The range of threats to business data has sharply increased in recent months, pushed by the increasing sophistication of hackers and thieves, and now by the specter of terrorism and cyber warfare.

There are micro and macro issues here–issues of employee data theft and vandalism and the bad luck disasters of storm and fire. But there are also sinister threats to the communication infrastructure that could have tremendous impact on business, even by just impeding the flow of electronic data. Relentless cyber assaults by viruses, worms and Trojan horses not only bedevil systems administrators, may do far more harm in the future as hackers improve their nefarious skills.

FRIED Contents of fireproof safe at Gruzen Samton turned to ashes after WTC attack. (Photo courtesy of Jordan Gruzen, Gruzen Samton LLP, Architects)

"People don't realize how unbelievably dependent we have become on these systems," says John Voeller, chief knowledge and technology officer at Black & Veatch, Overland Park, Kan. The Internet serves businesses so well that some are discarding older skills and tools, such as plotters, he adds, and becoming totally dependent on electronic transmissions instead.

Hacker assaults on the Internet in recent months are "babycakes," Voeller says, compared to the damage conceivable with software sitting around today. The rapid spread of last summer's Code Red worm and the "Nimda" virus, which clogged servers and degraded service reliability on Sept. 17, reveals the perils of Internet dependence. "What contract liability are you exposed to if it takes three days to get your drawings into the system?" asks Voeller. "What happens if you miss the evaluation date because of a slowdown of the network?" Business data is clearly at risk, but businesses are not without protection. Maintaining redundancy is probably the first line of defense.

In the widest sense, business data encompasses all of a company's information stored on paper or in electronic files. Electronic project documents obviously need to be safeguarded, but also of critical importance are accounting systems, archived records, contracts, insurance policies, software registration codes, correspondence, contact lists, photographs and employee records. The need to protect data, much of which is on servers just across a firewall from the Internet or bottled up in hard drives or storage vaults, has never been greater. Incidents of data theft and vandalism by disgruntled employees are on the rise. Now, worries about fire and destruction by natural disasters have been joined by real concerns and similar losses, from terrorists.

"It is a myth that buildings and people were the sole target Sept. 11. It also was the economy," warns Ed Jopeck, director of security analysis and risk management with Veridian, an Arlington, Va.-based information technology security consultant. Jopeck's Information Solutions division has 1,900 engineers, trainers and specialists providing security services and information and infrastructure protection for the U.S. Defense Dept. and various intelligence agencies, as well as some state and local governments and companies.

Jopeck spoke Oct. 18 to a Business Week-sponsored symposium in Chicago discussing the future of the Internet. Business Week is owned by the McGraw-Hill Cos., which also is ENR's parent. "An attack on one sector of the economy has a cascading effect," he told attendees. "Our economy lives on proprietary information–it's our competitive edge–and those things are at risk."

IMPACT. Principals of companies physically impacted by the destruction of New York City's World Trade Center know exactly what Jopeck means. They are taking lessons from the experience even as they rebuild. "Our biggest worry before this was the potential disgruntled employee," says Michael Gelfand, a partner in the architectural planning and interior design firm Gruzen Samton LLP.

The firm's two floors of offices across the street from 2 WTC were gutted when the collapsing tower showered the building with burning debris and blew out windows (ENR 10/8 p. 20). The 120 employees were evacuated safely and data backed up in the company's Washington, D.C., office was secure. But not so lucky were files, plans and tapes stored in a fireproof cabinet and safe in Manhattan. The safe utterly failed to protect its contents. "It turned into an oven," says partner Jordan Gruzan.

Despite being a direct victim of history's most devastating terrorist assault, Gelfand is sanguine about one thing: A simple fire in the office could have done the same thing. "I guess we are more worried about terrorism than we ever used to be," he says. "But it will do the same thing a potential accidental fire or gas explosion would do. It has brought the whole concept of losing our data closer to the surface."

RECOVERY. Gruzan Samton is recovering through determination and flashes of good luck. Almost all of the contents of one fireproof cabinet were rescued and restored. One small section of the office was saved because recent renovations had partitioned it with a two-hour firewall, which kept the flames at bay. Gruzan says that among the lessons his firm has learned is to compartmentalize operations just that way, and to use offsite back-ups religiously. It also plans to go for total redundancy between its New York and Washington offices. Hardware, by comparison, was easy to replace.

