Home > Security

Computerworld - How can you make security more effective under the constraints of a small or medium-size company?
In Part 2 of this series, we look at this environment and at the similarities and differences with the home-user case discussed in Part 1 (see story).
Small and medium-size businesses probably have no dedicated security staff. Their attitude toward security is to try to stay out of trouble. In this sense, small and midsize companies handle security the way people handle the security of their home office systems -- but with important differences that I'll outline below. These businesses often have employees who would astonish security professionals with questions such as, "Why would somebody want to hack us? We have nothing that would interest hackers." Today, most IT professionals understand that server disk storage, CPU cycles and high-speed network connections have a lot of value for malicious hackers and alleged cyberterrorists.
Even though they're small, these businesses are more regulated and have more administrative requirements than a private citizen in a home office. These requirements might include responsibilities to shareholders, fear of litigation for breach of contract, professional liability and many others. Thus, the level of security and accountability would need to be higher than in a home office. Most organizations connected to the Internet now have at least one firewall and some sort of DMZ setup for public servers (Web, e-mail, FTP, remote access). Many are deploying intrusion-detection systems (IDS) and virtual private networks (VPN). All these technologies raise new concerns about what to do with signals coming from them, since companies rarely hire new security staff just to handle those signals.

	Anton Chuvakin, Ph.D., GCIA, is a senior security analyst at a major information security company. His areas of expertise include intrusion detection, Unix security, forensics and honeypots. In his spare time, he maintains his security portal www.info-secure.org.

Security responses for such an organization would likely focus on high-severity threats. While it's well known that many low-severity threats, such as someone performing port scans, might be precursors to more serious attacks, such as an attempted break-in, a small company would rarely have the personnel to investigate those types of incidents.
Ideally, security reports should focus on attacks that are more serious and that actually have a chance of succeeding (unlike, say, exploits for services that are not installed). A central Syslog server (for the Unix environment) would be valuable; and using freeware tools such as Logcheck from Psionic Technologies Inc., Swatch and logsurfer could help in handling a flood of logging