Information Security, The New Niche

{LANG_NAVORIGIN} Security Management
By: Philip Buckley, 10/12/2004



Introduction

Information is now not being stored in hardcopy format in boxes upon boxes of paper and kept in light and humidity controlled rooms somewhere beneath the earth. It is now being stored on a digital medium, with the medium being optical or magnetic. This new digital medium poses a risk because it makes the data that is held on these disks much more accessible for all the good and bad reasons. The good reasons far overwhelm the bad reasons this is why we have arrived at the digital age where everything is being stored digitally. The big problem is the risk that we face with so much data being stored on a digital medium that it cannot be ignored. Digital data is being stored at every level of society so the threat of that data being compromised corrupted or falling into the wrong hands is a greater societal problem. Hence, information technology companies are seeing this need or market demand for information assurance and are aligning or transforming themselves into information security companies.


Background

The internet is the main purveyor of this security threat, there is no doubt we are inundated with the latest news of worms, viruses, hacking ethical or malicious, information warfare that originate from the internet. This problem does not stop at the internet and its users. This risk exists on any computer network or any computer that will be connected to a network, be that network wired or wireless. The insecurity of the information network is made so because the backbone structures and protocols that made it are insecure. The internet is based on TCP/IP (Transmission Control Protocol / Internet Protocol). This is the protocol that almost all of the computers in the world use to communicate with each other. The TCP/IP protocol is world wide open source and widely understood; therefore it is easily manipulated and used for wrong purposes, which may lead to hacking and virus writers. The protocol itself was written with the transmission of data in mind. It is a very good protocol for its intended purposes. Its intended purpose was not to deliver information securely but reliably making sure whatever was sent was delivered correctly. Therefore, the authenticity of the sender or receiver is not accounted for by the protocol. Email is the best known application on the internet and it uses SMTP (Simple Mail Transport Protocol) to send mail. SMTP is one of the most insecure protocols. It was built around with a focus on being fast rather than secure. Almost every security measure that is implemented today is in the form of patches or upgrades to these old protocols to get them to some security level. However, security management is an on going practice, and for the foreseeable future an ongoing complex practice. The first known use of the word worm in the computer lexicon was in 1979. It was used by engineers at Xerox PARC (Palo Alto Research Center). They wrote a short program to search the network for idle computers with the idea of using these computers more efficiently. This has now become the modern day computer virus that corrupts or erases data/information on our digital storage devices. There are older forms of network tampering. In the 1970s onwards there were “phone freaks” or “phreakers” who are persons who use tone generators to make free telephone calls. This was not very wide spread and could be tracked by the telephone company if the practice was repeated. However, in 1999 and 2001 there was the infamous Melissa and Code Red virus. Melissa virus infected thousands of computers at an alarming rate. This caused an estimated $80 million of damage and prompted record sales of anti-virus software. The Code Red virus was even worse; this infected ten of thousands of computers and caused an estimated $2 billion in damages. However, Code Red had a twist to it that was not seen before. The infected computers were programmed to attack the White House web site at a pre-determined date in the hopes of bringing the web site offline. This gave viruses a very public stage and notoriety.


Market Overview

The market for information assurance affects every person or entity that owns a computer. The rapid growth of the internet and its massive network puts data and information sent or stored across its infrastructure at risk. Information warfare and Cyber terror has been added to our every day language. The market of information assurance can be split across three different segments, hardware, software, and consultancy. Not every company will have the resources to implement a complete or thorough security solution, because most of the technology itself is cutting edge and is not widely understood. Also there are needs for consolidation and standardization in the industry to bring it to the point where consultancy fees can be reduced. Since the late 1990s companies saw the successes of the internet and wanted to provide their services online. However, these security threats endanger the relationship of trust that is so vital among trading partners, online retailers, and consumers. This also includes the government sector. With every level of government having plans to offer their services online. It all comes under the e-Government initiative.