"I don't know how the guys did it. In six days we were back in operation scattered across eight different offices with several servers and everybody on a computer," Gruzen says. Meanwhile, recovery continues. The firm took possession of new Manhattan space on Oct. 28.

Click here to view:  Number of Hacking Reports Reported

Click here to view: A Few Hour Work by the Code Red Worm

Planning to enhance data security is an 'on the one hand, but on the other hand' situation, because there are many levels of risk for which to plan. The security of the Internet itself is, at some levels, questioned. Under some scenarios, Internet-based business practices are seen as a safeguard but overdependence may also be a serious liability.

Jopeck and other experts say offsite data back-up has become a first-line defense for corporate security. But it requires either a routine system for transporting tapes to a secure, remote location, or assured connectivity to do it electronically. Other primary defensive strategies are aggressive it systems management, virus protection disciplines, cautious hiring and employee awareness training. But the one issue that has really jumped to the forefront after Sept. 11 is the need for Internet-reliant companies to make sure they have robust communication links to secure data centers.

"One who loses the ability to communicate minimizes the ability to maintain network security," says Victor de Joy, executive vice president of Lexent Technologies Inc. and president of its subsidiary engineering and construction division, National Networks Technologies. The company has been restoring and upgrading connections to businesses in lower Manhattan in the wake of the WTC disaster.

"I am seeing an increased focus on last-mile connectivity, on having a direct fiber-optic link to the end user, as opposed to leasing through a third party like a local exchange carrier," de Joy says.

Prior to the attacks, typical arrangements had fiber-optic networks handing off at node points to local carrier's "twisted pair" copper service for final routing. Many of Lexent's clients are replacing that entirely by fiber optics, eliminating one vendor from the critical loop. "In New York City, there is demand to accelerate the last 300 ft into that commercial building so there is no dependence on a third party," de Joy says. Clients in Boston, Philadelphia, Chicago, Florida and Los Angeles are also pushing up their last-mile timetables, he says.

TWISTED. One difference between reliance on twisted pair-based telecommunications and the Internet, which dispatches transmissions as packets of data scattered across a variety of routes, was pointed out by Adam Haas, executive director of telecommunication services at w&h Pacific. The Beaverton, Ore. engineering and construction firm specializes in land development, landscape architecture, planning and telecommunications. "Telephone calls [on Sept. 11] were very difficult to make, but sending e-mail by the Internet turned out to be one of the most robust communications methods because of the Internet's distributed architecture," he says. "Standard telecommunications are Point A to Point B, and if you get a break, you're in trouble."

Establishing a universal end-to-end fiber system should enhance business security, but it is a daunting task. "It's expensive," says de Joy. "We are looking at ways to engineer and perhaps bring together carriers to share the costs to light buildings." Only about 10% of the nation's buildings are serviced by an optical connection, he says, adding that the costs can range from a few thousand dollars to well in excess of $100,000 per building. "Over the past five to 10 years, an enormous amount of optical communications infrastructure has been deployed," says de Joy. "The last thing to do is finish the job, which is to build that complete optical- based network from end-user client to end-user client."

Such a system not only would have almost limitless bandwidth, but significantly greater security, he says. Compared to copper cable, optical systems are easy to monitor for tampering and are almost impossible to tap into physically.

Bill Moroney, president and CEO of the United Telecom Council, Washington, D.C., says the utilities and pipeline companies his organization represents have made broadband reliability one of their highest priorities and have met it by building private systems. "As an industry, critical infrastructure companies probably have the biggest private networks," he says. "They own the switches, fiber optics, everything. It's just the nature of the reliability that is needed." Some large companies are now turning to utilities that have developed needed construction and management expertise to build similar systems for large private networks.

Moroney, however, is one expert with a high degree of confidence in the resilience of the Internet. "Theoretically we are susceptible, but there is an enormous amount of redundancy," he says. "To say we couldn't be attacked is silly. Of course we could."

REDUNDANCY, REDUNDANCY. Beyond the last mile linkage lurks the question of local routing diversity, a question experts say companies need to be asking. "Generally speaking, the long-haul and backbone infrastructure is diverse," says de Joy. "If one cable gets cut, there are prescription backup plans to reroute another way. The issue is if you lose your last mile. It's not a security flaw, it's a diversity flaw."

