Internally, employees are the No. 1 threat, followed by employees who have just left the company. New programs and tools, which are widely available on the Internet, mean that only minimal knowledge and ability is needed to break into a site. In these cases, sites are overwhelmed by thousands of simultaneous erroneous but time-consuming messages. Traditional problems linger Old-fashioned theft is another external threat that Sullivan says companies must be more aware of. Internal threats often include attacks on Web sites or compromising of data, but Sullivan says not all threats are malicious or intentional.
Ignorance is a major threat to security.
If a person working with computers doesn't know as much about it as they think, they can easily make configuration errors, leading to lost productivity. Sullivan counsels increased training and limiting staff access to computers to counter this kind of threat. Sullivan says that security for too many companies is an afterthought, usually addressed only after they have been hacked. Security has to be taken seriously, and at the senior management levels. Security policy is the first place to start, he says.