“In a research recently carried out by IDC, the market for security-related hardware, software, and services will continue to record a healthy growth rate, in spite of the slowdown experienced by the overall IT sector the profits are expected to grow from just $17 billion in 2001 to $45 billion in 2006. Experts believe that the proliferation and widespread use of remote LAN, Internet, extranet/intranet, and wireless access services in the corporate sector is responsible for this stupendous growth. Furthermore, IDC foresees the global market for information security services to reach US$21 billion by the end of 2005, up from US$6.7 billion in 2002. The biggest spender in this sector is expected to be the financial sector, accounting for US$2.2 billion spent on information security services in 2005, growing from the US$848 million spent last year. Apart from the usual segments of the market, the small businesses are the surprise contributors recording the highest and the rapidest growth rate since last year. The extent of the concerns over security of information can be gauged from the recently passed laws in America as well as the U.K. that make electronic signatures in online transactions legitimately viable.”

The federal government is one of the nation’s biggest employers and spenders. The government is looking to upgrade its infrastructure to make it more secure from the everyday treat of terrorism. Department of Homeland Security has a budget of $40.2 billion for fiscal year 2005. This is an increase of 10 percent above the 2004 budget. This shows the commitment and continuing priority placed on Homeland Security in requesting new government-wide discretionary resources for fiscal year 2005 of $30 billion.  This is an increase of 9.7 percent above the comparable fiscal year 2004.

These market forecasts make Information Security a very large market and young market with willing buyers. The most lucrative side of this sector appears to be providing IT consulting security services. This is very obvious with the big accounting firms such as Ernst & Young, PricewaterhouseCoopers, KPMG and Deloitte & Touché which are renowned for their shrewdness with information; are joining the IT consulting field providing information assurance services. These accounting firms are joining a field which is already crowded with IT consultant heavy hitters such as Accenture and IBM. This is the case when technology is cutting edge and companies need consulting services to help integrate the new technology in their existing business. However, its market size is expected to decrease overtime as the technology matures. The hardware sector of the market is expected to grow but not as fast as the software segment, or have as high of a turnover rate. Also customers tend to have a longer life cycle for upgrade or replacing hardware equipment. The software segment is expected to be the fastest growing segment. According to Gartner Dataquest “The security software market, which grew 10 percent to in 2001, is forecast to reach $4.8 billion, growing at a compound annual growth rate (CAGR) of 8.9 percent in 2006.” Case in point Accenture was awarded a $10 billion contract to provide security at the nation’s borders. Accenture beat out long time government contractor Lockheed Martin. This one contract is wrapped up with all of the facets of information security. Figure 1 and table 1 shows the worldwide total software market growth that is expected until year 2006.

Figure 1: Total Worldwide Security Software Market Revenue History and Forecast by Segment

Source: Gartner Dataquest (December 2002)

Table 1: Total Worldwide Security Software Market Revenue History and Forecast by Segment

Source: Gartner Dataquest (December 2002)


Market Segments

Antivirus
Antivirus makes up the largest segment of the market because of its maturity level. It is expected to grow at 11% rate over the next few years according to Gartner Dataquest see table 1. The public is now educated about the needs for antivirus software. Antivirus technology is a reactive technology, meaning that the virus has to exist before a cure can be found most often the antivirus software has to be updated with known viruses’ lists before it can detect a new virus. The antivirus software segment accounted for nearly 35 percent of the security software market in 2001, which included products such as Symantec's Norton Antivirus and Network Associates' McAfee VirusScan. There are smaller player such as PC-cillin and BitDefender. Microsoft is also slated to enter this market in 2004 and is expected to have a dominating position because of its monopoly on the desktop. However, there is room for the market to grow. The consumer buying segment has only penetrated 50 percent of the world's consumer awareness. Also, there are untapped computing device markets that will be in need of antivirus software such as the growing PDA (Personal Digital Assistant) and Linux operating system markets. Overall, the antivirus software segment is expected to show solid growth but lose share during the next few years, as areas such as IDS (Intrusion Detection Systems) and encryption, grow more rapidly and make up larger parts of the total market.

