After the September 11 attacks, officials in five U.S. states and two Canadian provinces asked Microsoft (MSFT
), Boeing (BA
), and dozens of other companies how well prepared they would be if another disaster struck. Most corporations thought they had adequate backup power and communications channels.
The complacency didn't last. Under a study dubbed Blue Cascades, officials analyzed reams of data they had collected to project what would happen if terrorists blew up a key electrical switching station owned by the Bonneville Power Administration, followed by the severing of a natural gas pipeline through Canada. On top of the immediate power outages, an overloaded backup generator at a telecom operator failed, cutting phone and data lines. As Internet traffic surged, corporate servers crashed. Factories, offices, food stores, and banks were plunged into darkness. In the hardest-hit parts of the West, power wasn't restored for weeks.
Similar "what-if" exercises are under way across the U.S. these days. And they are showing executives and local governments how vulnerable they are to well-coordinated terrorist attacks against critical infrastructure. Until Blue Cascades, "there was a real disconnect between the private and public sectors," says Matt Morrison, president of the Partnership for Regional Infrastructure Security, a consortium of government, corporate, and military organizations that sponsored the study.
Now executives are grasping at countermeasures. Many are upgrading information technology systems to boost cybersecurity and setting up duplicate data centers. Some are buying more backup generators. Banks, health-care providers, and Wall Street brokerages are adding spare high-speed telecom lines.
Companies are also experimenting with technologies that are now too new or expensive for widespread commercial rollout. A United Technologies unit (UTX
), for example, is helping build pilot electrical plants powered by fuel cells for Merck (MRK
), Verizon Communications (VZ
), and other companies. In Lower Manhattan, NASDAQ and several brokerages are trying out a wireless technology known as millimeter wave communications from Lihue (Hawaii)-based Loea Corp. From antennas in office windows, Loea beams high-frequency signals carrying data up to 1,000 times faster than DSL connections. And Loea says it can install the system in a day without complex retrofits of corporate networks.
While such offerings may be enticing, Corporate America isn't spending with abandon. Instead, companies are carefully weighing costs against potential benefits. "The question is the level of risk companies are comfortable with and what is economically viable," says consultant Paula L. Scalingi, former director of the U.S. Energy Dept.'s critical infrastructure protection office.
Consider the effort to boost security at ports, where most containers used to enter the U.S. with cursory checks. One pilot project involving shipping lines, big U.S. importers, and port operators in Asia, Europe, and the U.S. monitors the contents of hundreds of containers from their loading to the time they arrive stateside. The containers are fitted with electronic seals, sensors to detect tampering, and bar codes with a variety of shipping data that are scanned by handhelds. "We have total visibility of what is in a container, who loaded it, and who touched it at every point in the chain," says Lance Trebesch, general manager of Sunnyvale (Calif.)-based Savi Technology Inc., which supplies the system.
In the pilot's next phase, containers will be tracked via global positioning system devices, and more sophisticated sensors will scrutinize contents. Participants will also assess whether the system will pay for itself through higher efficiency. "We have to be very careful that what we do is affordable," says Earl Agron, port security director for shipping giant APL, which participates in a similar pilot project.
Cost is a big issue when it comes to computers and telecom services, as well. Many companies actually have all the PCs, networking gear, and primo software they need to operate backup data centers. Trouble is, they're relying on a single set of communications links. "They bought all the newest hardware and software, but investments in telecom infrastructure did not keep pace," says William R. Hummel, emergency preparedness product director for Verizon, which is finding new customers for its latest fiber-optic offerings.
New cybersecurity products are also flooding into the market -- often leaving companies confused over how to allot tight IT budgets. "The patches are there, the fixes are there, the firewalls are there," says Bruce Schneier, founder of Cupertino (Calif.)-based Counterpane Internet Security Inc. "But companies don't install them due to the expense, and don't know which ones are important."
Simple is often better, Schneier argues. Counterpane, for example, sells an Internet "alarm service" that alerts network managers or telecom providers as soon as it suspects a hacker has entered a network, and takes steps to protect sensitive data. Counterpane says clients include Abbott Laboratories (ABT
) and John Deere & Co. (DE
)
Are companies investing enough to protect themselves? Nobody will know for sure unless there is another attack. But the hard-nosed approach has one upside: Companies have made it clear there is a big market for security products that also make business sense. Those demands could well inspire a new burst of innovation.
MARCH 24, 2003 |
Copyright 2003, Bloomberg L.P.
Printer-Friendly Version
