Not long ago, at the height of the dotcom boom, you could chart the rise and fall of companies by looking at the garish artwork sprayed on the walls of loft buildings in San Francisco’s Multimedia Gulch district. But now, thanks to wireless technology, there is a better way. Driving around the city on a warm night a few weeks ago, Bill Cockayne, a Silicon Valley veteran, opens his car’s sunroof. His friend Nathan Schmidt posts what looks like a small fluorescent tube through the open roof and plugs it into a laptop computer. “Metro/Risk”, says the computer in a clipped female voice as the car makes its way through North Beach. “Admin network. BCG.” Then a robotic male voice booms out: “Microsoft WLAN. Archangel. Whistler. Rongi.”
These are the names of computer networks in offices and homes that have been fitted with wireless access-points, which can provide Internet access to users within range (typically, within 100 metres or so). Mr Schmidt’s computer is configured so that open access-points, which can often be used by anyone within range, have their names spoken by a female voice; closed ones, for which a password is required, are read out by a male voice. Most of them are open. Mr Cockayne pulls over, and Mr Schmidt connects to a nearby access-point and calls up The Economist’s web page.
This kind of wireless networking, using the so-called Wi-Fi protocol, has become immensely popular over the past two years, the technology crash notwithstanding. Many companies and individuals leave their access-points open deliberately to enable passers-by to share their Internet connections. Open a laptop in New York, San Francisco, Seattle or many other large cities around the world and you may well be able to get online free. But although Wi-Fi is liberating for users, it can cause security problems.
Adding an access-point to a network costs less than $200 and is very simple — so simple, in fact, that “rogue” access-points have started to sprout on corporate networks without the knowledge of management. A survey by Computerworld, an industry magazine, found that 30% of American companies had identified rogue access-points on their networks. And if these are left open, they provide a back door past the firewall into the company’s network. Rob Clyde, chief technology officer at Symantec, says that half of the chief executives at a recent round-table event cited Wi-Fi as a top security concern.
This is just one example of how a new technology can bring security problems in its wake. There are plenty of others. Some firms are opening up their networks through online business-to-business exchanges, for example, where they list what they want to buy or sell and invite bids. Everything from paper clips to car components is bought or sold in this way. There is widespread agreement that “web services”, in which companies open up their core business processes directly to other firms over the Internet, will become increasingly important in the next few years. But by opening its systems to outsiders, a company may also attract unwanted visitors, or attacks from nosy competitors.
Joint ventures, in which two firms collaborate and share information, can also cause problems. A recent report by Vista Research cites the example of an American car maker that established a joint venture with a Japanese firm and opened up its network to allow in employees of its Japanese partner. But the design of the American firm’s network allowed access only on an “all or nothing” basis, so the Japanese firm’s employees ended up with access to everything.
Handheld computers are another problem. They are often used to store sensitive data such as passwords, bank details and calendars. “The calendar is a fundamental loophole,” says Doug Dedo of Microsoft’s mobile devices division, because it may contain entries such as “meeting with company X re merger”. Another problem associated with handheld computers is that their users carry them into the office and plug them into their computers, bypassing anti-virus systems and firewalls. A virus-infected document stored on a handheld computer could then start spreading. Similarly, peer-to-peer file-swapping networks such as Gnutella, instant-messaging services that zap messages and files across the Internet, and web-based e-mail systems such as Hotmail all provide new routes into a company’s network that can be exploited by attackers.
There are plenty of technical fixes available. Handheld scanners can be used to track down rogue access-points, and legitimate access-points can be secured against outsiders by using virtual-private-network (VPN) software. A lot of work is being done to ensure that web services are secure, including, improbably, a joint initiative by rivals Microsoft and IBM. Anti-virus and firewall software exists for handheld computers, which can also be password-protected. And firewalls can be configured to prevent unauthorised use of peer-to-peer and instant-messaging services.
All these threats arise from a common factor: the distinction between the “public” parts of a company’s network (such as the web servers where its home page resides) and the private core (which is accessible only to employees) is quickly eroding. “The cultural and technological trend is towards more porous companies,” says Gene Hodges, president of Network Associates, a large security-software firm. As firms connect with their suppliers and customers, “the more you open up, the more you are exposed.”
Airports, Not Castles
The classic notion of perimeter security, in short, is fast becoming obsolete. Alan Henricks, chief executive of Cenzic, says the shift is “from keeping people out to bringing people in a trusted fashion”. Nand Mulchandani, co-founder of Oblix, another security firm, puts it more colourfully: the “big walls, moat and crocodiles” approach of the past few years, he says, is now outdated.
The latest thinking is that rather than seeing their networks as castles, large organisations should regard them as airports. People go in and out all the time, some areas are more secure than others, and as people pass from one area to another they have to present their credentials: tickets, boarding passes or passports. Apply this approach to computer security, and instead of an “exclusive” model in which you try to prevent people from doing things they shouldn’t, you have an “inclusive” model that lays down who can do what, and only lets certain people do certain things.
In the old days, says Tony Scott, chief technology officer at General Motors, computer systems were used only internally, and managing who was allowed to do what was simple. But with the recent proliferation of systems, and a greater reliance on suppliers and outsourcing, the number of users who may need access to a company’s systems has grown rapidly. “On top of that, most modern companies now have their actual business processes deeply embedded in their systems,” he says. Indeed, their business processes are the systems. According to Mr Scott, “All these forces working together create a huge problem. Who is accessing these systems, and how can I manage it?”
One outfit offering solutions to this identity-management problem is Silicon-Valley-based Oblix. Its software sits between users and a company’s existing software systems (accounts, inventory, e-mail, and so on). Using a big database that includes information on who can do what, it makes sure that users can do only the things they are meant to do.
It sounds obvious, but it has two advantages: it means users need to log in only once, rather than into lots of separate systems; and it centralises and simplifies the management of user privileges. For example, a division manager who hires or fires an employee can instantly update that employee’s access privileges, rather than having to ask the systems department to make changes to a number of separate systems.
Responsibility for security can thus be devolved to managers and form part of their everyday management duties. Management is all-important, says Mr Mulchandani, because if your eyeball reader correctly identifies a sacked employee but his access privileges have not been revoked, you have a security failure on your hands. Oblix’s software is used by a number of large firms including General Motors, Boeing and Pfizer. Identity-management systems are also available from other vendors, including Novell, IBM and ActivCard, whose smart-card-based offering is used by America’s armed forces. The technique does not do away with the need for traditional security measures, but it provides an additional line of defence, particularly for large organisations that have to deal with a lot of users.
More importantly, identity management is an example of how technology can be used to align security procedures with business processes. Security thus becomes the servant of management. Security decisions must ultimately be taken by managers, not technical staff. The big decision, and the most difficult to make, is how much time and money to spend on security in the first place.