Since personal computers became mainstream and moved onto office desks, network security has been an issue that is mostly over-looked or simply given lip service. That was true twenty years ago and it is true today. For every company or agency that has an effective network security program, there are thousands that don’t. In the new world of the Internet, that creates huge problems for everyone.

Security for networks and for PC’s used to focus on the problem of software virus propagation, with physical security a distant second, and data backup an even more distant third. Companies such as Symantec, Norton, and Computer Associates developed anti-virus software and with the proliferation of viruses, an entire industry was created. Sharing files on diskette was the primary “vector” for computer viruses, with sharing files on networks the second most common “vector.” One simply did not share document files without first running a virus scan, if you were at all serious about protecting your systems.

The Internet changed all that, and not for the better. Anyone who has been paying any attention at all to the news lately is aware of major disruptions in service caused by internet “worms” and viruses, as well as early attempts at “cyberwar” attacks on government and commercial systems around the world.

The problem is so serious that the “network security” industry is exploding. The literally uncontrolled growth of the number of powerful and cheap computers combined with the enormous growth of the Internet has created a gargantuan pool of vulnerable systems.

The MIT website provides estimates of the “internet population” that saw a growth from 1.3 million internet “hosts” in January 1993 to 9.5 million “hosts” in January of 1996. Other sources place the number of Internet “hosts” in January of 2002 at approximately 150 million. In this case, a “host” is defined as a computer with a registered IP address.

Network security threats can be broken down into two broad categories: internal and external. How you deal with each of these will depend on the systems to be protected. A single “hobby” computer has a different risk level and set of vulnerabilities than say, a bank’s internal network. If the single computer and bank network are not connected in any way to “the outside” then the vulnerability is greatly reduced. If the bank computer network is connected through a private line to a central processing center, then it becomes moderately more vulnerable to intrusion. If that same network is exposed to the Internet, it becomes a potentially juicy target for abuse by criminals.

In the case of “isolated” networks, security breaches have been almost uniformly committed by “insiders.” Disgruntled employees who sabotage critical systems have become almost clichéd. Single computers in small offices or at home are more likely to fail due to electrical problems or “operator error.”. As soon as a computer or network touches the Public Switched Telephone Network (PSTN) it is a whole new ballgame.

In the Internet world, “firewalls” are used to limit access to networks or critical network elements, and form a first line of defense for critical systems. Their application will be driven by the systems and network elements to be protected. The scope or level of protection will also be driven by balancing the need for access to and from the Internet, with the importance and risk tolerance of the network element. In the case of banks or hospitals, for example, risk tolerance is extremely low, and security is a premium.

There are a wide variety of methods to protect networks and network elements, from hardware, to software, to network layout and design. Just as there are a correspondingly large number of potential vulnerabilities, and a correspondingly large number of potential solutions. The only sure way to avoid a computer security breach is to turn off the computer and never access the Internet. That obviously is not a good solution. We live in a “connected world” with a “connected economy.” Network security can no longer be ignored.

For more information on network and Internet security issues, access the following sites on the Internet: www.sans.org; www.cert.org; and www.netsecurity.about.com

Future articles will cover elements of an effective computer security plan. Pay attention. It’s important.