Commentary: The Web--curse or blessing?

By John Pescatore, Gartner Analyst

As security problems escalate, businesses must realize that the Internet isn't as reliable or stable as private networks and other utility services. Consequently, businesses should make plans to survive periodic Internet outages until 2006.

At the recent annual meeting of the Internet

	See news story: Microsoft apologizes in security flap

Corporation for Assigned Names and Numbers (ICANN), a presenter said that it would not take much for a malicious hacker to shut down the Internet by flooding the Web's master directory servers with traffic. A hacker breaking into a number of PCs or Web servers could instruct them to send so much traffic to a target server that it would be overloaded and therefore prevent people from accessing the Web. The meeting was told that such attacks were tried all the time but usually to single Web sites and not on a scale that would seriously interfere with overall Internet traffic.

As Microsoft and other software vendors have painfully learned, plenty of savvy attackers can find vulnerabilities in computer software and break into the more than 50 million computers exposed to the Internet today.

The two overriding principles in security design are these:

• The overall level of security is only as good as the lowest common denominator, and attackers will always find the weakest link.

• Complexity is the enemy of security.

Sometimes things that appear quite sturdy can become quite fragile when exposed to forces never anticipated. The value of the Internet lies in its low-cost, loosely connected structure. The basic elements of the Internet and World Wide Web--such as TCP/IP, Domain Name Services (DNS) and HTTP--were never designed to withstand large-scale, coordinated attacks. The basic structure of the Internet doesn't have a very high mean time between failures.

On the other hand, the structure does support simple redundancy, rapid reconfiguration, and a variety of means to provide fairly low mean times to repair. The lack of a rigid hierarchical control structure frustrates many people who are used to reaching availability goals by structural overdesign.

But that arrangement represents the major reason the Internet has pushed private and value-added networks into providing high-value and low-cost connections. Trying to graft hierarchical security controls onto it will result in a structure with about as much value as a skyscraper built from spider webs.

Nevertheless, Gartner believes that the security of the root name servers and the rigor of the processes used to control updates should be increased. Secure DNS capabilities should phase in as part of the increased focus on security.

However, businesses should not assume that the Internet will reach the mean-time-between-failure levels of private networks or other utility services and should plan for periodic outages until 2006. Where businesses require nonstop processing, they should contract for alternative connections.

Gartner recommends that businesses take the following actions:

• Immediately check their Internet-exposed systems and servers for vulnerabilities and test their cyberincident response plans. Not only must their IT assets be kept safe from direct cyberattacks, but steps must also be taken to keep businesses' own servers and remote PCs from being used as launching points for attacks.

• If revenue-producing or other business-critical operations depend on Internet connectivity, businesses should begin budgeting for contractual denial-of-service protection from their Internet service providers or Internet data centers.

(For a related commentary on Internet security risks and measures that should be taken, see Gartner.com.)

Entire contents, Copyright © 2001 Gartner, Inc. All rights reserved. The information contained herein represents Gartner's initial commentary and analysis and has been obtained from sources believed to be reliable. Positions taken are subject to change as more information becomes available and further analysis is undertaken. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of the information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof.