Internet Security--A Plan of Attack

In the worst case scenario, a company begins to address these issues only after an attack has occurred.

In that situation, Danahy says, CEOs need to run damage control by asking their IT managers even harder questions:

When did this happen? Exactly what happened?
"If the administrator cannot pinpoint exactly when and how the attack occurred, more monitoring and checking are necessary," Danahy asserts.