Internal threats often include attacks on Web sites or compromising of data, but Sullivan says not all threats are malicious or intentional. Ignorance is a major threat to security. If a person working with computers doesn't know as much about it as they think, they can easily make configuration errors, leading to lost productivity. Sullivan counsels increased training and limiting staff access to computers to counter this kind of threat. Sullivan says that security for too many companies is an afterthought, usually addressed only after they have been hacked.
Security has to be taken seriously, and at the senior management levels.
Security policy is the first place to start, he says. Sullivan recommends assigning a priority to all sensitive information, and then concentrating on protecting the top 20 percent. The rest could be considered an acceptable business risk. Planning a counterattack Countermeasures Sullivan recommends include heightening the consequences of committing fraud, limiting access to computer systems and increasing monitoring. The FBI launched its Infra Guard program in Hawaii in March.