VI. Dancing in the Dark

You know your information security strategy is working when the number of successful breaches is low, the amount in financial losses is negligible and network downtime is kept to a minimum. Unfortunately, a large percentage of security leaders worldwide have no idea if their security plans are working because they don’t know any of these numbers.

From 2003 to 2005, the percentage of survey respondents saying they had fewer than 10 negative information security incidents in the past year remained steady. But this year, we included the option to answer that you do not know how many negative security incidents occurred. This year, nearly one-third of respondents admitted that they do not know how many breaches or unauthorized access events occurred within their organizations.

To a certain extent, that’s understandable. Attacks can be hard to identify, and networks can be extensive. What’s less comprehensible is that a significant portion of respondents said they have not installed some of the most rudimentary network safeguards. Only one-third of respondents have put in place patch management tools or monitor user activity. Less than half use intrusion detection software or monitor log files (the two best methods organizations can employ to detect breaches) and even fewer use intrusion prevention tools. Surprisingly, more than 20 percent of respondents don’t even have a network firewall.

Installing a firewall is easy. If a significant number of respondents haven’t even done that much, it shouldn’t be surprising that many more are struggling with the hard stuff. It’s hard to quantify attacks and what’s lost because of them. First, just understanding what constitutes an incident can be confusing. "Is having spyware on your computer an incident?" Sony’s Spaltro asks. "Some may not think so, but we treat it as such." Second, the ability to track, record, correlate and communicate up the executive chain is lacking in most organizations. For the fourth consecutive year, there was an increase in the percentage of respondents throwing their hands up and saying they have no idea how much money their companies lost due to attacks. It’s now up to 50 percent.

"How do you calculate the loss of intellectual property or the damage to a corporate reputation?" Lobel asks. "Very smart people have a hard time agreeing on the value."

But until the security department can put a credible dollar figure on what the company is losing because of poor security, the boardroom isn’t going to listen to security executives asking for more money to spend on technology or on skilled security workers (cited as the top resources needed to improve security). The CEO wants to know how security affects shareholder value. But answering that would require a strategic overview and, as we have already seen, security professionals, by and large, don’t have one. At least, not this year.