LESSON 11: EMERGING FIREWALL MANAGEMENT ISSUES Firewalls introduce problems of their own. Internet security involves constraints, and users don t like this. It reminds them that Bad Things can and do happen. Firewalls restrict access to certain services. The vendors of information technology are constantly telling us anything, anywhere, any time , and we believe them naively. Of course they forget to tell us we need to log in and out, to memorize our 27 different passwords, not to write them down on a sticky note on our computer screen and so on. Firewalls can also constitute a traffic bottleneck. They concentrate security in one spot, aggravating the single point of failure phenomenon. The alternatives, however are either no Internet access, or no security, neither of which are acceptable in most organizations Firewalls protect private local area networks (LANs) from hostile intrusion from the Internet. Consequently, firewall protection allows many LANs to be connected to the Internet where Internet connectivity would otherwise have been too great a risk. Firewalls allow network administrators to offer access to specific types of Internet services to selected LAN users. This selectivity is an essential part of any information management program, and involves not only protecting private information assets, but also knowing who has access to what. Privileges can be granted according to job description and need rather than on an all-ornothing basis. The issue that most firms grapple with is the make-or-buy decision. Until recently, few vendors have offered off-the-shelf firewall systems. Hence, in the past, construction of firewalls required a significant amount of corpo-rate time and effort, and most firewalls were handcrafted by site adminis-trators. With more choice in the marketplace, managers need to be careful in selecting a firewall solution and need to evaluate the trade-off between ease of use, ease of administration, and data security. Frequently, technical design of the firewall is dictated by financial con-cerns about the costs of buying or implementing a firewall. For example, a complete firewall product may cost anywhere between $0 and $200,000. At the low end, configuring a router will cost staff time. Implementing a high- end firewall with specialized proxy servers might cost several months of programming effort. Managers must also consider the costs of systems management and evaluate firewalls not only in terms of immediate costs, but also in terms of continuing maintenance costs such as support and soft-ware upgrades. Firewalls also present capacity management problems. For instance, in companies that use the Internet a lot, firewalls represent a potential bottle-neck, since all connections must pass through the firewall and, in some cases, be examined by the firewall.

Finally, firewalls present content management and control problems. Who manages the information on a firewall? Is it the function of the MIS department, marketing communications, or should it be left to the func-tional units? This is a tricky problem because for large firms, content man-agement is a function of the marketing communications department, which zealously guards against any effort that may affect the corporate image. In such a scenario, functional units would have to approach marketing com-munications for clearance and approval before placing anything online. The approval process is bottlenecked and could result in delays of several weeks. In the meantime, the functional units are getting worried because the content is getting dated and would have to. be updated the minute it is approved: a classic Catch 22 situation. Addressing control issues will re-quire serious thinking about delegation of authority, organizational struc-ture, and content management. Notes E-COMMERCE Copy Right: Rai University 11.676.1 33

TUTORIAL 3: E-COMMERCE Copy Right: Rai University 34 11.676.1