Users are the weakest link, security experts warn

By Dan Verton

November 15, 2001 12:00 PM ET

Computerworld - Companies that would have trouble compiling a list of their networks' users and detailing the level of access that those users have don't know who is on their network and are sitting ducks for cybersabotage, a group of industry experts said today.

Weak user passwords, inconsistent policy enforcement and lackadaisical user access management have made corporate network users the No. 1 cyberthreat to sensitive business data, said experts during a live webcast today sponsored by Irvine, Calif.-based Access360, a company that specializes in resource-provisioning management.

"The user, while juggling even more IDs and passwords in today's environment, continues to be the weakest link," said Mark Ford, an analyst at the Secure eBusiness Group at Deloitte & Touche LLP in New York. "We must gain control of the weakest link before we end up in an identity crisis."

For example, dormant user accounts and accounts belonging to users who are no longer employed by a company are "the classic problem for cybersabotage," said Brian Anderson, chief marketing officer at Access360. "Those are the equivalent of locking the door but leaving the window open."

10 Steps to Prevent Cybersabotage

1. Act, don't react. Establish a reliable system for assigning access rights for critical company data resources.

2. Identify dormant user IDs and orphaned accounts.

3. Automate communications between IT, human resources and other departments. Link all who are responsible for granting access rights in departments.

4. Define "need to know." You can't assume that everybody should have access to everything.

5. Don't forget the sharing factor. Passwords get passed around.

6. Reset passwords regularly.

7. Make nondisclosure policies routine. These contracts should be brought to the attention of employees and business partners once a year.

8. Suspend terminated IDs.

9. Reconcile active IDs with reality.

10. Operate out of opportunity rather than fear.

Source: Access360, Irvine, Calif.

The growing problem of insider threats is no secret to most IT managers. In fact, in the most recent survey on cybercrime by the FBI and the San Francisco-based Computer Security Institute, 81% of corporate respondents said the most likely source of attack was from inside the company. In addition, the U.S. Treasury Department reports that insiders committed 60% of the computer intrusions reported by banks and other financial institutions in the first four months of this year.

The problem, said Mike Hager, vice president of Network Security and Disaster Recovery at New York-based Oppenheimer Funds Inc., is that corporations have spent about 80% of their security dollars to protect against outside threats when, in fact, 80% of all attacks come from the inside. The misdirection of resources has led to misperceptions about cyberthreats among senior executives, said Hager. "If we don't educate senior management about what the real threats are [then] we don't get support from them," said Hager. "That's the No. 1 threat."

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Mitigating Litigation Risk with Email Management Tools
Does your company have an email retention policy that protects it when litigation occurs? IDC discusses effective email retention policies and the role...

Managing And Protecting Your Ever Increasing Mobile Assets
Learn best practices for desktop and application virtualization, computer security, and computer life-cycle management....

Protecting Content During Business Disruption: Are You Covered?
Learn how ECM is helping Tulane University and the 13th Judicial Circuit Court implement disaster readiness programs....

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

Beyond PCI Checklists: Securing Cardholder Data with Tripwire's Enhanced File Integrity Monitoring
How do organizations pass their PCI DSS audits yet still suffer security breaches? Paying attention to PCI DSS checklists only partially secures the...

Best Practices for Managing Business Risks from the Use of IT
(Source: Symantec) Based on exhaustive benchmarks conducted by the IT Policy Compliance, this session highlights the relationship between business risks and use of...

Authentication as a Service by Forrester Research
Authentication-as-a-Service: understand the benefits of two factor authentication and the best ways to implement it....

Sun OpenSSO Enterprise Webinar
(Source: Sun) This webinar replay discusses Sun OpenSSO Enterprise innovation--the single, open-source solution that helps your business solve the challenges around internal access...

Sustaining SOX Compliance: Best Practices to Mitigate Risk, Automate Compliance, and Reduce Costs
Since the adoption of SOX, much has been learned about IT compliance. Discover how to make SOX efforts more effective in "Sustaining Sox...

Agile Enterprise Content Management (ECM) for Rapid ROI
(Source: IBM) Content rich business processes are a core feature of daily operations at just about any organization today. Very often these essential...

All White Papers | All Webcasts