CIO —

Awareness of the problematic nature of information security is approaching an all-time high. Out of every IT dollar spent, 15 cents goes to security. Security staff is being hired at an increasing rate. Surprisingly, however, enterprise security isn't improving.

For the fifth straight year, CIO, CSO and PricewaterhouseCoopers (PWC) present select results and analysis from the "Global State of Information Security" survey, the world's largest, most comprehensive annual information security survey.

And the first question to ask is, Are you feeling anxious?

Are you feeling the disquiet that comes from knowing there's no reason why your company can't be the next TJX? The angst of knowing that these modern plagues—these spam e-mails, these bots, these rootkits—will keep coming at you no matter how much time and money you spend trying to stop them? The chill that comes from knowing how much you don't know?

Yeah, you're feeling it.

You're feeling it because you're seeing it. According to the 2007 survey, a comprehensive canvassing of 7,200 respondents on six continents, you see the information security problem more clearly than ever before. You're seeing it because you've created tools and systems in order to see it. For example:

• You've added processes. Three years ago, only 37 percent of companies reported having an overall security strategy. This year, 57 percent did. Also, nearly four out of five companies conducted enterprise risk assessments, at least periodically.

• You've deployed technology. Nine out of 10 respondents said they use firewalls, monitor users and rely on intrusion detection infrastructure, and that number approached 98 percent when responses were limited to larger companies (more than $1 billion in revenue). Encryption is at an all-time high, with 72 percent reporting some use of it (compared to 48 percent last year).

• You've hired people. The number of CISOs and CSOs employed continues to rise. And the mean number of information security workers per company has topped 100, most likely due to more outsourcing and the use of contract employees.

You've crafted an infrastructure for understanding. You're seeing it, and that's why you're feeling it. You're undergoing a shift from a somewhat blissful ignorance of the serious flaws in computer security to a largely depressing knowledge of them.

Continue Reading