While enterprises face all kinds of security risks, including vulnerabilities that must be patched and viruses that bombard corporate firewalls, the threats that strike the most fear into the hearts of chief security officers and their employees are the ones nobody has thought of yet.

After all, any known threat can be at least minimized, but a new exploit is always difficult to stop.

"We have to expect that cyber outlaws are devising new attacks," said Stan Stahl, president of Citadel Information Group, a Los Angeles-based information security consultancy. "Cyber criminals are bright people, expert at thinking out-of-the-box."

Last year alone, more than 4,000 computer flaws and viruses were found.

That may be a scary message, but CIOs and security admins can greatly reduce their companies' risk of falling victim to attack by taking a few vital steps. Most of those steps have more to do with sound policy than with intricate technological hacker-traps.

"There are no security silver bullets and no automatic technological answers," he said. "Senior management must take leadership and assume responsibility."

[ Read more ]