Construction companies face Internet security risks

|tab|

As construction companies turn in-creasingly to tracking and managing projects via the Internet, security is becoming an even more critical concern. |ret||ret||tab|

If someone walks in the front door and asks to see your company's financials, job cost reports and job bids over the last three years, would you let them? You already may have.|ret||ret||tab|

Simple misconfiguration can lead to full access to your system while you are surfing the Internet. |ret||ret||tab|

To demonstrate the point, we at BKD Technologies recently attached to a disbelieving client's computer (with permission, of course) while it was connected to the Internet. While attached, we accessed several documents, including accounting and payroll information and spreadsheets, and were able to change them, print them and even delete them. |ret||ret||tab|

All of this was done with the standard functionality of the Windows operating system. Security breaches often do not require special equipment or deep know-ledge. |ret||ret||tab|

Misconfiguration is just one of hundreds of ways in which systems may be vulnerable to a security breach. In today's highly competitive world, you cannot afford to leave the security of electronic information to chance. |ret||ret||tab|

|ret||ret||tab|

Enter information security:|ret||ret||tab|

Information security is a vital business issue which covers many topics from protecting against viruses and the disgruntled employee to basic policies and procedures and disaster recovery plans, to name just a few. |ret||ret||tab|

Several years ago a person might have needed hours to copy bid sheets from paper files and a pickup truck to haul them off. Now, literally years of bid and cost data can be copied in seconds and carried off or e-mailed anywhere in the world. Add access from the Internet, and you don't even need physical access to the office.|ret||ret||tab|

The most important thing you can do is to continually educate yourself and start identifying where your important information assets are at risk. Security does not happen accidentally. In the meantime, this list of action steps will help get you started:|ret||ret||tab|

Develop a comprehensive computer security policy that employees must read, understand and sign as a condition of employment.|ret||ret||tab|

Have an outside consultant perform a security assessment on a periodic basis.|ret||ret||tab|

Hire certified network engineers to design your systems, even if they are simple.|ret||ret||tab|

Utilize physical access controls such as locks, cameras and alarms.|ret||ret||tab|

Install and maintain anti-virus software.|ret||ret||tab|

Do not attach unprotected computers to the Internet with file and print sharing enabled.|ret||ret||tab|

Consider using a proxy device to connect to the Internet instead of direct modem connections.|ret||ret||tab|

Do not open e-mail from an unknown source.|ret||ret||tab|

Encrypt sensitive information, especially when sent as an e-mail attachment.|ret||ret||tab|

Install firewall software and/or hardware.|ret||ret||tab|

Consider the need for intrusion testing.|ret||ret||tab|

Monitor Internet usage.|ret||ret||tab|

Diligently back up critical data.|ret||ret||tab|

Protect backup media by storing in an off-site location.|ret||ret||tab|

Periodically test backups to ensure they can be read.|ret||ret||tab|

Develop and test a disaster recovery plan.|ret||ret||tab|

Maintain hardware and software ac-cording to manufacturer's recommendations.|ret||ret||tab|

Keep current on software fixes.|ret||ret||tab|

Install uninterruptible power supplies.|ret||ret||tab|

Log access to sensitive files.|ret||ret||tab|

Practice good hiring and termination techniques.|ret||ret||tab|

Remember if you don't have the expertise to evaluate your security posture and put information security measures in place seek outside assistance from knowledgeable experts before someone else finds your vulnerabilities for you.|ret||ret||tab|

(Jeff McKinnis and Scott Hickman are consultants with the firm of BKD Technologies.)[[In-content Ad]]