Near the end of 1997, ING Life, an insurance provider in Canada, determined the need to provide faster access for brokers. Outside brokers relied on fax, phone and postal service for policy information requests and agent offices connected to the headquarters via 56-kbps frame relay. Thus, ING implemented an extranet solution using the Internet to connect external brokers and agent offices that lowered response times from hours to under a minute. This solution raises many questions concerning use of the Internet as part of its business solution. ING’s decision to facilitate use of the Internet for business operations poses many probable difficulties and risks. Use of an extranet can introduce an organization to unacceptable risks to its internal data and information systems. For example, allowing access to internal databases through an extranet webserver increases the opportunity for attackers to breach the network for several reasons. In ING’s case, it uses two Windows NT servers to provide web services protected by a single hardware firewall. Multiple brokers connect to ING through web services, causing multiple simultaneous openings in the firewall. Attackers can employ a port scanner to scan for open ports with known exploits to gain access. Furthermore, too many open extranet connections also create multiple entry points for viruses or other malicious code to infiltrate the network and cause damage. Another potential entry point for a security breach can originate from a broker’s own computer. Although it wasn’t stated in the case study, many times external brokers will purchase their own computer versus the company providing one. Thus, ING has little recourse to enforce its own security policies on that device. Whether the device contains inadequate access controls or if the users have a lack of understanding of security policies and requirements, this can expose the interconnected networks to penetration, especially if the device was already compromised. The proliferation of social engineering attacks today drives the need for adequate security on any device that accesses a company network, primarily since many systems are compromised through user missteps including opening email attachments or clicking links that contain malicious code that allow attackers to execute code to identify installed software that can be breached through known exploits. This could invariably lead attackers to discover holes in ING’s browser application as well. Another risk for ING can come from a rogue broker with access to confidential information. In any given scenario, direct access to ING’s database presents a goldmine of information that can be taken, sold or used for other malicious intent and may even leave ING legally liable. It can also be difficult to trace what data was taken or how it was used.