Ed Amoroso
Chief Security Officer, AT&T
From what I've seen, CIOs do not have a good understanding of how vulnerable (or not) their businesses are to malicious attack.

Some CIOs incorrectly assume they can reduce their security budgets because they have not been hit recently with a virus. This is not an accurate security metric, by any means. On the other end of the spectrum, we see CIOs who cry wolf at every opportunity, referring to the mostly useless alarms generated by intrusion-detection systems as "attacks." This is a similarly inappropriate metric, leading to decisions based on exaggerated risk.

There is no simple solution to this tough problem. In fact, the only way to fix it is through the gradual and painful maturation process that the information security discipline must undergo. Every professional field—especially in science and engineering—begins with wild swings between what is viewed as reasonable and what is viewed as nonsense. Mathematics has its numerology, chemistry has its alchemy, astronomy has its astrology, and so on. Information security, as a discipline, must weed out silly and inaccurate views. This will result in a more mature field, one based on well-founded underlying scientific and engineering principles. Medicine, for example, is based on biology, chemistry and the like. An information security profession should be based on mathematics, system engineering and computing. Only then will CIOs have a reasonable base on which to determine whether they are vulnerable.

Paul Stamp
Senior Analyst, Enterprise Security Technologies, Forrester Research
The biggest problem I see is how to adapt to changing business climates. We're fundamentally changing the way we do business. We're sharing data with people we never thought we'd need to share data with. We get access to our data from all sorts of places, from our offices in upstate New York to coffeehouses in Bangkok. At the same time, compliance mandates mean that we're ever more accountable for the data we store and process. And security spending is shrinking as a proportion of overall IT budgets.

The typical IT security model today often amounts to a smattering of Band-Aid solutions that fail to address underlying causes of what is causing the security problems in the first place. What's more, we assume that the good guys are "inside" our environment, and the bad guys "outside," whereas in reality we often share more sensitive information with contractors and suppliers than we do with our own employees. Most security controls assume that we control the infrastructure where our information resides.