We have to shift the emphasis on IT security to larger discussion about business risk. Why? Because we associate IT security with things that have become a very small subset of a much larger and continually growing circle of information technology risk.

Think this is just pointless semantics? Consider this: We have been trained over time to associate IT security with certain actions--protecting the perimeter of the data center, for example--and certain products--intrusion detection, encryption, firewalls, anti-virus software, etc.--that are all merely tactical and do not address any of the real strategic issues in protecting people and organizations from threats.

Here's an example: Ask consumers what they should be doing about internet security and they'll probably say (if they even know) that they should install firewall and anti-virus software on their computers and keep them updated. Few, if any, of these people would consider a wireless router to be a security device, yet the risk that wireless routers pose to their safety online is much higher than the risk that something will sneak through anti-virus software.

In this study, researchers Rajiv Shah and Christian Sandvig found that only about 50 percent of consumers changed the default settings of their wireless routers to switch on encryption and rewrite the default administrator passwords that are easily available to anyone with an internet connection and a web browser. It's also pretty easy to find people's router locations--there are maps of them available.

Wireless routers represent a huge, emerging risk even though we still don't think of them as part of security. An open router is like a key to the kingdom, "a gateway for eavesdropping, redirection to fraudulent websites, and traffic profiling. These capabilities grant the attacker nearly total control over how the network’s clients interact with the Internet," writes Markus Jackobsson, an academic and security consultant in this chilling report.

But there's been no shift in the configuration of routers since they were originally introduced--when the extent of their risk was considered to be only that some freeloader would jump on and hog your bandwidth. Routers haven't made it into that small circle that we think of as IT security, so the larger risks aren't addressed.

By limiting our scope to IT security rather than risk, we ensure that the emphasis remains tactical rather than strategic. What's the tactical response to open routers? Provide consumers

You do not have flash or javascript support.

Average (4 votes)

Reply