What’s worse, experts and government officials warn that these incidents are "canary in a coal mine" signs that portend a huge security disaster. At the Microsoft SafeNet 2000: Policy and Practice in the Internet Age summit in Redmond, Wash., experts tossed around talk of "the big one"?a digital Pearl Harbor, a World Trade Center e-mail bomb or an Exxon Valdez data spill. The CIO of a Fortune 500 manufacturing company believes these apocalyptic predictions may come to pass. "I hate to say it, but I think they’re right," he says. "Somebody’s going to break in somewhere and do something dramatic, and then people will wake up."

Security Through Obscurity

Many CIOs espouse a similar, it-always-happens-to-the-other-guy kind of thinking when it comes to security disasters. "We’re off the radar screen," says the Fortune 500 manufacturing company CIO. "Who cares what we do?except maybe for a competitor or someone who has a grudge against us?"

In today’s networked economy, security experts warn, CIOs can no longer afford to think that way. "The concept of ’security through obscurity,’ that ’There are so many companies out there, why would I be a target?’ was once almost plausible," says John S. Tritak, director of the U.S. government’s Critical Infrastructure Assurance Office in Washington, D.C. "If your company depends on a brand, any customer interaction, back-office business functions or networking dependencies, a minimal level of security is a must in today’s economy."

Security experts urge CIOs to tear down the firewall of silence that surrounds security. Corporate America needs to go public about its security secrets, they say, and share information to learn from others’ mistakes and create consistent protocols.

"We need to publicize attacks," writes Bruce Schneier in Secrets & Lies: Digital Security in a Networked World (Wiley, John & Sons, 2000). "We need to publicly understand why systems fail. We need to share information about security breaches: causes, vulnerabilities, effects, methodologies. Secrecy only aids the attackers."