Wed, October 15, 2003 — CIO — The best place to start with "The State of Information Security 2003," a comprehensive, exhaustive survey of global security practices conducted by CIO in partnership with PricewaterhouseCoopers, is with what it doesn’t include.

It doesn’t include any revelation that will make you slap your forehead and exclaim, "Oh, that’s what I should do!"

Nowhere in its pages will you find The Answer, because The Answer is a fiction, even if the problem—how to know if you’re making your enterprise as safe as possible as efficiently as possible—is not.

What this survey does include in its depth (7,500-plus respondents) and intricacy (44 questions cross-tabulated by company size, security budget, geographical region and dozens of other categories), is a profile of the imperfect and evolving world of information security. (You can view the entire survey at www2.cio.com/research and significant slices of it beginning on Page 86.)

According to the survey, you’re just beginning to appreciate information security as an ongoing discipline. You understand that establishing good security practices will be hard and will involve a complex integration of technology, education, risk analysis and regulation.

You know you need to do more, but the survey indicates that you’re not yet doing it.

In one sense, you can hardly be blamed for temporizing. As the survey shows, right now information security is a confused and paradoxical business. For example:

• You’ve increased spending significantly, and yet that investment has had no measurable impact on security breaches.
• You’re constantly warned about digital Pearl Harbors, yet the vast majority of reported incidents are relatively small.
• You’re told aligning security and business strategies should be a top priority, and yet those who’ve fared best avoiding breaches, downtime and security-related damages are the least likely to be aligned.

  All this may be out of your enterprise’s control. However, in other areas, information executives seem to be contributing to the confusion. For example:

• Respondents who suffered the most damages from security incidents were twice as likely as the average respondent to plan on decreasing security spending in the coming year.
• Those same respondents were nearly half as likely to list staff training as a priority.

In short, the survey shows that as much as the information security discipline has grown since its baptism—on Sept. 18, 2001 (one week after the terrorist attacks and the day the Nimda worm hit)—it hasn’t much improved.

However, what’s crystal clear is that confidence in security correlates to better security. In other words, enterprises that believe they’re doing better are doing better.