More importantly, these tools can breed complacency. If disgruntled employees or unscrupulous competitors want to hack into your network, chances are they'll do it from the inside. Another security firm recently cracked the loan files of a major bank by sneaking in at night with the cleaning crew and installing keystroke monitoring tools on the bank's PCs. Verio's Lee recalls one company he worked with in which half the people who knew the passwords for core business routers were contract employees. Traitorous techies can also install a sniffer on a desktop PC, run it during the workday, copy the resulting log files back to disk, and analyze these at home.
Companies often focus so narrowly on data and applications that they overlook the dangers of e-mail.
Feldman recommends carefully limiting the number of recipients of e-mail concerning sensitive subjects such as competitive strategies and product announcements. Even personalized e-mail services from Yahoo, Microsoft, or Excite can compromise security if they are used for business purposes. Nobody logs these password attempts, so you can just keep cracking away. Even worse, many people use a single password for all their many accounts. If a hacker steals your Yahoo password, for example, and it's the same one you use to log on at work, that hacker has just gained entry to your network.