a technologist is not ready to give up constant, hands-on technology work in favor of more people-oriented management
duties, it could be a mistake you’ll regret on many levels.
One vice president of IT painted a grim picture of such a decision: The promoted employee could be resented by former peers
and might not like the new management duties, which could lead to poor performance. Even worse, the new manager might feel
compelled to cling to the ill-fitting position because the old position might no longer be available.
Just such an experience put this particular vice president in the tough position of having to deal with a new manager’s performance
problems, which led to a double whammy: A top technologist left the company, and the new manager still had to be fired.
Management training can help avoid such disasters. But use your gut. Either the aptitude is there, or it isn’t.
E-mail
Printer Friendly
Reprints
(InfoWorld) - In the litigious world we live in, deploying a unified communications platform in your enterprise could...
