Today’s most compelling technologies are giving you the biggest security headaches. Social networking sites such as Twitter,
Facebook and LinkedIn enhance collaboration and help your company connect with customers, but they also make it easier than
ever for your employees to share customer data and company secrets with outsiders.
Virtualization and cloud computing let
you simplify your physical IT infrastructure and cut overhead costs, but you’ve only just begun to see the security risks
involved. Putting more of your infrastructure in the cloud has left you vulnerable to hackers who have redoubled efforts to
attacks against the likes of Google, Yahoo and other Internet-based service providers. A massive Google outage earlier this
year illustrates the kind of disruptions cloud-dependent businesses can suffer.
But there’s also good news. Even though the worst economic recession in decades has compelled you to spend less on outsourced
security services and do more in-house, your security budget is holding steady. And more of you are employing a chief security
Such are the big takeaways from the seventh-annual Global Information
Security survey, which CIO and CSO magazines conducted with PricewaterhouseCoopers earlier this year. Nearly 7,300
business and technology executives worldwide responded from a variety of industries, including government, health care,
financial services and retail.
To read more on security, see: Twitter Taken Down By
Denial-of-Service Attack and Social Networking Malware:
Three Ways to Protect Yourself.
See the complete survey results here.
Check out how we got the numbers.
These trends are shaping your information security agenda. “Every company worries about protecting their data, especially
their client data,” says Charles Beard, CIO at Science Applications International Corp. (SAIC). “Under the old business model,
everyone had to get together in the same building in the same geographical area. Now everyone is using the Internet and mobile
devices to work with each other. That’s where we see the promise of things like social networking. The flip side is we’re
exposed to the dark side of cyberspace. Adoption of this technology is well ahead of efforts to properly secure and govern
Read on to learn what we found.
Top IT Security Priorities
New investments are focused on protecting data, authenticating users
2. Web content filters
3. Data leakage prevention
4. Disposable passwords/smart cards/tokens
5. Reduced or single-sign-on software
6. Voice-over-IP security
7. Web 2.0 security
8. Identity management
9. Encryption of removable media
The Promise and Peril
of Social Networking
In less than two years, social networking has gone from an abstract curiosity to a way of life for many people. When someone
updates their status on Twitter, Facebook or LinkedIn, they might do it at work by day or on company-owned laptops from home
What gives IT executives heartburn is the ease with which users could share customer data or sensitive company activities
while they’re telling you what they’re having for lunch. Cyberoutlaws know this and use social networks to launch phishing scams. In one popular
attack, they send their victims messages that appear to be coming from a Facebook friend. The “friend” may send along a URL
they insist you check out. It may be pitched as a news story about Michael Jackson’s death or a list of stock tips. In
reality, the link takes the victim to a shady website that automatically drops malware onto the computer. The malware goes off
in search of any valuable data stored on the computer or wider company network, be it customer credit card numbers or the
secret recipe for a new cancer-fighting drug.
It’s no surprise, then, that every IT leader surveyed admitted they fear social-engineering-based attacks. Forty-five percent
specifically fear the phishing schemes against Web 2.0 applications.
Nevertheless, for many company executives, blocking social networking is out of the question because of its potential business
benefits. Companies now clamor to get
their messages out through these sites, so the challenge for CIOs is to find the right balance between security and usability.
“People are still incredibly naïve about how much they should share with others, and we have to do a better job educating them
about what is and isn’t appropriate to share,” says H. Frank Cervone, vice chancellor of information services with Purdue
University Calumet. “We have to do a better job of enhancing our understanding of what internal organization information
should not be shared.”
But in a university setting, it’s critical to engage people through social media, Cervone adds. Even in the commercial sector,
he doesn’t see how organizations can avoid it.
And yet this year—the first in which we asked respondents about social media, only 23 percent said their security
efforts now include provisions to defend Web 2.0 technologies and control what can be posted on social networking sites.
