Keep IT managers on top of security

Computerworld - In this series of articles, I'll examine the knowledge that typical IT managers and directors need to have about information security. Subsequent articles will explore this subject in more detail by describing some of the ways IT managers can obtain this knowledge and use it to better protect their information assets.

Let's dive right into a scenario:

Each of two recently merged companies has a data center in a different city. As the process of merging information from the two companies begins, an executive asks the IT manager to make customer data on the servers in the other data center immediately available to analysts in the local data center. He wants it today.

The IT manager, a former hands-on systems administrator, thinks on his feet and says to the executive, "Yes, we'll have that working before the end of the day."

The two data centers have Internet connections and firewalls, and the IT manager asks his administrators to set up an NFS (network file system, a network-based file sharing tool) over the Internet connections and through the firewalls so that the other server's databases will appear to be present on the local server. In a few hours, the distant server's databases are virtually present on the local server and available for business analysts to begin mining.

Peter H. Gregory, CISSP, CISA, is an information technology and security consultant, a freelance writer and an author of several books, including "Solaris Security," "Enterprise Information Security," and "CISSP for Dummies." As a consultant he provides strategic technology and security services to small and large businesses. He can be reached at p.gregory@hartgregorygroup.com. His Web site is www.hartgregorygroup.com. Join an online discussion on this column.

Quick solution over security

Every IT manager has at one time or another sacrificed security to achieve a quick win. While such a decision may be justified, much of the time, security simply isn't considered. Industry has bred a generation of IT managers who are evaluated on how quickly they can put together last-minute solutions. The problem with this approach is that the quick solutions are rarely secure, though they frequently make their way into production and stay there without further changes.