The walled city may be protected from attack, but it is not open for trade. In the same way, putting up a hard perimeter around your systems may prevent security breaches, but it will also exclude you from electronic interactions with partners and suppliers. The growing importance of electronic channels, whether for trade or collaboration, is forcing through a change in perspective, in which rather than being seen as a defence against the outside world, computer security becomes a business enabler. Consultant PriceWaterhouseCoopers says that instead of classing it as an overhead, spending on security should now be viewed as a "potential revenue generator and business differentiator". David Wray, chief technical officer of Authoriszor, a security consultancy, agrees. "Security is the hygiene factor that will drive e-business forward. People won't do it unless it is safe." Similarly, Adrian Wright, IT security director at Reuters, the business information provider, says: "All sorts of parties need to be behind the firewall. We are in the era of extended enterprises, with outsourcing, joint ventures, mergers and acquisitions, and the increasing use of contractors. You have to let these people in, or the business can't function." Despite the failure of so many B2B exchanges, electronic trading and collaboration is growing strongly, according to an independent study of electronic trading projects in Europe, published last month by J D Edwards, the software company. In the survey of 100 directors in France, Germany, UK, Italy, Spain and the Netherlands, 85 per cent had experienced growth in electronic interactions during the past year. B2B - more than any other application of the internet - is changing the definition of security. It is no longer about keeping people out, it is about safely opening the enterprise. Once inside the firewall, it is about having mechanisms in place to control what customers and suppliers can view and do. In addition, there must be security mechanisms to substitute for traditional methods of ensuring the person you are dealing with is who they say they are, and that both parties agree to any transaction. At the same time, security in B2B has to deal with the increase in hacking and viruses (that is affecting companies whether or not they trade electronically) and confront the well-documented fact that most security breaches are internal. As the growth in security products and services markets shows, creating an integrated B2B security infrastructure that encompasses these requirements is a complicated and expensive exercise. There is a huge range of products on offer, from firewalls to virus monitoring and encryption to public key infrastructure. But as every consultant will tell you, security is not a technology issue alone. "No one product is going to solve all your needs," says Michael Rasmussen, senior analyst at Giga Information Group. "Security is a process, and one that is integrated with all the individuals within an organisation. To achieve security in B2B it is important that all involved know what is expected of them to protect information and how it is protected." Matt Holland, security architect at the e-commerce technology company Lost Wax, agrees. "In order for a B2B security infrastructure to become successful, you must strike the right balance between the sharing and segregation of information amongst not only an extended community of users, but also an expanded set of resources," he says. Companies must also ensure that the security policy is congruent with the business plan. "Implementing a security solution that increases business transaction time may put you at a strategic disadvantage to your competitors," says Mr Holland. In some circumstances this could represent a greater risk than loss of integrity on a single data channel. Nic Perryman, vice president (Europe) of VerticalNet, which operates online exchanges, says it is no longer enough to rely on firewalls at the perimeter. To successfully transfer supplier relationships to an extranet or an online trading exchange, companies must address security at multiple levels. "In addition to firewalls, it is nowadays essential to build secure environments for applications, databases, content and the network itself." Phil Flavin, chief technology officer of BT Ignite Solutions, a provider of managed networks, agrees. "The requirements of B2B to allow access to applications means that in future security will shift from the firewall to the server level." The high cost and complexity of B2B security is causing a "major problem" for smaller companies that are under pressure to link up to large customers in electronic supply chains, according to Bill Pepper, UK head of security risk management at Computer Sciences Corporation, the management consultant. They just have not got the budgets or the staff. "It's no good just protecting the web front end and forgetting about back end systems." Indeed, the complexity of security infrastructure and policies is hampering business development in general, says Mr Wright at Reuters. "Every time you forge a new relationship each company brings its own security policy to the table, and it takes time to go through it and carry out an audit." He is now proposing to Reuters' partners and to industry at large, that rather than carrying out full scale audits, companies should make "security treaties" with each other. This would involve both parties handing over a memo of understanding describing how their security policy accords with best practice. "I am not talking about a free-for-all, but I don't care about what firewalls you have - I just want an undertaking that you have a secure environment." Mr Wright has presented his idea of security treaties to the Information Security Forum, a grouping of 200 blue chip UK companies. "Security is becoming more and more of a problem, but we are making headway with the proposal because people see it will facilitate business-to-business interactions."
|