One positive sign: Every year, more companies dedicate staff to monitoring how employees use online assets—57 percent
this year compared to 50 percent last year and 40 percent in 2006. Thirty-six percent of respondents monitor what employees
are posting to external blogs and social networking sites.
To prevent sensitive information from escaping, 65 percent of companies use Web content filters to keep data behind the
firewall, and 62 percent make sure they are using the most secure version of whichever browser they choose. Forty percent said
that when they evaluate security products, support and compatibility for Web 2.0 is essential.
Unfortunately, social networking insecurity isn’t something one can fix with just technology, says Mark Lobel, a partner in
the security practice at PricewaterhouseCoopers.
“The problems are cultural, not technological. How do you educate people to use these sites intelligently?” he asks.
“Historically, security people have come up from the tech path, not the sociologist path. So we have a long way to go in
finding the right security balance.”
Guy Pace, security administrator with the Washington State Board for Community and Technical Colleges, says his organization
takes many of the precautions described above. But he agrees with Lobel that the true battleground is one of office culture,
not technology. “The most effective mitigation here is user education and creative, effective security awareness programs,” he
Jumping into the Cloud, Sans Parachute
Given the expense to maintain a physical IT infrastructure, the thought of replacing server rooms and haphazardly configured
appliances with cloud services is simply too hard for many companies to resist. But rushing into the cloud without a security
strategy is a recipe for risk.
According to the survey, 43 percent of respondents are using cloud services such as software as a service or infrastructure as
a service. Even more are investing in the virtualization technology that helps to enable cloud computing. Sixty-seven percent
of respondents say they now use server, storage and other forms of IT asset virtualization. Among them, 48 percent actually
believe their information security has improved, while 42 percent say their security is at about the same level. Only 10
percent say virtualization has created more security holes.
Fears about vendors dominate cloud security risks.
|Ability to enforce provider security policies
|Inadequate training and IT auditing
|Access control at provider site
|Ability to recover data
|Ability to audit provider
|Proximity of company data to someone else’s
|Continued existence of provider
|Provider regulatory compliance
Security may well have improved for some, but experts like Chris Hoff, director of cloud and virtualization solutions at Cisco
Systems, believe that both consumers and providers need to ensure they understand the risks associated with the technical,
operational and organizational changes these technologies bring to bear.
“When you look at how people think of virtualization and what it means, the definition of virtualization is either very
narrow—that it’s about server consolidation, virtualizing your applications and operating systems, and consolidating
everything down to fewer physical boxes—or it’s about any number of other elements: client-side desktops, storage,
networks, security,” he says. “Then you add to the confusion with the concept of cloud computing, which is being pushed by
Microsoft and a number of smaller, emerging companies. You’re left scratching your head wondering what this means to you as a
company. How does it impact your infrastructure?”
Fortunately, there’s some evidence of companies proceeding with caution. One example is Atmos Energy, which is using
Salesforce.com to speed its response time to customers and help the marketing department manage a growing pool of clients,
according to CIO Rich Gius.
The endeavor is successful thus far, so Gius is investigating the viability of running company e-mail in the cloud. “It
would help us address the growing challenge where e-mail-enabled mobile devices like BlackBerrys are proliferating widely among the workforce,” he says. But he’s not ready to take such a big step because the risks,
including security, remain hard to pin down. One example of the disruption that cloud-dependent companies can experience came
in May, when search giant Google—whose content accounts for 5 percent of all Internet traffic—suffered a massive
outage. When it went down, many companies that have come to rely on its cloud-based business applications (such as e-mail)
were dead in the water.
The outage wasn’t caused by hackers, but there are signs that cybercriminals are exploring ways to exploit the cloud for
malicious purposes. On the heels of the outage, attackers added insult to injury by flooding Google search results with
malicious links, prompting the U.S. Computer Emergency Response Team (U.S. CERT) to issue a warning about potential dangers to
cloud-based service sites.
