Feature

The Global State of Information Security 2006

By Allan Holmes

September 15, 2006 — CIO — When it comes to information security, the reflection you see in your morning mirror is probably not that of a sharp, confident, professional IT executive. Rather, that man in the mirror is more likely to look like a gangly, awkward, not-yet-to-be-fully-trusted teenager.

That’s what "The Global State of Information Security 2006" survey tells us. In its fourth edition, this largest-of-its-kind survey reveals that global information executives, still relatively new to security’s disciplines, are learning and improving but are still prone to risky behaviors—behaviors that could have devastating consequences.

The study by CIO, CSO and Pricewaterhouse-Coopers (PwC), with 7,791 respondents in 50 countries, indicates that an increasing number of executives (CEOs, CFOs, CIOs, CSOs, and VPs and directors of IT and information security) across all industries and in private- and public-sector organizations continue to make incremental improvements in deploying information security policies and technologies, although the rate of improvement is slower than in previous years. They’re becoming more financially independent, with some security budgets increasing at double-digit rates. And they say they’re more confident in their level of security, perhaps because their networks have not had a serious virus or worm in the past 12 months.

But teenagers, as any parent knows, live in the moment and have an ability to ignore what they know they should do and do what they know they shouldn’t. The survey shows us that most executives with security responsibilities have made little or no progress in implementing strategic security measures that could have prevented many of the security mishaps reported this year. Only 37 percent of respondents said they have an overall security strategy. And they’re planning to focus more on tactical fixes than on strategic initiatives, ensuring that in the coming year they will be more reactive than proactive.

One of the most unsettling findings in this year’s study is the sad state of security in India, by a wide margin the world’s primary locus for IT outsourcing. The problem is less with the outsourcing companies themselves than with the dangerous waters they swim in. Many respondents from India admit to not adhering to the most routine security practices. The problem is obvious, but right now it’s apparently easier to ignore than to address.

Harder to ignore is the constant news of large organizations losing laptops packed with unencrypted personal data on millions of customers. Every year we report that such incidents should motivate companies to tighten security, but every year the survey indicates that’s not happening. Similarly, even after Hurricane Katrina, which hit the Gulf Coast seven months before we launched our survey, a majority of companies still did not have a business continuity/disaster recovery plan in place, and plans to complete one this year have become less important to security officials than in 2005.

Complacency, it seems, abounds. A large proportion of security execs admitted they’re not in compliance with regulations that specifically dictate security measures their organization must undertake or risk stiff sanctions, up to and including prison time for executives. Some of these regulations—such as California’s security breach law, the Health Insurance Portability and Accountability Act (HIPAA), and non-U.S. laws such as the European Union Data Privacy Directive—have been around for years. Is this an example of adolescent rebellion, or are security executives finding it hard to obtain the necessary resources to comply?

The answer, says Mark Lobel, a PwC advisory partner specializing in security, is neither, actually. The information security discipline still suffers from the fundamental problem of making a business value case for security. Security is still viewed and calculated as a cost, not as something that could add strategic value and therefore translate into revenue or even savings.

But if one digs into the results, there are reasons for optimism. There’s evidence that organizations that comply with security laws are more likely to be integrating and aligning security with their enterprise’s business strategy and processes, which in turn reduces the number of successful attacks and the financial losses that result from them. In short, security can create value if it’s part of an organization’s business plan and if the executive in charge is part of the executive team making those strategic spending and policy decisions.

The six sections that follow illustrate that global information security management practices are varied and, with a few notable exceptions, have yet to mature.