What follows are five selected views of "The State of Information Security 2003." Each view provides insight into some aspect of this complex new discipline, including an innovative method for benchmarking security spending.

You may not find The Answer here, but you will find data and lots of it. And there’s no question that that’s what you need to start improving your information security.

The Confidence Correlation

Those who are very confident in their security have a stronger security infrastructure in place, and they spend more on security as a percentage of their IT budget.

What the Numbers Mean

Structure and dedicated resources breed confidence. And confidence, experts say, breeds better security. In a sea of data that fails to reveal relationships between security and best practices, the confidence factor is a welcome sight.

The respondents who describe themselves as very confident in their organizations’ security (24 percent) can be called security leaders. That group has created far more structure around security within the organization than the group that describes itself as less confident. They’ve hired more security executives and given those executives more control over policy, spending and personnel.

Another key point: The more confident a company is in its security, the less likely that security goes through the IT department. Many in the security world believe that IT’s control of information security has been a limiting factor in improving information security.

For example, if the CIO is responsible for both the CRM implementation (which he’s been told to get done for $2 million in one year) and information security (which will add both time and money to the project), which charge will get his attention and which will get short shrift?

Bill Spernow, former director of IT for the Georgia Student Finance Commission, says the first thing he did when he got his job was fight for, and win, independence from the IT department. "If I see an organization where the CISO reports to some IT component, I see a position that’s not working, guaranteed," says Spernow. "The conflict of interest is just too much to overcome. Having the CISO report to IT, it’s a deathblow."

To Do:

1. Create structure around information security by hiring a CSO or creating an executive security committee.

2. Remove information security from the purview of the IT department.

The Per Capita Benchmark

Dividing employees by security budget reveals some surprising—and erratic—spending habits. But even here the confidence correlation is clear.

What the Numbers Mean

The per capita security spend—the information security budget divided by the number of employees—provides a benchmark with which a company can compare itself within its own industry and across industries, regardless of company size. It can also show how spending per employee varies geographically. This is a simple but powerful metric.