The attack poisoned several thousand legitimate websites by exploiting known flaws in Adobe software to install a malicious
program on victims’ machines, U.S. CERT says. The program would then steal FTP login credentials from victims and use the
information to spread itself further. It also hijacked the victim’s browser, replacing Google search results with links chosen
by the attackers. Although the victimized sites were not specifically those offering cloud-based services, similar schemes
could be directed at cloud services providers.
IT organizations often make an attacker’s job easier by configuring physical and cloud-based IT assets so poorly that
easy-to-find-and-exploit flaws are left behind. Asked about the potential vulnerabilities in their virtualized environments,
36 percent cited misconfiguration and poor implementation, and 51 percent cited a lack of adequately trained IT staff (whose
lack of knowledge leads to configuration glitches). In fact, 22 percent of respondents cited inadequate training, along with
insufficient auditing (to uncover vulnerabilities) to be the greatest security risk to their company’s cloud computing
It’s this awareness that makes Atmos Energy’s Gius proceed with caution. “We have no CSO. If we were a financial services firm
it might be a different story, or if we had a huge head count,” Gius says. “But we are a small-to-medium-sized company, and
the staff limitations make these kinds of implementations more difficult.”
Even with the right resources, security in the cloud is a matter of managing a variety of risks across multiple platforms.
There’s no single cloud. Rather, “there are many clouds, they’re not federated, they don’t natively interoperate at the
application layer and they’re all mostly proprietary in their platform and operation,” Hoff says. “The notion that we’re all
running out to put our content and apps in some common [and secure] repository on someone else’s infrastructure is
Lobel, with PricewaterhouseCoopers, says perfect security is not possible. “You have to actively focus on the security
controls while you are leaping to these services,” he says. It’s difficult for companies to turn back once they have let their
data and applications loose because they are often quick to rid themselves of the hardware and skills they would need to bring
the services back in-house.
“If you dive down a well without a rope, you may find the water you wanted, but you’re not going to get out of the well
without the rope,” he says. “What if you have a breach and you need to leave the cloud? Can you get out if you have to?”
Insourcing Security Management
A few years ago, technology analysts were predicting unlimited growth for managed security service providers (MSSPs). Many
companies then viewed security as a foreign concept, but laws such as Sarbanes-Oxley, the Health Insurance Portability and
Accountability Act and the Gramm-Leach-Bliley Act (affecting financial services) were forcing them to address intrusion
defense, patch management, encryption and log management.
Attacks on data have increased faster than any other security exploit. The top target: databases.
Multiple Responses Allowed
Convinced they couldn’t do it on their own, companies chose outsourcers to do it for them. Gartner estimated the MSSP market
in North America alone would reach $900 million in 2004 and that it would grow another 18 percent by 2008.
Then came the economic tsunami, which appears to have cast a shadow over outsourcing plans even though security budgets are
holding steady. Although 31 percent of respondents this year are relying on outsiders to help them manage day-to-day security
functions, only 18 percent said they plan to make security outsourcing a priority in the next 12 months.
When it comes to specific functions, the shift has already begun. Last year, 30 percent of respondents said they were
outsourcing management of application firewalls, compared to 16 percent today. Respondents cited similar reductions in
outsourcing of network and end-user firewalls. Companies have also cut back on outsourcing encryption management and patch
At the same time, more companies are spending money on these and other security functions. Sixty-nine percent said they’re
budgeting for application firewalls, up slightly compared to the past two years. Meanwhile, more than half of respondents said
they are investing in encryption for laptops and other computing devices.
The results surprise Lobel of PricewaterhouseCoopers. “When you think about it logically, some IT organizations have the
resources and maturity to manage their operating systems and patches, but many don’t,” he observes. “Hopefully, the numbers
simply mean IT shops have grown more mature in their security understanding.”
