Confronting the security risks

More businesses are adopting wireless technology, yet not all are keeping pace with the threats that could allow illegal access to the corporate network, according to research.

The fifth annual Wireless Security Survey of London shows an increase in the number of wireless local area network access points, but also that a quarter of businesses are still leaving corporate systems exposed (Computing, 25 May).

Hugh Penri-Williams, chairman of user group the Information Security Forum (ISF), says this is a problem facing many firms, and wireless is not the only risk.

‘With IT security it is not one particular threat or endemic problem that we face; it is about having to deal with a fast development pace of technology in business, compared with the speed that the security safeguards are developing,’ Penri-Williams told Computing.

The ISF, an independent, not-for-profit organisation established in 1989, was set up to address this very problem.

With 270 members, including half of the Fortune 100, the ISF is a conduit for large companies looking to address emerging security threats.

‘Instead of firms investing in individual projects, all the money is pooled and we work on our members’ behalf to undertake research and development and develop new tools and techniques,’ said Steve Thorne, head of the ISF management team.

So what are the emerging threats? In many cases it is lack of IT security policies and procedures, rather than a lack of technical problems.

‘Often it is an awareness issue rather than a technical one,’ said Penri-Williams. ‘Errors and admissions are a bigger threat than large outside attacks. It could be stupidity – someone breaking the system or leaving a disk with vital information in their car.’

Remote working and the breaking down of technological borders between business and home also presents new security challenges. Is a ‘walled castle’ approach to security still valid when accessed remotely via a PC that your children use at home, asks Penri-Williams.

‘You need to sit down first and analyse the threats and vulnerabilities of each asset in the company. Without the risk assessment it is very hard to come up with a solution,’ he says.

The Information Security Forum

*The Information Security Forum is a not-for-profit organisation of more than 270 users including 50 per cent of Fortune 100 companies. Members include British Airways, HSBC, HM Revenue & Customs and Tesco.

*Private and public sector members fund research programmes and pool knowledge to develop reports on information security.

*The Forum has created a library of 200 reports.