Encryption
Encryption Technologies represent the future of the security industry. This is one of the most cutting edge technology segments. Encryption is defined by www.encarta.com as “computing to convert computer data and messages to something incomprehensible by means of a key, so that it can be reconverted only by an authorized recipient holding the matching key.” In the encryption algorithm, authenticity of the sender and the receiver are verified. When encryption schemes and methods are properly applied, it can provide a secure communication channel even when the underlying system and network infrastructure are not secure. Encryption is a necessity when data passes through shared systems or network segments such as the internet, where multiple people may have access to the information. In these situations, sensitive data such as passwords, personal information, and government information should be encrypted in order to protect it from unintended disclosure or modification. Encryption can help to protect data authenticity, protect data integrity, prevent disclosure, and void data replication. Encryptions biggest market potential is the market of DRM (Digital Rights Management) and email encryption. Email is arguably the most used application on the internet, but unfortunately this modern day form of communication is not private. Encryption technology like s/Mime (Secure Multipurpose Internet Mail Extension) and PGP (Pretty Good Privacy) are leading contenders for secure mail transfers. There are only two email software programs that are supporting s/Mime; Microsoft and Netscape. PGP right now is used mostly in the open source community. This form of email communication has to be wide spread before it can be effective. There are currently no standards to follow and it involves complex setup. It also requires action on both the senders and recipient part, so they are not widely used. Encryption technology ranges from certificates, VPN (Virtual Private Network), to secure token.

VPN are private networks but are still a part of the internet. VPN are made possible by encryption technology. The most popular of the encryption algorithms used is IPSEC (Internet Protocol Security). IPSec is a secure exchange of packets between receiver and sender. This form of secure communication may be the most complete form that exists today. After the VPN network is set up between sender and receiver, all information submitted is encrypted. This form of secure communication is widely used by companies that wish to transmit corporate information between themselves and partners securely. This VPN network could form the basis of the company’s extranet. A VPN is also used to allow remote users to access information that is stored at the companies’ datacenter. These VPN technologies are invaluable to businesses when company information can be readily accessed securely around the globe. Workers are now able to telecommute. There is also an increasing need to outsource; therefore more need to share company information. Collaborating with partners can be done securely and in real time with the use of the internet. There is no need to rely on expensive lease lines; therefore reducing cost. These technologies will see more growth as more and more companies use the technology to collaborate with business partners as well as allowing workers the flexibility to telecommute. VPN infrastructures are made possible by routers and firewalls. Routers and firewalls are specialized equipment placed on the network to inspect packets and to determine whether they are allowed access to their segment of the network or if they should establish a secure connection to facilitate a particular communication. VPN networks can be static, meaning the network is always available; or dynamic, meaning it is made available when it is requested by the user. A VPN network can have a one to one, one to many, or many to many relationship. There are many small companies in this market but it is somewhat fragmented. The market leaders are CheckPoint and Cisco systems. They make up a majority of the market with their CheckPoint Firewall-1/VPN-1 and Cisco Pix lines of products. Encryption technologies are in development to better encrypt data on USB drives, hard drives, magnetic tapes, DVDs, CDs and PDAs. There are now application specific encryption communications, for example, communication between databases. There is an ongoing upgrading of encryption technology for military and corporate communication over wired and wireless spectrum. Wired networks include Ethernet, Cable broadband, fiber optic, and fiber channel. Wireless network includes 8011.X, satellite networks, and consumer wireless systems such as car alarms, home alarms and cordless phones.

