Chapter 8. Internal Network Security

The next time you are sued for a network security failure, you should assume that the lawyer taking your deposition will have read Linda's book and the first question is likely to be whether you have, too.

Fred Chris Smith, attorney and co-author of A Guide to Forensic Testimony

Congratulations! You're the director of a famous museum. You've been busily preparing for an important show for many months. Today you received the first of many huge shipments of finely crafted, historic art pieces from public and private collections. Curators hustled and bustled to prep the sculptures. Plans are in place to receive and electronically inventory hundreds of porcelain statuettes that will be arriving in waves of shipments over the next few weeks. Many countries are participating in the show by providing their most prized collections!

Because of the large scale of this exhibition, a number of shipping companies have been contracted to manage the flow of deliveries from around the world. Coordination of a project of this scope must be smooth and strategic. And, as director, it has to be your baby.

Aren't you lucky that we now have computers? Twenty years ago, this project would have been a nightmare to coordinate.

Or are you lucky? In such a high-tech, computerized world, who would have thought that the database server that maintained the critical data for show management would be wide open? As a result, anyone can obtain access to the archives that detail the ebb and flow of priceless artifacts. Looking for a new Remington to add to your underground collection? Look here's one arriving next Tuesday at 4:00 p.m., being delivered from JFK via land route by Joe's Family Trucking. Not the kind of information you'd want well known, is it?

No doubt, a highly-placed museum director would be exceptionally conscious of security. But it's also doubtful that he'd see the computer database as a potential security risk. Few people not directly involved in information security ever do.

Just imagine, though, learning right before your big show that your own museum network is not secure. And that knowledge makes you afraid to put sensitive information onto your own network.

Preposterous? Maybe. But that's exactly the situation that was faced by Gerald Pushman at the Chambersburg Museum of Art. Just consider…