Forget SARS -- worry about the BAGLE_WORM -- everything is a target!
If Raymond Chu - Product Marketing Manager with the Advanced Technologies Group of Cisco Systems Asia Pacific had his way, wed be constructing a 'virtual moat around our hotels, and positioning electronic guards at a variety of checkpoints so as to avoid being hacked. So serious is the threat of malicious intrusion into ones network, server, PC or notebook that just a single line of defense is without doubt just not good enough", he says.
(PRWEB) April 9, 2004 --If Raymond Chu - Product Marketing Manager with the Advanced Technologies Group of Cisco Systems Asia Pacific had his way, wed be constructing a 'virtual moat around our hotels, and positioning electronic guards at a variety of checkpoints so as to avoid being hacked. So serious is the threat of malicious intrusion into ones network, server, PC or notebook that just a single line of defense is without doubt just not good enough", he says. In fact, some industry pundits claim that you can place a brand new PC on the internet, and within a few minutes, someone or more appropriately, some thing will try and hack into it. Thats not surprising when according to the Network Associates website - more than 81,000 threats exist today" -- now thats what I call scary!
Being almost a daily occurrence, we hear of computer viruses (some of the most famous and prolific being Melissa", I Love You" and Blaster Worm") which will cleverly masquerade themselves as something less sinister attempting to outwit the less tech savvy amongst us into lowering often limited defenses or beat those (somewhat puny ones) we already have in place so that they can worm their way through our networks causing destruction and devastation.
This state-of-the-art form of terrorism is considerably smarter, faster and potentially more damaging to humanity than the type which brandishes a box cutter or AK47, or maybe even those suicide fanatics we hear about who strap C4 around their waists. The creators of these malicious brats (which seem to have nothing better to do with their time) stealthily float around cyberspace at light speed knowing no boundaries, and uncaring about race, creed, religion or color. The consequences of such acts are so overwhelming, that they can cause denial of service attacks on websites, forcing companies to shut down with huge financial and social consequences. It is estimated that in 2003 global losses from viruses were US$13 billion and global incidents in the first three quarters of 2003 over the total number in 2000 were +700%. Increase in loss due to denial of service attacks since 1999 were +2000%. A horrific example of this modern day phenomenon is the Slammer Worm which infected 75,000 hosts in the first eleven minutes with the infection rate doubling every 8.5 seconds causing network outages, damage to ATMs, cancelled flights, and some businesses had to slow down or close for weeks.
The list of aliases that these folks dream up is limitless, with some being known to label themselves as a software patch from Microsoft that you must immediately install to prevent hacking" when in actual fact, that is exactly what they are -- a virus.
Most often when these harmful critters get into our systems, they will harvest email addresses from local files and spoof the 'from address, so that when we receive emails they may lull us into a false sense of security appearing as though they come from a known sender. Some may even attempt to download a backdoor from a remote web site whereby someone can easily get back into your machine (at a later date) and undetected.
Rightly so, we used to think that passwords were the best thing since sliced bread when it came to protecting access to computers and data, and to a certain extent that still holds true. But remember, passwords are like toothbrushes, and they should be changed every three months. And not just with ones birthday or pets name or even a favorite type of food. They should be at least 8 digits in length and a combination of letters and numbers with some folks I know adding in a few symbols for increased complexity. Your System Manager through the effective use of operating systems (and without any extra cost to the business) most likely already has the ability to force users to change passwords every so often. Do you know if this is set up on your system? When was the last time you were asked to change yours?
Whilst Hotels have probably not yet been on the radar screen for potential hackers it may not be long before they are knowing what rich content is stored on the PMS, Accounting, Sales and Catering and HR/Payroll systems.
Based in Hong Kong and with over 14 years of experience in the business, Chu is responsible for the product marketing and business development for Cisco security products and solutions in the Asia Pacific. He is often called upon to speak at security events, and give interviews like this one. So when I met up with him at his office he told me, that the establishment and enforcement of company policies plays a significant role when it comes to the securing of networks". For example, at the very basic level you need to know who and what has access to your networks and systems from inside and outside of your hotel. One mustnt be so naïve as to believe that all attacks are external -- just putting up a perimeter defense wont do it -- you need integrated security intelligence at all layers with devices inherently having their own protection -- a self defending network -- with omnipresent guards". The results of a US based 2003 FBI Computer Crime and Security Survey showed that 22% of attacks originated internally. Disgruntled employees do exist, and in many cases can all too easily infect your network with a virus not necessarily from a syringe, but instead uploaded from everyday objects like floppy disks, CDs or USB Thumb drives.
