The computer screen illuminates his face in the dark room. He isn’t wearing a ski mask and he isn’t armed with a crowbar. He keys in a few numbers, clicks the mouse and types in a few more numbers.
In seconds, he’s in your network. He might not even be in the same state or the same country, but he plows through your financial, medical and customer records as if he is surfing the Web. It’s every business owner’s nightmare.
Internet technology spawned a whole new breed of nonviolent but equally dangerous criminal. Commonly called hackers, those more familiar with the lingo know these crooks as crackers.
”A hacker is somebody who can write in assembly language code like C,” says Rob Herman, chief operating officer at Totem Network Security in Akron. ”It doesn’t necessarily mean you’re doing bad things with it. A cracker is the technical term for someone who is an evil hacker.
”There is another group out there called script kiddies. These are the guys that will go out and find the vulnerability, and they’ll create a script you can download and run against the network. They don’t need to be very knowledgeable at all. They can still find enough information out there.”
It’s clear that the technology to trespass moves as fast as the technology to safeguard your network. Herman says the security process requires vigilance on the company’s part, especially if its network contains vital information about the company or its clients.
”It’s a matter of how important your data is to you and how much you want to spend,” Herman says. ”There are new vulnerabilities found every day, and people will go out and find them.”
Here are Herman’s tips for keeping crackers and script kiddies out of your network.
Start inside
Lots of companies have computer security in place but don’t have a policy outlining what to do if that security is violated. A security policy helps employees understand the boundaries and where in the system they can and cannot go.
Most important, it’s in writing. Not only will the policy help deter internal computer crime, it will give you legal leverage if your system is attacked, Herman says.
Check for leaks
If you don’t have a full-time technology officer, have a network specialist come in at least once a quarter to look for loopholes in your security.
Last year, 40 percent of computer system attacks came from the outside, according to a survey by the FBI and the Computer Security Institute. That’s a 15 percent increase from the previous year. The trend indicates that a security check from the outside to look for Internet weaknesses is just as important, if not more important, than securing your network from within, Herman says.
”We’ve seen companies that have all of its servers, its network, everything is available from the Internet,” Herman says. ”From my house, I could type that IP address and get into that (router) box. With those guys, it wasn’t a matter of luck, it was a matter of time.”
Intrusion detection
Most companies install a firewall and stop there.
A firewall is good for one office, but if there are multiple offices in different locations, installing a virtual private network is a good idea. A VPN allows two or more offices in different locations to communicate over a scrambled or encrypted line.
Once multiple offices are linked over a VPN, install an intrusion detection device to alert you if someone is trying to tap into your network’s traffic.
”It’s programmed to recognize certain patterns,” Herman says. ”If it sees that, it will throw up a red flag in real time. It can send e-mail or you can configure it to shut off traffic from that network. That can be dangerous stuff. If nothing else, it can let you know something strange is going on.”
Cisco Systems Inc. claims the largest market share of intrusion detection systems, but Check Point Software Technologies Ltd. is a growing company in the field.
The bottom line is simple: You can’t afford not to protect your company’s intellectual property.
How to reach: Totem Network Security, (330) 668-1846; Computer Security Institute, (415) 947-6320
