November 1, 1999

Printer ready

In Search Of More-Secure Extranets
From passwords to digital certificates, companies have more ways to protect sensitive data

By Kay Blough

Related links:

sidebar: Extra Steps Can Protect Extranets Network Policies Ease Management Secure Minds, Not Bits

ompanies can streamline their processes and speed development by setting up an extranet to share information with customers, partners, and suppliers. But they also increase the risk of a security breach by opening their systems to outsiders.

Few companies are more sensitive to security concerns than Lockheed Martin Corp.'s Tactical Aircraft Systems, which several years ago decided to bid for the contract to build a new fighter aircraft--called the Joint Strike Fighter--for the U.S. Defense Department. Eighteen months ago, the company began to build an extranet to develop, manage, and coordinate the proposal with suppliers and partners around the world. But it had two unusual security concerns: It was dealing with classified information, and some companies that were partners for certain aspects of the proposal will be competitors on other projects.

Lockheed Martin built the extranet using Livelink, a collaborative knowledge-management software from Open Text Corp. It runs on Windows NT and Unix platforms, and supports most popular relational database systems.

The company implemented a dual-password system for the extranet. One logon ID and a password are needed to get past the firewall, and a second logon ID and a password are needed to get to the proposal information.

In addition, Lockheed wanted data to be encrypted during transmission to provide additional security. So it set up a virtual private network connection to accommodate transmissions from British Aerospace plc and Northrop Grumman Corp.

So far, the extranet has worked well for stage one of the proposal process. "We see it as the tool of the future, and we are positioning ourselves to exploit that," says Graham Rutherford, integrated product team leader of data management for the Joint Strike Fighter program. "We have a nice running Web-based system, and we are flowing that down to our suppliers."

While Lockheed has to wait to see if it wins stage one, which involves building, flying, and testing concept demonstration aircraft, the company plans to use the extranet to go after the second and third parts, which involve designing, engineering, and manufacturing the Joint Strike Fighter project. "We expect to use this software beyond the concept development phase," says Mark Minnies, a technical team leader who worked on security. The system would follow the aircraft into service, so the life of the program could be 40 years.

As part of a threat analysis to assure the company that its internal systems wouldn't be compromised, Lockheed hired a company to try to break in. The attempt failed, Minnies says.

Overall, Lockheed says, the extranet has produced significant cost savings by eliminating the need to copy and distribute information involving the proposal. It also cut turnaround time by at least 90 days, Rutherford says.

While most companies don't have to deal with classified materials and military contracts, a growing number are confronting extranet security issues as more business is being handled electronically.

Ruesch International Inc., a nonbanking financial institution in Washington, specializes in handling foreign financial transactions, payments, and related services. For Ruesch, security was paramount. "Our average transaction is $13,000, while the average Web retail transaction is $29.95," says Ronald Szoc, senior VP for technology.

Ruesch decided to use an extranet for managing and executing international payments for its 2,000 to 4,000 RueschLink clients expected to be signed up by this time next year. The company considered a range of security options, including biometrics such as fingerprint or voice identification; smart cards; and one approach that required users to enter their personal identification number into a desktop reader every five minutes. But the company rejected those as too cumbersome. "E-business isn't about barriers," Szoc says.

continued...page 2, 3

Photo of Rutherford by Steve McAllister
Photo of Szoc by Stan Barouh

Back to This Week's Issue
Send Us Your Feedback
Top of the Page

---