Security Budgets Hold Stead
More companies are increasing spending than cutting it.
|Stay the Same
Numbers may not add up to 100% due to rounding
Gius of Atmos Energy offered another possible explanation: Companies see a lot of chaos in the security market with an
avalanche of mergers and acquisitions. One independent security vendor after another has merged with or been acquired by other
companies. Examples include BT’s acquisition of Counterpane and IBM’s acquisition of Internet Security Systems. IT leaders are
simply getting out of the way until the industry settles down.
Gius says Atmos Energy is handling most of its security in-house right now. “We pursued a number of open-source and lower-cost
solutions to manage it ourselves,” he says. “We invested in two people to help ensure we had the skills to manage that
environment.” But he’d like to outsource more if it makes sense financially. He notes that security is increasingly integrated
into the platforms provided by the likes of Microsoft, Cisco and Oracle, as well as telecom providers like Comcast and
Verizon. It makes sense to him to have those providers manage the security of their systems.
Beard, with SAIC, says that no matter what drives security spending decisions, companies should understand their specific
security strategies and where managed security providers can offer unique value. Smart business executives understand that
they must maintain control of the big picture at all times, even if a third party is managing many of the levers. Keeping an
eye on security service providers and the risks they are encountering is essential. “CIOs and security officers may outsource
certain functions to various degrees, but they should never outsource their responsibility,” Beard advises.
Trend # 4
A New Corporate Commitment
CIOs may still struggle with the quality of their data security, but the response to this year’s survey suggests their
executive peers have agreed, finally, that security can’t be ignored.
Companies’ budget plans tell part of the story. Not only are more companies investing in security technologies, but overall
security investments are largely intact, despite the economy.
Twelve percent of respondents expect their security spending to decline in the next 12 months. But 63 percent say their
budgets will hold steady or increase (although fewer foresee increases than did last year).
For starters, more companies are hiring CSOs or chief information security officers (CISOs). Eighty-five percent of
respondents said their companies now have a security executive, up from 56 percent last year and 43 percent in 2006. Just
under one-third of security chiefs report to CIOs, 35 percent to CEOs and 28 percent to boards of directors.
Two factors are influencing companies to maintain security as a corporate priority: Seventy-six percent say the increased risk
environment has elevated the importance of cybersecurity among the top brass, while 77 percent said the increasingly tangled
web of regulations and industry standards has added to the sense of urgency.
Respondents were asked how important various security strategies had become in the context of harsher economic realities.
Seventy percent cited the growing importance of data protection while 68 percent cited the need to strengthen the company’s
governance, risk and compliance programs.
Notes Mauricio Angée, senior manager of IT security and compliance and CSO at Universal Orlando: “For segregation of
duty purposes, it’s interesting to see how companies are being asked—by compliance auditors, qualified security
assessors and through legislation—to hire IT security managers with a much-more-defined set of roles and
responsibilities.” Such roles include setting the company’s security policy, making the security budget pitch (instead of the
CIO) and delegating responsibility among lower-level IT security administrators and engineers.
How Cybercrime Costs You
Losses from incidents average $833,000.
|Brand or Reputation Compromised
|Intellectual Property Theft
|Home Page Altered or Defaced
Multiple Responses Allowed
None of these developments, however, make a focus on information security a sure bet in the eyes of IT leaders. Just because
companies feel they have to spend money on security doesn’t mean executives view it as an essential, even beneficial business
process instead of a pain-in-the-neck task being forced upon them.
Angée said CIOs and security leaders still have to fight hard for every penny. Meanwhile, security execs don’t have the
same decision-making power as other C-level leaders in every company, says PricewaterhouseCoopers’ Lobel. CIOs can bring in a
CSO or CISO without a strategy and budget for that person to work with and end up achieving nothing. If something goes wrong,
he concludes, “all you’ll have is somebody to blame and fire.”
Bill Brenner is a senior editor with CSO magazine and CSOonline.com.
Do you Tweet? Follow me on Twitter @BillBrenner70. Follow
everything from CIO Magazine @CIOMagazine.