South Florida Business Journal

Protecting your Business in Cyberspace
By Margaret Grisdela
This article was originally published in The South Florida Business Journal on April 23, 1999

As "e-commerce" moves to the forefront as the storefront, senior executives need to implement totally new forms of business protection. Viruses, hackers, spam … these are just a few of the emerging business risks in today's digital age.

Security should be high on the priority checklist as web sites, intranets and extranets expose potential vulnerabilities 24 x 7. Here are five guidelines to successfully protect your growing electronic business.

#1. Prevent attacks before they happen

External hackers can try to break into your network to damage your web site, steal secrets or discredit you. Take the embarrassing example of a fur coat manufacturer's site damaged by animal rights' activists.

eBay Inc., the online auction firm, revealed last year that its site was hacked by a college student who successfully guessed the password to an administrative account, ultimately giving him root access.

How to protect yourself? "Manage your firewall carefully", warns Mike Bilger, IBM Practice Leader for E-Business Security Services. Maintain the latest in anti-virus software on every PC, including a scan on incoming email.

Internal disgruntled employees can also try to gain access to highly sensitive data like payroll or customer lists. Make sure your network is properly segmented and maintain strict password protection.

Passwords should be changed regularly. A random combination of numbers and letters create passwords that are hardest to crack. Employee access codes should be carefully protected and never shared or taped to a PC. Encrypt all confidential data like administrator passwords before transmission over the network.

#2. Evaluate the security of all partners

"Don't overlook your business partners, since your network is only as strong as the weakest link," cautions Bilger. You may be exchanging purchase orders, inventory or financial information with multiple partners. Make sure their security is as strong as yours is. A clause about network security should be in every new partnering agreement, including your right to audit a partner's security systems.

#3. Update your insurance

"Information assets become more important than physical assets in cyberspace," notes Emily Freeman, E-Business Expert at Marsh Technology Group. Protect your intellectual property, customer lists and software R&D, all of which will typically be stored in electronic format. Think about it - in a digital world your most important electronic assets can actually be stolen but still left intact!

Standard insurance policies will not provide adequate coverage for today's high tech risks. Look for an insurance company that offers new products designed specifically for electronic commerce.

#4. Take privacy seriously

The FTC is a leading advocate for privacy policies, which it claims are necessary to give consumers confidence in how their information is used. IBM is also taking a lead in calling for standardized privacy statements (see www.ibm.com/privacy). Truste is a non-profit organization that recommends industry standards in privacy policies (see www.truste.org).

Geocities was actually forced by the FTC to give visitors the choice to "opt out" of site registration after it started selling data contrary to intended use.

International privacy guidelines are stricter than U.S. standards in many cases. The European Data Privacy Directive, effective in October 1998, prohibits the export of personal data to countries without privacy controls.

Sounds simple but consider the complicated case of travel agent Sabre Group Inc. Sweden ruled that travel agents using the system had to get written customer permission before transferring reservations data to its Texas headquarters.

#5. Use a Disclaimer and Make it Enforceable

There may be specific terms of use or legal considerations that you want visitors to abide by, such as the means of settling any disputes. "Use a click-through device to record user acceptance," recommends John Ottaviani, head of the Technology Group at Edwards & Angell LLP. Good examples of this can be found at online brokerage sites.

E-commerce is rapidly becoming the new business model of choice. Be aggressive and ever vigilant when it comes to securing your Internet-based transactions!