Those flaws are being addressed not only at nodes and data centers, but on corporate campuses and individual office buildings, says Haas. "People are going to have to think about placing additional conduit into their properties and coming in from multiple points within a building to provide true divergent routing," he says.

DATA MINING A second fire-proof box protected crucial data at Gruzen Samton. (Photo Photo courtesy of Jordan Gruzen, Gruzen Samton LLP, Architects)

Haas also predicts more carrier oversight by the federal government for emergency recovery planning. "It is really about knowing where the faults are in your network," he points out. "The government is going to have a role in it because there is certainly going to be an increase in tapping into information that might be related to homeland security."

Haas also says that data centers are strong, dispersed and redundant enough not to be a serious weakness in the system. Taken individually, however, data center security is a high priority. Centers are being built with layers of protection against intruders, but also are tied in with geographically diverse communications links. They also have power feeds from separate grids, backed up by on-site emergency generation. "We have redundant conduit, both for electrical power and telecommunications equipment," says Jerry Valencia, partner of Valencia Commercial Properties, Del Mar, Calif. The firm is finishing development of a new data center for the Rockefeller Group in nearby Santa Ana. The center also has back-up generation for at least 72 hours and uses biometric security in the most sensitive area, he adds.

ROUTING AROUND. Thomas Rossiter, president of Chicago-based design-build firm McClier, says the key to securing the Internet isn't in building blast-resistant data centers but in guaranteeing the capability to switch operations very quickly from one to another. He says the nationwide scope of the Internet, and its routing redundancy, are its best security. Localized disruptions, even the loss of multiple transmission lines or Internet data centers, can quickly be minimized by rerouting communications. "If there is a disaster, one can be switched," he says. "If you go down in Chicago you process out of Saint Louis or Milwaukee."

Just when dependence on the Internet is seen as a risk factor, others point out that it can be a security agent as well. Ryan Watts, a software engineer and security officer at Atlanta-based Constructware, and Jeff Albertine, developer of the firm's Application Service Provider software, point out that such services focus resources on protecting data and systems far more aggressively than most of their clients can.

System administrators implement anti-virus updates continuously, and the software constantly scans uploaded files and repairs or quarantines infected ones. But the architecture of ASPs such as Constructware also offers protection, they say, because data hosted on such system's project Websites is never actually touched by users. Only html representations of it are affected, so the user and database servers holding project information are never directly linked.

VULNERABLE. Veridian's Jopeck urges businesses to take very seriously the need to back up and safeguard data. He warns that U.S. systems are vulnerable to economic espionage by foreign governments, whose capabilities to cause damage and disruptions far outweigh those experienced from hackers so far. "Can you imagine your company business as a subject of spying by a foreign intelligence service?" says Jopeck. It "would take pretty much everything you've got," he adds. "If foreign governments take part, it's going to be much more significant than anything your corporate security officer has seen."

Jopeck further predicts that "when the time comes, we will be a battlefield in war. We will have computers behind enemy lines–your computers–because they are connected to the global network. Your computers could become casualties of war." He describes the September attacks as part of a shifting and escalating pattern of assault that is likely to continue. He adds that our dependence on electronic storage and transmission of corporate information is a vulnerability that our enemies will surely exploit, and that includes targeting the Internet.

"Someone is going to know that he or she can do greater damage to us by attacking the Internet than in any other way, perhaps even greater than by bringing down buildings or killing people," says Jopeck.

The Veridian executive warns that security precautions will increase business headaches and interfere with performance. The burdens may pull down weak or unprepared companies. He urges companies to take an analytical and proactive approach to assessing their risks. "Seek out vulnerabilities and create defenses, rather than wait to respond to attacks," he says.

The need for excellence in security staffing is another area experts say is not being given enough attention. "Most companies do not have top-notch it people," says Voeller. "They're sloppy, and even the very best are having significant difficulty." He says that as the level of hacker sophistication goes up, the level of difficulty will be like the difference between checkers and chess. "Make sure you have a very unemotional network manager," he advises. "If that person is doing their job well, you won't have to worry that you won't be able to do yours."