In the March issue of Legal IT (Netting a cure), I
discussed how to counter the threat of viruses and worms by deploying a managed secure e-mail service. In this article, I would like to focus on the security environment needed to ensure that such security investments provide their expected level of return. This is aimed at showing how companies that have a small central security function, such as partnerships, can still achieve uniform and adequate levels of security.
A common security situation
To do this, we will present a case study of a company that was quite badly hit by the Nimda worm back in September 2001. The company is a global manufacturer of consumer products, one of the top three in its market, with offices in more than 30 countries around the world.
Despite the size of the business, its IT security function was small and had limited funding. It often found it hard to mandate security solutions and standards. Hence, given its spread of geographies and cultures, the installed base of IT security solutions was uneven at best and non-existent at worst. Therefore, it came as no surprise that from the moment Nimda appeared, the infection spread throughout the company and within hours the global network had to be brought down.
The impact was immediate. The business found its core systems were offline, manufacturing faced close-down within 72 hours and key people in the London head office were pulled off business-as-usual to join in the firefighting. The board, which had spent little time discussing IT security issues in the past, was not happy. It wanted to know, and in short order, what had happened, why it had happened and what needed to be done to deal with the crisis.
