Feature

Conventional Wisdom Of Information Security

Five truths have emerged from five years of the "Global State of Information Security" survey.

September 06, 2007 — CIO — After five years of conducting the "Global State of Information Security" survey, we have noted some critical trends in information security. We've also uncovered nontrends—numbers that remain so constant and predictable that we can now call them conventional wisdom. Here, then, are five pieces of wisdom based on numbers in the survey that never seem to change.

Spending lags. You're always about 10 percent happier with security policy's alignment with the business than you are with security spending's alignment. Over the years, roughly 85 percent of you have said that your security policies are completely or somewhat aligned with the business, while just 75 percent said that about spending. After all, who doesn't want more money?

Also see

The Fifth Annual Global State of Information Security

Partners too. You're more confident in your own security than that of your partners, suppliers and vendors. Once again, around 80 percent to 85 percent of you were either very or somewhat confident in your security, but when you were asked about partners and vendors, the number dropped to between 70 percent and 75 percent. Remember, you're someone's partner and he's not too thrilled about you either.

Few are cocky. About one in 12 of you think very highly of yourselves. Since 2003, the number of respondents who claimed 100 percent of their users were in compliance with their security policies hovers around 8 percent.

Size doesn't matter. Company size does not affect spending. When the information security budget is measured as a percentage of the IT budget, it remains constant no matter how many employees a company has or what its revenues are. Size of company matters less in security spending than in industry. Technology companies spend the most; nonprofits and educational enterprises spend the least.

Banks lead. Financial services companies are attacked more but suffer less. Over the years, respondents in the money business have reported more security incidents without an appreciable increase in losses or downtime as a result. They do this despite not having significantly larger security budgets than others. The financial sector models best practices. Other stories by Scott Berinato © 2008 CXO Media Inc.

Comments

Share [+]

TOOLS

Comments

Digg This

SlashDot

CENTER OF EXCELLENCE

Security

» Prudential Financial Protects its Brand with Symantec Data Loss Prevention Solutions
FORTUNE 100 insurance leaders rely on the Symantec Data Loss Prevention solution to protect sensitive customer data.

» Information Security: Data Drains and How to Prevent Loss
Do you know where your confidential data is, where it is going, and how to prevent it from leaving your organization.

» Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands
Learn what the thought-leaders at PricewaterhouseCoopers have to say on the risks associated with data security.

» 7 Requirements of Data Loss Prevention
Incorporate best practices from many companies using DLP solutions as you establish your organization's requirements and safeguard confidential data.

» Ponemon Study: How Much Does a Data Breach "Cost"?
35 U.S. organizations that lost confidential information and had a regulatory requirement to publicly notify affected individuals are studied in this report.

Center sponsored by