Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

You Know These Security Threats--You Hired Them

While companies have for years invested in intrusion-detection systems and firewalls to create a shell around their networks, that isn't enough. Internal networks provide fertile ground for attacks on data and systems when threats manage to crack the shell or are introduced by employees or others with access rights. That's a reality that some companies don't want to admit exists.

A number of technologies and services are just hitting the market with the goal of firming up internal network defenses. Some inject intelligence into network security appliances in an attempt to stay a step ahead of security threats, while others aim to limit access to users.

"Most of the focus has incorrectly been on perimeter security," says David Langston, CIO of Allied Home Mortgage Capital Corp. "Anybody who's been involved in security knows that the vast majority of compromise events are generated internally." At Allied Home, internal network threats usually result from poor judgment, such as employees opening spam, Langston says.

U.S. IT pros suspect insiders were behind some security breaches and espionage in the past year


suspect unauthorized users or employees

suspect authorized users or employees

suspect former employees

Data: InformationWeek/Accenture Global Information Security Survey of 1,952 U.S. business-technology and security professionals reporting security breaches

Monitoring Behavior
Allied Home is an early adopter of Alert Logic Inc.'s Invision Security service, which becomes widely available this week. The Invision service relies on an appliance at a customer's site that uses algorithms written into Alert Logic software that search for malicious network traffic, unusual user-behavior patterns, and unauthorized network-configuration changes. Alert Logic staff remotely monitor that appliance from an operations center. When a potential problem is detected, such as a worm that's wriggled past perimeter defenses or a conflict between network access and user privileges, the Invision service can signal to network routers, firewalls, and switches to automatically block or quarantine certain traffic.

  • 1