Certificates are digital documents that validate the authenticity of the holder. It is an implementation of PKI (Public Key Infrastructure) where a public key is shared between sender and receiver. Certificates are digitally signed by a trusted third party, sort of like a digital notary or judge. The notary is a party you trust and the software or server you are trying to communicate with will present this certificate/document that was issued by the notary. You trust the notary therefore you trust software that is holding the certificate. The notaries in the world of the internet are certificate authorities (CA) they validate the authenticity of the requestor of the certificates. Secure web transaction e-Commerce is based on this technology therefore it is wide spread and widely used. There are many existing companies that offer CA services. The most popular ones are Verisign, Thawte, and Equifax. There are also companies such as Microsoft and RSA that are selling CA software to satisfy CA services that are internal to a corporation. The certificate market is also expanding to include client authentication. At present what mainly exists are certificates to verify the authenticity of a server and/or software. With the expansion of Client VPN (these are normally dynamic VPNs that allow remote users access to a datacenter or any general company information) the use of a client certificate is expanding. When accessing the VPN the client has to verify themselves. This is done by password, certificates, secure tokens, or a combination of all three methods. The password is the least secure method because they can be easily guess or hacked. Using a combination of the methods of authentication increases the security and determines the factor of authentication. Using any two methods is called a two factor authentication.

Secure tokens are used to increase the level of security and verify the authenticity of the holder. This is normally used when logging into a network or transferring critical data. A secure token is a device that constantly displays a secure code that can be use to authenticate a user to some back end trusted computer source. This form of authentication is far more secure than password phases, because it constantly changes the secret code. A secure token can take the form of a smart card, ID, USB pen drive, dongle, a cell phone or any computing device that is portable and easily carried around with the user. These devices are presently very expensive and only reserved by extremely secure facilities and personnel. The prices will fall eventually, making it affordable for consumers and low level personnel. It will then be replaced at the top end price range by some form of biometric data validation.

Intrusion Detection Systems
Intrusion detection systems are specialized equipment that scan and inspect network traffic to discover malicious traffic patterns or activity. It is expected to have an average annual growth rate of 18.1% until 2006 see table 1. This is a true proactive security solution rather than being reactive in cleaning a network after it has been infected by a virus. IDS management teams maintain a database of malicious traffic patterns called signatures that are updated regularly. The IDS machine then inspects network traffic with these signatures and matches suspected malicious activities. Network administrators can be alerted when these are detected, or the sender of the malicious traffic can be blocked by the IDS system. According to Gartner Dataquest: “The IDS segment, which has made up about 5 percent of the security software market in 2000, includes software products such as Internet Security Systems' SAFEsuite IDS and Symantec's Intruder Alert and NetProwler (formerly Axent's ProwlerIDS). This does not include hardware IDS solutions such as the Cisco IDS or ISS Proventia appliances. Overall, the IDS software market will show above-market growth through 2006, although the increasing popularity of appliance-based solutions will limit the CAGR of IDS software to 18 percent.” This represents significant growth opportunities in this cutting edge technology sector; therefore, we expect to see rapid technology growth as more companies joining this sector and offer more products that drive competition and innovation.

Content Filter
There is a small market for content filtering. These are companies that produce software and hardware devices that inspect data content to determine whether it passes the security policy set by a company or an individual. The need exists for products such as these because companies need to share data; therefore data has to be transmitted. This software helps determine if this is done appropriately. Corporations like to know that when employees are sending data they are not sending company secrets or confidential information. They would also like to know that when the company's resources are used, that they are used appropriately. Making sure internet browsing, IM (Instant Messenger), email, FTP (File Transfer Protocol) are not used for gambling, pornography, hate speech, or any crime. Companies like BlueCoat systems, Websense, Smartfilter and Microsoft provide companies with ability to enforce company rules, supply data assurance, and audit the use of company resources. This type of software will penetrate the home user market. It will do the same thing VCHIP did for the TV viewing public. There is room to grow for new companies as well as existing companies to provide content filtering for kids at home that need access to the internet. Spam filtering is also in this category. Spam filtering is software that determines if an email message is sent from a known sender or if it's unsolicited mail. There are overwhelming problems now with spam on the internet. This can only be contained by content filter software on the corporate network or user’s email client software.

