While infrastructure security has long been on corporate agendas, the events of 11 September undoubtedly emphasised the importance of effective disaster recovery. Anthony Harrington finds that while firms accept the costs of security as an essential part of doing business, many of them are only slowly realising that a firewall is just one element of what should be a constantly refreshed and reassessed defensive system.