InformationWeek
Defining The Business Value Of Technology
July 12, 1999
 Print this story |
Virus Attack
continued...page 4 of 6
As enterprise networks and systems become more extensive and complicated, providing effective security becomes more difficult. Threats can come from many directions and can be aimed at a variety of potential weak points. That has turned security--from both technical and process points of view--into a multilayered equation that covers everything from network devices to applications.
As a result, companies have been forced to use a variety of methods to ensure that only an authorized person can gain access to a network, system, or application. Passwords remain the most widely used technique to validate the identity of a users, with 65% of survey respondents using multiple logons or passwords to limit access to applications.
Some companies layer security systems one on top of another in order to make unauthorized access more difficult, but some IT managers say that approach isn't the most effective way to secure an entire system. "Each layer of protection is a separate card in a house of cards," says American Family Insurance's Shaurette. "Adding an extra card to the house doesn't necessarily make the house stronger."
The most effective way to secure a business application is to build or develop the application and its protective components together, experts say. Too often, security is added to business applications after the fact. However, a growing number of electronic-commerce apps are being built with security as part of the design.
Take the example of Bally's Gaming and Systems online sports gambling service, to be launched later this summer. Bally's, already a major player in the $600 billion-a-year casino business, wants to tap into the emerging online gambling market, which is expected to grow to $2 billion by 2003. But before the company can enter the new market, it has to meet certain security requirements.
Security is an integral part of Bally's wagering application because the law says it has to be. In addition to the normal protective measures an online company must take to conduct business over the Web, the gambling company is legally required to authenticate not just who places bets online but what jurisdiction they are in when they access the wagering system. "We had our security specifications mapped out before we even knew exactly what the application was going to be," says Tony Fontaine, VP of applied technology for Bally's.
The law prevents the company from starting a wagering system on the Internet, so Bally's created a private intranet application that members can access via browsers to place bets on sporting events. Because only people 18 and older can gamble legally, Bally's first needs to authenticate a person's age and that the person attempting to access the system is actually a member of its private system.
Illustration by Teofilo Olivieri
Security is growing as a priority. Information security ranked as a priority in 60% of the companies responding to the survey, up 56% from last year. Despite that ranking, information security still gets shortchanged by many companies, including large enterprises. The survey shows that 33% of companies with more than $500 million in annual revenue are spending less than $100,000 this year on security, including staffing, consulting, and technology. Overall, however, the survey shows that most companies are spending more money on security than they did last year (see chart, below).
Related links:
The survey shows that protecting a network from unauthorized access is by far the top priority for most companies, with more than 90% of respondents saying their companies focus security spending on preventing outsiders from gaining access to their systems. The No. 2 priority is protecting key data.
continued...page 5, 6
return to page 1, 2, 3
Back to This Week's Issue
Featured Microsite
