The Internet Rules but the Emperor Has No Clothes

Today’s Internet is a virtually free resource. Its existence is based upon end-users freely communicating in an open environment. However, this free and open environment does not imply any value beyond the ability to communicate. Thus most of the information currently being exchanged is not deemed “valuable” in the business sense. However, as more and more business-related information is made available on the Internet, the exposure of that information to unauthorized disclosure or modification becomes a real issue. What a competitor or opponent may discern to be of value establishes a threat to any non-trivial communication. Opponents can decide what information is valuable to them whether or not the owner recognizes the threat. The crowning achievement in the Internet is the complete, wide open interconnection between information resources and end-users. Yet it is this very interconnection which renders the Internet an unsuitable repository for valuable information. To use an analogy from the familiar tale, “The Emperor’s New Clothes,” the Internet/Emperor is well connected, but he apparently does not recognize the need for security/clothes. There is no lack of solutions to this distressing situation: adequate technology exists to clothe the Emperor, but many tailors are idle. One can only hope that customers will demand, and that vendors will produce, an abundant number of secure solutions. Implications of a Wide Open Internet In light of the voluminous discussion surrounding the growth of the Internet, it is easy to recognize a growing dependency on the Internet. Yet businesses have been reluctant to embrace the real value of Internet communication: electronic commerce. The lack of effective computer security on the Internet is a primary force inhibiting the implementation of information technologies in today’s business environment. In particular, there is no rapid growth of electronic commerce. The lack of trust surrounding security for Internet applications is forestalling what otherwise might be significant progress toward electronic commerce. In contrast to what is occurring on the public Internet, more and more corporations are storing valuable electronic documents and transactions on local area networks (LANs). Many are even setting up corporate “intranets” for easy internal access to information. The corporate information being stored on and exchanged over these private and semi-private computer networks is increasingly valuable. As with Internet connections, increased levels of connectivity bring increased risk and vulnerability, even to LANbased information. Primarily, the risks and threats come in the form of attacks by maliciously inclined users or actively malicious software. When It Pays to Be Hostile When asked to identify the primary threat to the security of networked computer systems, many people point the finger at high school aged “hackers” armed with personal computers and modems. But amateurs who try to break into your system for the fun of it don’t pose nearly as much threat as dedicated individuals and groups motivated by the prospect of financial gain. The commercial value of the intellectual property (products and trade secrets) that will become available electronically will provide a strong motivation for new classes of attackers. As the value of the information stored on information systems increases, so does the threat of deliberate, malicious attacks on those systems. Some of these attacks will undoubtedly originate with agents external to the organizations that own and use the networked systems and resources. To safeguard valuable information against malicious attacks, there is a growing need for both hardwareand software-based protections that prevent any unauthorized monitoring, modification, or disruption of a company’s computer activities. When Software Is Malicious In a distributed computing environment, there is significant opportunity for malicious software to intervene between user and data, thus subverting the intent of well-meaning users. For exampIe, such software could be introduced as an authorized user gains access to intellectual property such as a computer program or entertainment product. The intruding software could then transmit the program to a third party, thus undermining the integrity of the licensing transaction and making it impossible to tell exactly who has gained access to the information and what actions an individual actually took and is accountable for.