Internet & Intranet Security Management - Risks & Solutions

The survey results were analyzed by industry and by the position of the respondent in his/her
company. The industry results suggest a wide variety of approaches to security, access, encryption,
and protection techniques. The results on an industry basis are presented in Table 2.
Security policy responses were generally the same across the four industries. There was, again, a
significant discrepancy on the amount of training, with public sector and telecom wanting more
than was currently offered. There were also differences in password handling, with public sector
and telecom having less stringent requirements for password protection.
Security implementation varied across the industries, with significant differences in access to the
Internet, use of firewalls, virus checking, e-mail policies and data encryption. Respondents from
energy suggested the strongest set of security measures including frequent contact between system
auditors and end users, while the public sector seemed to have the least rigorous measures in place.
Personal security activities suggest there is high awareness of the importance of security. Public
sector respondents had significantly more access to the Internet and made heavier use of encrypted
information. There was also a significant difference in changing individual passwords, with
telecom lagging.
Respondents were also asked to identify the areas of greatest threat to their organizations. System
malfunction was identified most often as the greatest risk, followed by unauthorized disclosure and
denial of service. Respondents were also asked to identify the areas in which they felt their
organizations were focusing the majority of their security efforts. They identified alteration of material
as the highest focus followed by unauthorized disclosure and denial of service. The unauthorized
disclosure and denial of service overlap the threats and focus questions. Surprisingly, the major focus
appears to be in an area these respondents did not feel was the greatest threat and the greatest threat;
system malfunction was only fourth of the seven areas for focus. This may suggest some rethinking of
the security issue (see Table 3).
Conclusions
The results of this study suggest that employees have a strong sense of the importance of the
information asset, the need for all employees to be aware of security as an important issue, and a
fairly strong general awareness of security issues.
Results suggest system level threats were of greatest concern. System malfunction was identified
most often as the greatest risk, followed by unauthorized disclosure and denial of service. Fraud or
theft and regulatory or contractual exposure were of the least concern. By contrast, respondents felt
that the organizational focus on security was greatest in protecting against alteration and then
addressing unauthorized disclosure and denial of service, with system malfunction receiving a very
low priority.