Identity Access Management
Identity access management (IAM) is a market segment that takes advantage of all the new security technology and rolls them into one product that gives corporations the ability to manage their employee or business partner’s identity. With increasing use of computer networks the volume of users are increasing, therefore ways are needed to manage these identities as well as verify these identities and make the process as seamless to the user as possible. Technologies such as SSO (Single Sign On), multiple chain authentications, and federated ID management are available. These systems are complex to implement, but the aim is to reduce administrative overhead as well as simplify the user experience. SSO exists whereby users of multiple applications do not have to authenticate to each application they are using, but authenticate once and that same authenticated session can be used for another application. Federated ID management is used when corporate growth is expected. Business partners that interact on a daily basis can interchange their user community. Meaning that if user A exists in company A there is no need to create a new account for user A at company B, when user A comes to do business with company B on behalf of company A. User A’s profile from company A is carried across to company B to perform their daily transaction. This adds great value when doing e-Commerce transactions with several companies. The e-Commerce transaction could be B2B C2C or B2C.

Digital Rights Management
Newer and better DRM software and tools are needed to protect the copyrighted works of art, music, movies, software, and books. The creators are willing to give access to their creation but are concerned about their rights as the creator. The music industry is reporting that their earnings are being eroded and artist rights are ignored by users who are illegally digitally replicating music and then sharing the music on P2P (Peer to Peer) networks with millions of users. This is also seen in the software and movie industry but not quite as wide spread. As software gets better and business models change we will see fair use of digital entertainment data. The market exists to be filled by technology. That solves the problem of allowing fair use of digital entertainment but enforces copyright laws.

Biometrics
Biometrics technology is in its infancy, but it is used now at extremely secure corporate and military locations and at the US borders. Biometrics is a form of security validation that involves some biological data taken from the user to verify the user’s identity. This could be done by a finger print, iris scan, facial features, voice recognition software, DNA sample, or a blood test. Biometric authentication is used at the United States Airports for the US-Visit program, whereby visitors to the United States are asked to provide a finger print sample and have their picture taken to verify their identity before they are allowed access in the country. This will move into the corporate world and possibly law enforcement and will become more wide spread as the world tries to fight terrorism.


International Market

The international market is expected to grow as well, with Europe leading the way with 10.6 % annual growth rate, as can be seen in table 2. The growth rate is also expected to increase while the digital divides decrease and information and technology are further dispersed world wide. However, there are still opportunities to be had with the booming economies of China and Taiwan.

Table 2: Total Security Software Market Revenue History and Forecast by Region, New License Sales (Millions of U.S. Dollars)

Technology Managers

IT managers are faced with the tasks of whether or not to implement this new technology. Implementing a secure network is complex and time consuming. It is difficult to assess the ROI, therefore difficult to be accepted by senior management. Adapting a cutting edge technology can be painful and costly and also could be the wrong direction of the industry. However, peril exists in not implementing security measures. That may result in lost of company data, or bad press if a company is hacked and secrets are revealed, or customer information exposed. Companies can incur the anger of shareholders if company secrets are exposed or data lost. According to Martin P. Loeb who led a team of researchers at the University of Maryland’s Smith School of Business the indirect cost of security incidents may cost as much as $10 million and proprietary info theft may cost $2.7 million per year per company. These are staggering numbers of security incidents per year. According to Gartner Dataquest IT managers are looking to implement several security measures in the coming years, Figure 2 gives guidance on expected implementation timeline.

Figure 2: Technology Cycle

In figure 2 one can see that data encryption appliances, deep packet inspection, spam filtering, DRM, Public Key Token, Identity Management, and Smart cards are looking to mature and be implemented by IT managers in the next two to five years. One can also see further, that research is now being done and that the expected implementation and maturity of biometric authentication is to be in the next five to ten years. The product life cycle of the IDS system is short and is expected to be replaced by deep packet inspection.


