Conventional Wisdom Of Information Security

Feature

Sep 06, 20072 mins

IT Strategy

Five truths have emerged from five years of the "Global State of Information Security" survey.

After five years of conducting the “Global State of Information Security” survey, we have noted some critical trends in information security. We’ve also uncovered nontrends—numbers that remain so constant and predictable that we can now call them conventional wisdom. Here, then, are five pieces of wisdom based on numbers in the survey that never seem to change.

Spending lags. You’re always about 10 percent happier with security policy’s alignment with the business than you are with security spending’s alignment. Over the years, roughly 85 percent of you have said that your security policies are completely or somewhat aligned with the business, while just 75 percent said that about spending. After all, who doesn’t want more money?

Also see

The Fifth Annual Global State of Information Security

Partners too. You’re more confident in your own security than that of your partners, suppliers and vendors. Once again, around 80 percent to 85 percent of you were either very or somewhat confident in your security, but when you were asked about partners and vendors, the number dropped to between 70 percent and 75 percent. Remember, you’re someone’s partner and he’s not too thrilled about you either.

Few are cocky. About one in 12 of you think very highly of yourselves. Since 2003, the number of respondents who claimed 100 percent of their users were in compliance with their security policies hovers around 8 percent.

Size doesn’t matter. Company size does not affect spending. When the information security budget is measured as a percentage of the IT budget, it remains constant no matter how many employees a company has or what its revenues are. Size of company matters less in security spending than in industry. Technology companies spend the most; nonprofits and educational enterprises spend the least.

Banks lead. Financial services companies are attacked more but suffer less. Over the years, respondents in the money business have reported more security incidents without an appreciable increase in losses or downtime as a result. They do this despite not having significantly larger security budgets than others. The financial sector models best practices.