TORONTO, 8 JULY 2010 - It only took Malcolm Harkins about 20 minutes to realize the investments he had made in Intel Corp.'s IT security strategy were paying off.
About five years ago, the world's largest chipmaker was trying to conduct an employee survey with a sample size of about five or six per cent of its overall staff. The HR group worked with an outside supplier to issue the Web-based survey to employees through an e-mail. Then all hell broke loose.
"Within minutes of people getting that, we had admin assistants contacting us who said, 'We think this is a targeted attack, don't click on the link, delete it,'" said Harkins, who is Intel's chief information security officer (CISO) and general manager, Enterprise Capabilities. The tech support team was flooded with calls, and Harkins soon received an extremely angry phone call from an HR executive who assured him the survey was legitimate and wondered why the URL was being blocked at the firewall. Harkins and his team soon resolved the situation, but it was a revealing incident.
"I was so elated that for the first time I had statistical proof that the money I had spent on making people aware allowed people to act as a part of our technical perimeter," he said. "They saw it, and they acted as if it was an antibody. It was a foreign object, and they were going to protect the company."
Harkins recently spoke to CIO Canada by telephone to discuss Intel's strategy and emerging IT security trends.
What's keeping you up at night?
Malcolm Harkins: The biggest vulnerability we face today and the future is not the thing that the technical security person would think of, like a botnet or technical flaw, but the misperception of risk. That's because of a couple of different factors. Some of it is economic, but if you think of the psychological components to it, the greater somebody perceives a benefit from something, the greater their tolerance of risk. With the ease of use of certain things -- whether it be an end-user, a consumer, or whatever, they may not fully appreciate what they're doing. They may share information and post it online because they don't feel any impact to it or they don't perceive there are any issues with it. Or they get an e-mail, which they think looks kind of cool, and they click on the link. If you go back even a few years ago, a user would feel the pain of it. Your system would crash, the network might get saturated with it. Today, those threat vectors are so subtle, you don't know that something's gotten installed on your computer. Because the incentive for the intruder is to not make you aware of it. Because they don't feel the pain, they only perceive the benefit.
Sign up for MIS Asia eNewsletters.