Niemi also formalized the process of registering guests who enter his building and is adding computer lab surveillance.

Cannon has also tightened physical security by revoking several employees’ access to the data center. He also moved many consoles out of the data center, all in an effort to reduce traffic near critical systems.

The MWRA already has tight integration of physical and network security. To begin with, the computers are in a locked room, which is accessible by key card and manned 24/7. Visitors check in and check out at the front desk, and after visitors leave, their host sends a memo to senior management detailing the visit.

SCADA connects through a private line (soon, via microwave) to pump stations and reservoirs. If something goes wrong at a water facility, an alarm sounds both onsite and at the SCADA operations centers. The alarm also flashes on the computers, and it can’t be shut off until a formal acknowledgement of the alarm is made and physically logged by a person with clearance to do so.

"Roving crews" periodically go to MWRA pump stations and storage sites to check the integrity of the facilities and their connection to the control computers. Most of the sites are under surveillance.

"I see IT and these physical security rules meshing more and more," says Cannon. "Especially when you talk about disgruntled employees and screening. But it’s a fine line. We want to treat employees like adults. Cut off too much access and you’re saying you don’t trust them."

Besides meshing physical and IT security, two other measures CIOs can take are to get involved and share information with each other. Joining Cannon in the Information Civil Defense Group, meeting with government groups like the National Infrastructure Protection Center, raising awareness of the cyberterrorist threat within one’s own company and opening security dialogues with peers are all important steps to take.

Six months after the Sept. 11 attacks, there’s a great deal of optimism among technology professionals about their ability to deflect the cyberterrorist threat.

"[Awareness] is a big reason for optimism," says Alan Paller, security expert and director of research at the SANS Institute in Bethesda, Md. "The operations guy is getting a call from the vice chairman, someone really high up, who’s asking what the company is doing about this threat. That conversation has never happened before. Underneath there are still a lot of vulnerable systems out there, but I believe cyberterrorism is very hard to pull off.