Network security is not what it used to be. Most likely, if you're in the IT security business, you probably just laughed at the understatement of the year. With the 'rise' of the internet, search engines, wireless communication, cloud technology, and hackers hiding behind every access point, the idea of securing a single unified network has become almost ridiculous. It's still necessary as part of your greater business IT plan, but impossible to maintain on its own in today's highly online business environment. An office building is no longer an island standing alone with its tower of isolated data, it is a hub through which data flows in and out of the network at lightning speed, which means it's time to start thinking about network security differently.

Classic Network Security

The difference in IT security fifteen years ago and IT security today is actually rooted in the idea of a 'network'. Before the world wide web, everything required a cable or a hard portable copy. If you wanted data to go from one computer to another, you'd better have an ethernet patch cable long enough or a writeable floppy disk. Otherwise, you're completely out of luck. This defined networks as finite things connected by cables but isolated from the rest of the world. Some remarkably ambitious computer users went so far as to string cables over very long distances, between buildings, and many businesses began picking up the technique of burying thick data cables so as to create a campus-wide network, but the networks were still finite.

Early Hacker Viruses

Fortunately, this made protecting them much easier. There were still viruses back in those days, but hackers had to work pretty hard to spread them. It was possible to hide viruses in files, but it also took hours to transfer files so people did so with a great deal more care and intention than they do today. Otherwise, viruses had to be installed onto floppies, then later CDs and early USBs masquerading as useful software. The viruses themselves? They mostly ate your files because there was no way to send information back to the original hacker who wrote the virus.

Early Data Theft

Data theft was also much less rampant because, of course, there was no sneaking in through the internet and sneaking back out with the information. As 'tech' movies from the 90s so enthusiastically featured, stealing data involved actually sneaking into a facility to access a machine on the secure finite network, downloading files onto a portable hard copy, and escaping the facility. Network security was mostly about secure passwords and keeping people out of the server room. In other words, early network security was nothing like it is today.

Everything is Online Now

But it's not the late 80s to mid-90s anymore and networks have changed a lot. While ethernet patch cables are still incredibly useful in a very localised sense for connecting small work groups of computers together, the routers themselves are more often than not set up with a purely wireless connection. In fact, an internal network is no longer even necessary to keep everyone connected because everything, and we mean everything, is on the internet now. Document storage, inter-department communications, customer service, marketing. Name any aspect of modern business and you can find at least 10 examples of how it's online, even for very physical things like inventory or shipping. There are online aspects to these tasks hooking everyone to 'The Cloud'.

Network Security and Constant Vigilance

From a network security perspective, this has completely transformed the job of safeguarding business information. Before it was a solitary diligent role where every digitised file was kept in its proper place, made accessible through hosting and password protection, and credentials could be double-checked one at a time. Now, it's more like being an air traffic controller with thousands of data flying through constantly, and all of them need to be security-checked.

Information leaves and the company network all the time. Every single time an employee sends out an email, accesses a web page, or add an entry into a cloud-built platform, they are sending information out of the company network. Every time a webpage opens, an online report is created, or an email is received, information enters the network. Any one of these moving data points could carry private information out or a virus in and it's up to network security to prevent as many 'bad' exchanges as possible while allowing millions of 'good' exchanges to go on unimpeded.

Major Network Security Concerns

The fact of the matter is that no matter how much you secure your local network, no matter how rock-solid your firewall and virus scanning software may be, there will now always be ways for data leaks to get out and for malware to get in because there is simply too much online communication into and out of your local network to stop it all. Here's a quick breakdown of the major online communication forms and the security risks that come with them. Because no modern business network is an island anymore.

Inter-Office Communication

How do communications occur in your office? While there are sure to be plenty of in-person meetings and discussions, more often than not important information is sent via email, which usually routes out into the world wide web and then back in through your email server which means even inter-office emails access the internet several times to complete an exchange. Employees are also using collaboration software for live chat, but these too tend to be hosted online rather than solely on the local network as they might once have been.

Customer Service

Communications with customers are also almost 100% online. You may have a few phone lines still open but most modern customers are looking for live chat, email, and social media conversations instead. Any customer service staff your business has will be constantly communicating with customers over the internet which means steady packets leaving the network and returning.

In fact, communicating with customers is one of the primary points of network infection. Hackers often pose as customers and use social engineering to trick customer service agents into clicking on infected emails attachments or website links. To stop this, a network security officer will need to turn to HR and training to make sure that CS team members know how to avoid being 'phished'.

Communication Between Company Sites

Companies with more than one worksite used to have to communicate by telephone or have a manager drive circuits between locations. With modern technology, however, you can have video conferences, use online collaboration software, and stay in touch through live chat even if employees are in two different locations. But, of course, this too creates a multitude of messages going in and out of each individual building network. Remote workers, field workers, and people on business trips are also part of the out-of-office communication landscape and make up even more traffic to monitor.

Your Website and App

Then there's the fact that every business has a public online face now, also known as your website. The website is a direct portal to your business information and personal account databases meaning that it needs to be incredibly well secured. Hackers can and have in the past used a website to crack all the way into a business's local network if the website is hosted on a local server. This is why many IT directors choose to host their website on a separate cloud server so as to avoid a direct connection. 

Of course, then hackers simply target your customers from the client-end. In both websites and mobile apps, hackers have been known to invade and infect customer local computers and then skim surface data to steal their login information and try to crack in that way. The solution to this, in most cases, is to make sure that logins and private information are all encrypted all the time, from the moment a client types in the data.

BYOD vs Company Devices

The next major concern, and one that has definitely turned out to be an avenue for new viruses, is employee mobile devices. BYOD stands for Bring Your Own Device and refers to employees who work from their personal phones, tablets, and laptops which can put a company network at risk. But even if you go through the effort of providing each employee with a work phone or laptop, they will make mistakes and viruses will enter the system. Risky websites will be searched, phishing emails will be opened, and often this happens off your network where the original suspicious activity isn't detected. Then employees come waltzing back into work with an infected phone. That phone automatically connects to your wifi network, and now your network is at risk.

There are a number of possible solutions to this problem from extensive employee training to a 'leave your company phone at the door' policy, but businesses are still looking for the right solution to the BYOD virus path.

IoT and 'Smart Businesses'

Finally, here at the end it's worth mentioning that the rising trend in IoT devices and 'smart business' (smart home for business) integrations is also a major source of both network activity and malware risk. IoT devices are notoriously insecure and nearly impossible to make secure because they all have different computer chips and off-brand operating systems. There have already been waves of IoT hacks, mostly forming botnets or bricking the devices, but it's only a matter of time before a company gets hacked either with direct data access or through the eyes of a wifi security camera.

The best protection for IoT currently available is to isolate your devices on a completely separate network. Don't fork your current network, use a separate router entirely. Because the IoT dashboards are online, they don't actually need to access your internal business network and should be treated with the same caution as guest wifi.

Business technology is changing rapidly, and so too must our techniques. If you're still thinking of network security as a way to secure a single business network from all possible intrusions, you're going about it the wrong way. Instead, it's time to start thinking like an airport. Control gates, security checks, watching for suspicious patterns and, most importantly, controlling human behaviour. Even if your security system is perfect, all it takes is one phished employee to let a virus into your network.