One of the largest challenges facing UK businesses is IT security. As a business becomes increasingly reliant on the data on its systems, it faces ever-increasing threats to the network and data integrity.

Everyone is aware of the issues in the media regarding internet usage and the security of our electronic data that we store or transmit to 3rd parties. These perceived issues are almost the same; it’s just the scale of the solution that differs and therefore the cost. So is it really an issue or are we just scare mongering?

The simple answer is both ‘yes’ and ‘no.’

Is my computer and its data at risk?
Yes it is if you don’t take reasonable steps to protect it. Would you leave your home unlocked? Of course not, but nevertheless this simple analogy holds true to computers and systems that are at risk if you ‘leave the door wide open’.

So how do I ‘shut the door’ to my PC network and lock it?
Some simple steps will effectively reduce the risk to an acceptable level – we must protect our data and limit the amount of risk, but without spending very large amounts of money. The solutions differ slightly between the home user and the business user but in this case I will focus on the business.

Using analogies again lets think of a bank. When it comes to protecting the money, banks place their highest security closest to the actual money – the bank vault door with complex alarms, together with the front of house security- a simple lockable door, a visual deterrent in the form of a security guard, some cameras and likely some toughened glass protecting the bank clerks.

This is referred to as a multi layered approach that allows and encourages normal people into the bank, but in turn discourages the robber with a difficult path to the money.

This analogy holds true to IT systems and the data they contain. IT security should be tiered with multiple levels of security from the front door to the bank vault.

So how does this really translate from IT speak into real world? Firstly email, we all use it, in fact in a recent Microsoft study it was determined that email was the number one use of a PC. So if email is important we needs to take steps to ensure the emails we receive are relevant to the business:

Spam
We need a device or a service from a provider that “cleans” our emails of spam, this device or service should also remove viruses at the same time, therefore ensuring what you receive in your inbox is relevant.

Now these systems aren’t 100% perfect, therefore any system implemented must be able to learn and needs to be simple to use/administer. We then need to extend this protection to the actual PC as another layer in the form of a suite of software that blocks and inhibits spyware, viruses, malware, spam etc.

This software needs to be adaptive to the threats and learn quickly, it also needs to talk to a central system with status information.

Our security doesn’t end there, we almost certainly have internet access at work, well if we can get out to the internet it is logical that the internet can get to us, so we must now also take steps to protect our computer network and its data from the outside electronic world:

Firewalls
Firewalls are as their name suggests are walls that stop fire/heat spreading throughout a building or vehicle. So in IT this device stops the Internet from getting inside your computer network. These devices vary considerably in features and price and one size does not fit all!

Best practise would dictate a relatively simple (fast) device is placed closest to the internet to undertake simple security blocking tasks (like the front door to the bank), then closer to the users you would place a more complex device (like the bank vault) that can undertake a very fine inspection of information flowing in.

These complex devices can also inspect/block what is going out from your network, which can be a useful productivity and security tool if your staff are surfing the Internet at potentially unsafe web sites that could contain spyware and viruses.

So these devices and ideas are the starting point of formulating an IT security plan and policy, each business is unique and each requirement and its solution is different from the next.

Are the risks real?
Yes they are. The use of professionally written, intelligent and well executed viral code is becoming widespread. These code writers use the same processes and procedures a professional application developer would use to ensure the highest quality virus.

Infections today are less openly destructive than they used to be as the writers now know that they can extract useful and valuable data that has a financial worth, like credit card details. Infected machines have allowed these people to undertake money laundering, remote access to internal database systems, allowed terrorism to be funded and other criminal activities.

These attacks are not just limited to small time ad-hoc efforts but they can be streamlined targeted affairs for a particular purpose. This type of criminal activity is rapidly becoming mainstream, the number of detected viruses over the past two years is almost equal to all the viruses detected since they started recording such information.

The approach above is typically through email or web sites but we haven’t mentioned direct attacks i.e. “Hacking”. Here people try and exploit security weaknesses in your Firewall, computers or even people, they could attack your network via a home worker whose PC is unchecked and insecure (this method was used many years ago to illegally access Microsoft’s network). They can also use a “blended” attack where they use a virus to allow backdoor access through your firewall and then use a Trojan Horse type of attack from within. There must be many security hurdles in place to thwart a determined hacker from gaining access to your network or as the military would say defence in depth.

Security is large subject matter, but to put matters in to perspective it is all about risk, what risk is your business willing to accept and there will always be some. This answer alongside your business type and what you do for a business will help determine the solution.

By Graham Fern
Director, Axon IT

Posted: Telegraph Business Club