Drivers

Garner Dataquest is seen as the sage of the IT market and they have done a study of the factors that may drive or inhibit the growth of the market. According to Gartner, key drivers are:

• Enterprise losses because of the greater threat impact as well as greater threat frequency are expected to rise, raising enterprises' risk and loss expectations. Enterprises will increase security spending as a percentage of the IT budget to mitigate the higher perceived expected loss.
• Pricing is holding up in key product categories, such as antivirus. In most categories, price resiliency is expected to continue throughout the forecast period. However, in the antivirus category Microsoft's entry in 2004 will begin limiting prices worldwide, while regionally, there are already reports of price wars in Asia/Pacific.
• Heightened awareness of vulnerabilities among enterprises is creating a desire for remediation. Software helps with that task.

Long-term security software vendor revenue drivers include:

• Increased adoption of technical standards for Web services security will drive a significant security aftermarket opportunity.
• Increased regulations, HIPAA and Sarbanes-Oxley are driving laggard enterprises to improve security posture.
• Larger business partners are requiring certified levels of security from their suppliers as a condition for doing business.
• New entrants are supplying innovative products for combining multiple technology approaches to deal with "blended" threats. Better products may stimulate demand.
• New emergency/cyberterrorism/cybercrime initiatives will see increased government vertical spending on information security.

Key Inhibitors

The macro economy remains the biggest question mark about the prospects of security software vendors. Short-term security software vendor revenue inhibitors include:

• Flat or weak U.S. economy and world economy
• Flat or weak business capital spending
• Flat or weak enterprise IT spending
• Flat or weak telecommunications/carrier vertical spending into 2004
• Increased use of deferred-revenue-recognition accounting practices by software vendors
• Contraction of formerly promising categories, including PKI and IDS
• Competition from security hardware appliance vendors for security functionality, including firewall, VPN, IDS and others
• Slowdown in the uptake of mobile devices limits the mobile security opportunity in the near term.
• Price/feature competition in some security product categories

Long-term security software vendor revenue inhibitors include:

• Outsourcing of IT security management will reduce the revenue per unit of security software when sold indirectly through service providers.
• Embedding of enhanced security functions directly in systems and applications will reduce the need for third-party security software.
• The entry of Microsoft may limit the opportunity for third-party software, especially for desktop PC protection.
• Many independent software vendors (ISVs) may switch from a new software license business model to an updated business model or appliances model.
• The U.S. economic growth stagnation may continue.
• Traditionally strong verticals for security, such as state government, may weaken in a fiscal crisis.

Government Support

With the threat of bio terrorism or cyber terrorism the government is spending money on R&D to lead support for the information security industry. They are also spending money implementing existing security measures; therefore, companies can spend more money improving their products. According to the Washington Post, in 2002 President Bush signed a legislation dedicating more than $900 million over five years to security research and education to protect the nation's technology infrastructure against hackers and terrorists. The Cyber Security Research and Development Act will establish computer security research centers and fellowship programs at the National Science Foundation (NSF) and the National Institute of Standards and Technology (NIST). The federal government also established in 1988 CERT Coordination Center (CERT/CC) which is a federally funded research and development center operated by Carnegie Mellon University. In general, the government cyber security funding and plans are inline with growing the industry and being one of the chief implementers of new information security technology.


Prospective Companies

New entrants to the industry are expected because of the lack of dominant market leaders. Getting into the industry doesn't require huge capital startup, therefore funding can be attained to start a company with great ideas. However, as always, brand recognition is what counts and new entrants will have a problem not having a brand name. This could be solved by either partnering with a bigger brand name company or being bought out by a bigger company, the later is more likely to happen. The best prospects are companies that are established with deep pockets. I think Cisco system has the possibility of becoming the market leader and are positioning themselves to take that lead. In the 1990’s they positioned themselves as a networking company that does networking well. They made their reputation of being a networking and telecommunications company. From their SEC filing Cisco reported revenue of $20.8 billion with a market capitalization of $120.29 billion that is a deep enough pockets to buy smaller companies and fund R&D for information security. Therefore in the 21st century they have re-branded themselves as a security telecommunication and networking company. They are likely to control this market, because security threats will start or end on the network. They have several product offerings poised to dominate most market segments. The Cisco Pix firewall for general network security, Cisco VPN concentrator for VPN networks, Cisco Authentication Agent for identity management markets, and a Cisco Intrusion Detection System. They can use their market dominance in networking equipment and name recognition to win more business. They will face competition from companies like Checkpoint, Symantec, ISS, IBM, and Microsoft. None seem to have the range of products possessed by Cisco Systems.


