CIOs can also limit the damage any one employee can do by setting up access controls that map a person’s job function to the resources he needs to do that job. Do that from day one, and your company can avoid giving the impression that access levels have to do with him as a person?they’re simply part of a given job function. (See "Software Sentries," Page 80, for details on the technology that can help you do this.)

Also, there should be checks and balances in place that minimize the damage that one IT employee could do. One person might be in charge of changing files, another in charge of changing the network fabric and a third in charge of modifying payroll records. "Most big computer systems have a log-in that might be in a generic way described as the superuser," says Daniel Geer, CTO of managed security company @Stake in Cambridge, Mass. "If I gain the superuser power and I should not have it, the question is, How far does it extend? I’d rather not have the power to change the company invested in one person?not because I don’t trust that person, but because if their credentials are stolen, that is an uncontainable risk."

Build Security from the Inside Out

These access controls are only the first step toward a decreasing emphasis on what’s known as perimeter protection?security’s equivalent of the moat around a castle. Surprisingly, more than half of companies that responded to one CIO survey last year don’t have critical information restricted to a confined area, separate from other information that requires less security. In other words, once an intruder gets over the moat, he won’t even need to pick a lock to get the crown jewels. "Some corporations run hard on the outside and soft on the inside: Once you get in, you have free access," says Larry Bickner, vice president and information security officer at Nasdaq in New York City.

To protect its trading floor, Nasdaq takes the opposite approach, and one that experts recommend: progressive hardening from the inside out. "We break our world into various trust zones, and we control who’s within that zone or space," Bickner says. "I don’t have access to human resources servers or systems. It’s not part of my job. We have a completely different trust space for the market system, and where those overlap, we control those connections very strictly.... Even if one layer isn’t set correctly, the other layers compensate. That layering gives you hardening. Our architecture is hardened to the point that when you’re on the inside, it’s not much easier to get at things, frankly, from being on the outside."