No Compromises

In PowerTel's case, IT security is the part-time responsibility of one of Lindner's staff. This principally entails maintaining network security, or"the moat between PowerTel and the outside world", as Lindner puts it. He also says there is a constant influx of recommended security patches from vendors and much time is spent applying those.

"Information that ultimately resides in our core systems is made available on the Internet either to business partners or customers through a portal. So clearly we have to have bulletproof security that ensures those core systems can't be compromised from the outside. That's a key focus," Lindner says.

However, security is not an issue Lindner and PowerTel worry about every single day. While there are constant attacks on its external facilities, they appear to be mainly automated and blind, rather than targeted, he says."Certainly to our knowledge, we've never suffered a material loss.

"Looking at the Australian Standard 4444, though, you see just how incredibly broad the overall security problem is. Obviously, internal threats are a major risk, especially in larger organisations, and loss of company information is important, so we have policies around the retention of data in IT systems," he says."The auditors have in fact audited our security policy and provided extensive feedback. Our tactical mistake there was in saying that we're looking to build our own security policy around AS 4444. That of course then opened up the auditors' minds to all the things in the standard that we don't do," Lindner admits in good-humoured fashion.

In addition, on an annual basis, or thereabouts, Lindner calls in external security experts to inspect PowerTel's systems and report on vulnerabilities they find. Their recommendations are subsequently implemented in an exercise that Lindner concedes is expensive but worth the benefits.

According to Lindner, security measures to date have generally been accepted throughout the business. The only issue over which any friction has arisen, he says, is that some users would like to dial into PowerTel from outside using their own PC (see"Home Is Where the Exposure Is", page 123). However, the company does not currently provide for this as the risk of introducing viruses is considered too great. And while Lindner will personally set security policy, he says he'll always look to PowerTel's executive committee to endorse it, given its importance.