GLOBAL CHALLENGES

Five Ways Computer Security Has Improved Since 9/11--and Five Ways It Hasn't

Eric Lundquist | Date: 09-11-09 | Comments

We have learned some computer security lessons since 9/11, but there are areas, including cyber-security, that still need improvement.

The 9/11 attacks that happened eight years ago were tragic on many levels, especially the personal levels for many thousands of people. With the New York financial markets as one of the primary targets, the terrorist attacks also highlighted the vulnerability of the technology infrastructure that underpins much of our modern society. Here are five computer security lessons I think we've learned.

1. Data security and redundancy are the lifeblood of the modern corporation. Before the 9/11 attacks, system backup and remote, secure redundant IT system backup were not center-stage issues. Now, no company large or small thinks that disaster can't strike. Data security moved from a low priority on the needs list to a top must-have item.

2. Backup data centers. The whole concept of data center backup and redundancy has been shifted since 9/11. I'd argue this has happened as more and more research, money and innovation have moved into this topic. Redundant data centers were once highly expensive investments that in concept mirrored a company's IT operations. However, unless that redundancy is consistently tested, you risk the very real danger of out-of-sync data and out-of-gas electrical backup generators. Backup is now a much more real-time fluid concept that meshes nicely with new developments in cloud computing and virtualization.

3. Emergency messaging meshes. This one will also make the list of "room for improvement." While universal messaging systems that allow different emergency response organizations to easily communicate are still in the future, at least it is now firmly recognized that cops need to communicate with firefighters, etc.

4. Data analysis. One of the tragedies about tragedies is that often in retrospect all the clues were there about the disaster ready to unfold. This was certainly the case for 9/11. Just as the need to allow emergency response teams to communicate is now widely recognized, the need for government security organizations to share data is now widely recognized.

5. Identity. One of the big pushes since 9/11 has been to develop an effective identity management network that does not invade the privacy rights of U.S. citizens. Again, this is more in the "recognized need" than "effective solutions" category.

Now for the five areas in need of improvement:

1. Data security and redundancy. This was in the "five improvements" category also. The rise of cloud-based and hosted operations such as Amazon Web services promises a way to build real-time redundant systems that don't drain the budget. What are needed are real demonstration projects and case histories showing companies how to utilize these systems for disaster recovery rather than cost savings.

2. Emergency social nets. The past eight years have seen the rise of social networks that are fun, and honestly, more than a little trivial. But the ability of services such as Twitter to rapidly disseminate information holds a lot of potential for emergency real-time information networks. How to build those networks remains unresolved.

3. Data analysis tied to real-world information. After 9/11 there was a rush to turn to technology as a way to sniff out dangerous situations from weapon-carrying passengers to nuclear material traveling in shipping containers. From my perspective, a lot of this activity did not result in much additional security. Building data analysis systems that are tied into real-time data reporting tools including RFID tags remains a long-term, but needed approach.

4. Privacy, identity and security. Are those three concepts always going to be in conflict? Right now, there doesn't seem to be one approach that can find the balance between privacy rights and security needs.

5. Cyber-security. While the big credit card cyber-crimes get all the press, the fact remains that our data networks are not fundamentally more secure now than before 9/11. As more of our life and the backbones of companies, governments and social institutions become more digital, the need for cyber-security is greater than ever.