2.3 Analyze the technology being used 45
Identify industry trends and standards
This step can identify a common trend that businesses in all sectors are cur-
rently undergoing. Your business may be moving data via the Internet. Supply
chain integration may use virtual private networks (VPN) to communicate
with the vendors, including on-line ordering and JIT (Just in Time) raw
material order and delivery management.
Example. Both companies that create Widgets and Sprockets share the
same parts distributors (customers), vendors, and business partners. All the
major players in this market communicate with their suppliers via a VPN
over the Internet. Also, the parts houses are requesting the ability to gener-
ate JIT orders and on-the-fly orders via the Internet.
Analyze the technology being used
Next, you need to review your current use of technology. This review will
include your "trusted network." A trusted network is the network that a
company uses to conduct internal business. In many cases, the trusted network
is by default defined in the organization as "secure." The trusted network
typically supports the backend systems, internal-only-based web pages, data
processing, messaging, and, in some cases, internal instant messaging. In
many companies, the trusted network allows direct interaction between sys-
tems without encryption. Also, various protocols will exist within the trusted
network without any type of filtering or even virus scanning.
The problem with this definition is that many assumptions are being
made at these companies. A trusted network is not always a secure network.
In fact, in many cases the trusted network cannot be trusted, because an
internal network is composed of many different networks. These include
new acquisitions, old acquisitions, international access points, and even sev-
eral access point to the outside world.
A common practice is to define the trusted network as the network that
internal employees use when at the office or via a secure, controlled dial-in
mechanism. A single access point is established to the outside world via a
mechanism called the DMZ (demilitarized zone). A DMZ is an isolated
network placed as a buffer area between a company's trusted network and
the nontrusted network. The DMZ prevents outside users from gaining
I Chapter 2