Security nightmares to continue in 2002

This year will be worse than 2001 for security problems, a conference was told this week. Despite increased awareness following the events of 11 September, enterprise IT staff can expect 2002 to be just as tough as last year.

At the Sun ONE-sponsored security summit in London, speakers warned of more woes with little to cheer in the fight for more secure systems.

Slow progress towards security standards would be matched by a continuing struggle to make a clear business case for improved security provision to board level executives.

"There is a lot of publicity around security threats and legal issues," said Gary Hardy, director of technology risk consulting at Andersen. "But the costs are still often unknown and the business case is hard to pin down. There is a fear of taking on a project that overshoots the budget."

Mark Critchard, a partner in Andersen's legal technology practice, predicted a much greater enforcement of compliance with existing privacy legislation. He said there were many data privacy issues related to how to keep data updated, with high requirements inside Europe but not elsewhere.

"There won't be a silver bullet for viruses," said David Perry, global director of education for virus specialist Trend Micro. "We have started seeing new hybrid viruses and this has sent everyone back to the drawing board to produce hybrid protection."

But while Perry said that internet service providers (ISPs) should be offering far more virus protection, Critchard pointed out that legal barriers to filtering information at the ISP level existed, particularly in the European Union, so they were reluctant to get involved.

Public key infrastructure (PKI) was hotly debated with doubts expressed about the business case for its implementation by most companies.

But John Bullard, of security enabling specialist Identrus, said that 11 leading banks have now signed up to its software that incorporates PKI, and that this will spread to trading organisations.

"We are living in an internet neighbourhood. Sending a [Microsoft] Word file internally is not secure," said Hardy.