Part 2: Security response in a midsize office
Computerworld -
How can you make security more effective under the constraints of a small or medium-size company?
In Part 2 of this series, we look at this environment and at the similarities and differences with the home-user case discussed in Part 1 (see story).
Small and medium-size businesses probably have no dedicated security staff. Their attitude toward security is to try to stay out of trouble. In this sense, small and midsize companies handle security the way people handle the security of their home office systems -- but with important differences that I'll outline below. These businesses often have employees who would astonish security professionals with questions such as, "Why would somebody want to hack us? We have nothing that would interest hackers." Today, most IT professionals understand that server disk storage, CPU cycles and high-speed network connections have a lot of value for malicious hackers and alleged cyberterrorists.
Even though they're small, these businesses are more regulated and have more administrative requirements than a private citizen in a home office. These requirements might include responsibilities to shareholders, fear of litigation for breach of contract, professional liability and many others. Thus, the level of security and accountability would need to be higher than in a home office. Most organizations connected to the Internet now have at least one firewall and some sort of DMZ setup for public servers (Web, e-mail, FTP, remote access). Many are deploying intrusion-detection systems (IDS) and virtual private networks (VPN). All these technologies raise new concerns about what to do with signals coming from them, since companies rarely hire new security staff just to handle those signals.
![]() | |
| Anton Chuvakin, Ph.D., GCIA, is a senior security analyst at a major information security company. His areas of expertise include intrusion detection, Unix security, forensics and honeypots. In his spare time, he maintains his security portal www.info-secure.org. |
Ideally, security reports should focus on attacks that are more serious and that actually have a chance of succeeding (unlike, say, exploits for services that are not installed). A central Syslog server (for the Unix environment) would be valuable; and using freeware tools such as Logcheck from Psionic Technologies Inc., Swatch and logsurfer could help in handling a flood of logging
Security
Additional Resources



White Papers & Webcasts
Share our Strength
Download Now
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
Top 10 Things to Know about Data Protection
Download Now
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...
Ponemon Study: The Business Risk of a Lost Laptop
Download Now
Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.
Airport Insecurity: The Case of Lost Laptops
Download Now
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

