Security /

Security concerns dominate NW500 survey

Other key findings: storage needs skyrocket, mobile devices become mainstream, e-commerce spending expected to rise.

By Suzanne Gaspar
Network World, 05/07/01

Security is what keeps you up at night. Security is a top concern when you're implementing new technologies such as wireless or storage-area networks. And security is a key consideration in outsourcing decisions.

Wireless takes center stage (chart)
Top handheld issues (chart)
Selecting storage architectures (chart)
Top e-business challenges (chart)

NW500 In fact, security worries pervade just about every aspect of your job, according to the results of this year's Network World 500, our annual survey of 500 network executives.

"Systems can come down. . . . You need to watch out for e-mail viruses, and that was never an issue with the postal service," says Greg Youst, IT manager for e-commerce at educational loan provider Sallie Mae in Reston, Va. Sallie Mae has an online service that lets students and schools apply for and manage loans over the Internet.

Youst says security is on his mind all day. "If people believe I can't protect their information, why do business with me? If the site is down and we can't provide services, that's lost time and money,'' he says. Security is also part of the process when designing new systems and applications, he says.

As e-business becomes more important to a company's bottom line, security also rises to a new level of concern. The survey shows that 28% of transactions at traditional businesses - not dot-coms - are now conducted electronically, and one in four businesses say at least half of their transactions are conducted electronically. Youst says Sallie Mae is doing more online because customers want to do more online.

At the same time, two-thirds of respondents say they worry that their e-business activities are vulnerable to security breaches. And 87% say it's getting harder to ensure secure applications. For Youst, that means using VPNs, digital certificates and 128-bit encryption to secure connections and private information.

Other e-commerce-related results:

E-business spending averaged $58 million per company last year. That figure is expected to decline to $52.9 million this year, but rebound to $68.4 million next year.

The need to quickly increase e-commerce is driving some companies to outsourcers, but 72% of respondents say they host e-business applications in-house and 73% say they plan to continue doing so over the next 12 months.

The top reasons to go with an outsourcer for e-commerce applications are bandwidth, fast implementation and better performance. The top reasons to keep applications in-house are security, high availability and cost savings.

More than half of the respondents will have Layer 4 policy-based switches installed in the next two years to treat Web traffic requests more quickly and reliably.

More than half are using Web server collocation to ease their infrastructure woes. These data centers are viewed by 73% of the survey respondents as physically robust and secure.

Outsourcing:

For the 91% of network executives surveyed who are struggling to find qualified technical people, outsourcing is an increasingly viable alternative. According to the survey, nearly half say their level of outsourcing will increase over the next year.

Seventeen percent of the average IT budget goes to outsourcing, and 10% of respondents say they allocated 50% or more of their IT budget to outsourcing.

Wireless/mobility

Support for wandering workers is on the increase. Seventy-seven percent of respondents provide remote access to mobile staff, and 74% support telecommuters. Wireless access will be a top priority for 85% of respondents next year, and 44% are using handhelds for corporate network access.

Other mobile results:

Seventy-eight percent say their companies pay for handheld devices.

The security of stored and transmitted data is an important or very important feature of handheld devices, according to 84% polled.

When it comes to wireless, security features are important to 84% of respondents. However, the reliability of the wireless service is important to 93%, quality of service remains key to 90%, and 89% say geographic reach is the most important feature of a wireless service.

Storage

Network executives are concerned about security no matter what technology path they chose, and storage is no exception. Ninety-two percent of respondents said security is a key factor in selecting a storage architecture.

More than half surveyed expect their data needs to grow by more than 75% in two years, driven by the increase in Internet use and e-mail, followed by larger software packages and e-business applications.

Companies plan to spend an average of $7.1 million on storage in the next 24 months.

Forty percent have a SAN, and 28% plan to install a SAN within two years.

It's security that has Jerry Isaacson talking. Isaacson is the data security manager at the Massachusetts Institute of Technology in Cambridge, Mass. He says despite the fact that his SAN is running on its own network, he still worries about security.

Night terrors

What keeps network professionals up at night? Security and hackers were the top answers, according to the survey.

Security/hackers 24.40%

Network availability/uptime 20.00%

Reliability 11.60%

Availability/having enough bandwidth 5.20%

Keeping up with rapidly changing technology 4.80%

Too much work/lack of time 4.80%

Finding/training qualified technical personnel 4.00%

Equipment failure 3.60%

Money/resources 2.80%

Users/customer activity 2.40%

Loss of data 2.00%

Management/measurement of network performance 2.00%

As a virtually open system without firewalls, MIT's network is heavily armored in encryption, Kerberos and digital certificates, yet the Internet opens a hole a hacker can try to enter through, Isaacson says. Similar security holes exist with a dial-up or wireless connection, he says.

Isaacson says you need to balance security with usability. "We have students and professors who want to do things, and firewalls would restrict them."

He says new e-mail virus threats keep his mind spinning some nights. Despite using Network Associates' antivirus software, IT has identified and contained a virus on one or two campus machines.

Fortunately the school hasn't had an epidemic, but Isaacson says the potential for virus infection is greater today than ever before.

"On one Web site I saw 73 virus generation kits, many of which will build the virus for you," he says.

Sallie Mae's Youst agrees: "Up to five years ago, not many people knew where to go to download hacking tools," he says. "Today, people are looking for bragging rights or monetary gains."

At Sallie Mae, security is an integral part of the application development process. "All applications have flaws. . . . You have to evaluate the risk and decide what's the best way to meet the customer's need," he says.

The Network World 500 study was conducted by Network World and Research Concepts, LLC. It consisted of telephone surveys at companies with at least 1,000 employees and annual network-related spending of more than $10 million.