Intranet Security

It is important to an organization's continuation that its confidential and proprietary information and intellectual property are protected. Companies are taking advantage of the connectivity and ease of use of Internet technology to create intranets for organizational communication, collaboration, and coordination. With implementation of an intranet comes the inherent issue of security. The safety and integrity of the organization's information are compromised.

Although outsiders are a much greater threat today than before the Internet, employees, former employees, and other insiders are still the major security concern. The category of other inside network users is often quasi-employees and includes consultants, business partners, contractors, and temporary employees. They do not have the commitment of regular employees. For purposes of systems access, it may be difficult to decide who is an employee and who is not. All such individuals are familiar with the organization, people, and systems, providing a greater opportunity for the dishonest or disgruntled to take advantage of vulnerabilities or to use authorized access for unauthorized activities (Blackwell, 1998, p.1).

This paper examines the concept of information security, and evaluates its role in the construction of a secure intranet site.

Overview of Intranets

Organizations use Internet networking standards and Web technology to create private networks called intranets, which are "internal organizational network[s] that can provide access to data across [their] enterprise[s]" (Laudon & Laudon, 2000, p.298). An intranet uses the company's existing network infrastructure along with Internet connectivity standards and software developed for the World Wide Web (Laudon & Laudon), and does not incur significant additional investments in computer hardware and software to implement (Gupta & Hebert, 1998). Activities that an intranet supports include:

1. Promoting collaboration between groups that are dispersed geographically (Gupta & Hebert).

2. Disseminating comprehensive information about the company, its products, and services (Gupta & Hebert).

3. Providing employees with information such as job openings and health benefits (Gupta & Hebert).

4. Integrating applications that reside on computers that may be separated geographically (Gupta & Hebert).

5. Transferring files between computers in different locations (Gupta & Hebert).

6. Communicating locally or remotely among employees (Gupta & Hebert).

7. Providing employees with training material that can be used directly or downloaded from the site (Tabor, Pryor & Gutierrez, 1997).

Types of Organizational Information

In Is Your Company Ready for an Intranet, Gupta & Hebert (1998) indicate that organizational information is either static or dynamic; intranets disseminate both types of information easily. Static information, which is updated periodically, includes telephone directories, internal job openings, employee benefits information, and policies and procedures. These documents are static because information does not need to be disseminated upon creation. The goal of static intranet applications is to create repositories of information for access on a need-to-know basis rather than for distribution just in case it is needed. Generally, static applications are inexpensive, stand-alone projects that have little or no influence on an organization's customers, suppliers, or stockholders. Dynamic information, such as sales and inventory transactions, is updated continuously. This information, which impacts an organization's customers, suppliers, or stockholders, links users to company databases, information systems, and proprietary transaction systems. Users update information by gathering and processing data through electronic means.

Advantages and Disadvantages of Intranets

Intranets deliver information in various forms to employees, customers, and suppliers in a timely and cost-effective manner (Gupta & Hebert, 1998). Information, when updated and maintained in a central location, can be easily retrieved on an as-needed basis, thus eliminating issues associated with traditional dissemination methods (Gupta & Hebert).

Intranets create virtual workplaces where employees can coordinate their work, regardless of time and place (Gupta & Hebert, 1998). This increases team effectiveness because every team member shares the same accurate and timely information (Gupta & Hebert).

Because intranets use the same technology as the Internet and capitalize on existing hardware and software, the need for large additional purchases is virtually eliminated (Gupta & Hebert, 1998). Intranet technology enables companies to exploit existing information infrastructures for internal communications, therefore eliminating concerns regarding computer application development and compatibility (Gupta & Hebert).

Intranet technologies increase productivity by helping employees collect, process, and disseminate information in ways that are more effective (Gupta & Hebert, 1998). Employees do not have to spend significant time searching for information or verifying that information is accurate or current (Gupta & Hebert).

Gupta & Hebert (1998) found that although intranets provide many benefits for a company and its employees, there are some disadvantages. Information needs to be updated continually to be useful. Technologically is continually changing; ongoing maintenance is necessary. Regardless of security sophistication, outsiders could accidentally or intentionally break through and access company information.

Information Security

The acceleration of change in telecommunications network environment presents a challenge to the protection of information (Blackwell, 1998). New technologies and rapid connectivity lead to increased risks within an organization's enterprise because valuable information is more accessible and easier to divert (Murphy, Boren & Schlarman, 2000). One of the major issues for intranets is information security, defined as "the protection of information from accidental or intentional loss of availability, integrity, or confidentiality" (Blackwell, p.1).

Availability, "the accessibility of systems and information to authorized users" (Murphy, Boren & Schlarman, 2000, p.1), ensures that systems operate