There is also a real possibility that people could be stealing and selling your data to competitors or a dastardly person who is doing who knows what with the personal details of the guests that have stayed in your hotel. Just imagine how valuable your guest history or corporate account information is to the open market...so it needs to be protected in much the same manner your General Cashier does with physical cash.
If you want to sleep as soundly at night as you expect your guests to in their heavenly beds, then you have to realize that network security is just as important as the physical security of your building with some form of patrolling burly guards. However, in reality, patrolling just the perimeter of a network is no longer good enough, since with the advent of the internet, a network no longer has a defined edge or boundary. One other key reason for this is the coming about of WAPs -- wireless access points.
Stories have floated round for a while now whereby rogue wireless access points have been surreptitiously connected to networks (by staff, 3rd party engineers or unwelcome intruders) that allow virtually undetected remote access to networks and siphoning of data. In all honesty could your Security Chief and IS Manager place their hands on their hearts and swear that these do not exist on your LAN? Do they employ identity management techniques which manage each and every LAN port so as to be 100% sure whats plugged in?
Most likely in one form or another, your hotel is connected to the outside world and I really hope you have a Firewall, with stringent controls in place so as to police what data can flow into and out of your property. I would imagine you already have a back door policy that monitors what physical goods can come in and out --and from time to time you may conduct 'bag searches. But as responsible managers do you know what type of data is blocked or allowed to pass through the back door of your network? Bear in mind that Emails are not the only mechanism for viruses to penetrate your defenses -- instant messaging is another channel where viruses can slip in, and data can slip out - without your knowledge. Whilst this innovative technology can save you communications costs and improve productivity, it could also be the vehicle used for such acts of cyber terrorism.
Speak with your IS Manager and see if it make sense to deploy tools that can block annoying pop-ups. A simple and free version of such a tool is available from Google.
We must also consider what impact the Guest broadband network has on the hotel. Do you allow your guests to download any file type they want, and visit any website they care to? Can the guest who accesses your broadband network see other guests on the network, or maybe the PCs or other devices on the hotel LAN? Check with your IS Manager or broadband provider if for added safety and security that each room has been set up as a VLAN, meaning that in its own right its a virtual independent network that cannot be seen or accessed by others.
Chu adds, Remote access and Teleworking is an every day occurrence on networks, and by virtue of allowing such access to your networks, you are potentially opening yourself up to abuse". Make sure you have the policies and procedures in place and physical barriers to prevent unauthorized access". Remember, that if people can remotely access your network, so can they remotely access your data, and do with it what they want".
Chu adds by saying, There has to be more emphasis placed upon it (network security)". Richard Clarke, former Special Advisor to the President of the United States for Cyberspace Security once said, The average amount of money, as a percentage of revenue that companies spend on IT security is .0025%, or slightly less than they spend on coffee." Industry norms suggest that security costs as a % of 2003-2004 IT budgets should be as follows: Smaller organizations 11% and larger organizations 6-7% (source Meta Group, Inc., 2003)
Chu recommends, Start by conducting a security posture assessment to uncover vulnerabilities. Look for the breaking points, and where there are risks. You may even have equipment that has embedded security which has not been effectively deployed. If you dont have the in-house expertise, then consult with industry experts and partners seeking their advice on appropriate technologies and solutions like IDS (intrusion detection systems), IPS (intrusion prevention systems) Firewalls and identity management techniques. Make sure the technologies you deploy get updated on a regular basis and are easy to manage."
Gone are the days when its man versus machine - its now machine versus machine. Humans alone are no longer capable to defend you against the growing number of threats -- your network needs to be intelligent enough to automatically defend itself by sensing potential attacks, alert administrators and dynamically reconfigure themselves by re-routing data -- in the blink of an eye.
Dont delay -- the walls have ears 隔墙有耳.
terence@pertlink.net
|