Conclusion

There are issues to be considered by this new technology field. What are the societal impacts of this new technology? What are the legal and ethical issues that we face by implementing some of these technologies? The basis of new technology is to provide security for digital information. There may be questions as to what if it falls into the wrong hands? Could it be used to avoid law enforcement? There are also issues that affect privacy advocates who shun the ideas of biometric authentication. The main question referring to biometric authentication would be: who sees that data and how is it stored? There are also legal issues of exporting encryption algorithm overseas. Right now it is currently illegal to export most of our encryption algorithms therefore this will restrict trade. There are ethical issues in content filtering. Who decides what content an employee or users of the network are allowed to see? What are the moral and ethical standards? Also, with all of the new technology and expansiveness of it, there may be a need to realign IT departments to create a new post of Chief Security Officer (CSO), with sole responsibility of aligning the business needs along with information security. Technology managers have a lot to decide, such as when to implement and what technology to implement. The market is expansive and it is poise for growth. One can see there are many companies in this market segment jockeying for the prospective profits. This is evidence as accounting firms such as Ernst & Young and PricewaterhouseCoopers are joining the information security consulting services and along with networking and content filtering companies who are re-branding themselves to align with the demands of the market.


Reference

1. ACM Digital Library. (2004). UMUC Portal. Retrieved August 3, 2004 from http://80portal.acm.org.ezproxy.umuc.edu/dl.cfm?coll=portal&dl=ACM&CFID=25592585&CFTOKEN=33679020.
2. Betz, F. (2003). Managing Technological Innovation: Competitive Advantage from Change (2nd ed.). Hoboken, NJ: John Wiley & Sons, Inc.
3. CERT Coordination Center (CERT/CC). Retrieved August 10, 2004 from http://www.cert.org.
4. Department of Homeland Security. Retrieved August 10, 2004 from http://www.dhs.gov/dhspublic/display?content=3133.
5. Gartner Dataquest. (2004). Retrieved August 5, 2004 from http://www.gartner.com.
6. IDC Analyze the Future. (2004). IDC website. Retrieved August 2, 2004 from http://www.idc.com.
7. Loeb, Martin. (2003). “Infosec Economics”, The True Cost of Cyber Crime, January, pp 68-69.
8. Msn Finance. (2004). Msn website. Retrieved August 5, 2004 from http://moneycentral.msn.com.
9. National Institute of Standards and Technology. (2004). Retrieved August 10, 2004 from http://www.nist.gov.
10. Schroder, Norman and Graham, Colleen and Biscotti, Fabrizio. (2003). Moderate Growth Is Predicted for Security Software: Market Forecast, February, pp 1-6
11. Online version of the Washington Post news paper. (2004). Washington Post Web Site. Retrieved August 8, 2004 from http://www.washingtonpost.com.
12. Research and Market Emerging Security Technology. Research and Marketing Web Site. Retrieved August 1, 2004 from http://www.researchandmarkets.com/reports/35251.
13. U.S security exchange commission. (2004). Sec website. Retrieved August 8, 2004 from http://www.sec.gov/news/studies/cyberspace.htm.
14. University of Maryland Online Library. (2004). UMUC Web Site. Retrieved August 1, 2004 from http://www.umuc.edu/library/database/databases.html.
15. Wheatman, V. and Kavanagh, K. and Mogull, R. and Pescatore, J. and Nicolett, M. and Girard, J. and Stiennon, R. and Hallawell, A. and Wagner, R. and Witty, R. and Hirst, C. (2004). Hype Cycle for Information Security, June, pp 19.

More Security Management tutorials and guides














Your IP address will be sent with this e-mail

From e-mail to e-mail