The Fifth Annual Global State of Information Security
Five years ago, when CIO and PricewaterhouseCoopers collaborated on the first "Global State of Information Security" survey, very few people knew how bad the problem was. Now everyone knows. They just don't know how to fix it.
Indeed, the trend is even more pronounced when you follow the money trail.
Security Dollars Come from IT
Funding for information security comes from (could check more than one)
Another hallmark of an evolved security function is its convergence with physical security, usually under a CSO. This makes sense both for operational efficiency and because threats are becoming more converged. Access control is a classic example of convergence paying dividends. By combining building access and network access in one system, you save money, improve efficiency and create a single view into both physical threats (illegal entry) and digital ones (illegal network access).
And for four years, convergence of physical and IT security steadily increased. Until this year.
And Furthermore...
More data points to ponder from the "Global State of Information Security" Survey.
"Uh, Boss? Can We Talk?"
Are security and IT communicating enough with the CEO? By comparing their answers, one finds some startling disconnects.
What the Boss Thinks; What You Know
CEOs seem to think their enterprises are a lot more secure (and their employees more reliable) than CIOs and security leaders do. Conversely, CIOs and security leaders are a lot more optimistic about their budgets than are their CEOs.
| CEO | CIO | CISO/CSO/ Infosec dir. | |
|---|---|---|---|
| We've had fewer than 10 security incidents | 74% | 65% | 53% |
| We've had an unknown number of incidents | 18% | 25% | 28% |
| An employee or former employee was the source of the incident | 44% | 71% | 83% |
| We do not conduct enterprise risk assessments | 31% | 21% | 13% |
| Security spending will increase in '07 | 41% | 53% | 57% |
| Spending will stay the same | 41% | 32% | 28% |
We Need to Be But Are Not in Compliance With
Again, CEOs are far more confident than their CIOs and security execs that their enterprises are compliant. Either the CEOs are clueless, or the people who should know aren't telling.
| CEO | CIO | CISO/CSO/ Infosec dir. | |
|---|---|---|---|
| HIPAA | 9% | 14% | 27% |
| Sarbanes-Oxley | 9% | 20% | 32% |
| State privacy breach laws | 10% | 12% | 21% |
Privacy—Better, But...
Perhaps because of the sheer number of incidents involving privacy breaches, companies have improved their privacy practices. They are increasingly separating privacy from security and also separating security governance (which would take part in setting privacy policy) from tactical security. That means, for example, the people deploying monitoring tools aren't the ones setting the usage policy for those tools. But more work needs to be done. Some of the key steps to ensuring data privacy—encrypting databases, classifying data by risk level—haven't become standard practice. The industry least likely to have adopted privacy practices is technology. A privacy leader? Consumer banking.
Who Wants to Know?
Privacy Best Practices
| Employ CPO | Separate privacy & security | Separate security gov. & ops. | Classify data by risk | |
|---|---|---|---|---|
| Overall | 22% | 54% | 66% | 70% |
| > $1B revenue | 30% | 66% | 58% | 79% |
| Financial services | 33% | 64% | 60% | 80% |
| Consumer financial | 41% | 69% | 55% | 90% |
| Retail | 14% | 51% | 66% | 58% |
| Health insurance | 53% | 73% | 49% | 81% |
| Healthcare provider | 49% | 72% | 65% | 64% |
| Technology | 22% | 49% | 72% | 77% |
More on Privacy
While 60 percent of survey respondents posted privacy policies internally, only 24 percent posted policies on their external websites. Only 28 percent audited their privacy standards through a third party. Sounds like a cover-your-butt ploy; after all, if you don't have a policy posted, you can't be sued for violating or not living up to it. And if you haven't had your privacy audited, you don't have to fix all the problems an audit would find.
| Respondents who do not keep an accurate inventory of user data: | 69% |
|---|---|
| Respondents who do not keep an accurate inventory of where data is stored: | 67% |
$firstKeyword
Receive the latest security news as it breaks.
