Survey says that managing complexity still top security challenge
Managing the complexity of security continues to be the number one challenge for organizations around the globe, followed closely by preventing security breaches, enforcing security policies and spreading user awareness. These challenges have prompted plans for a significant increase in security spending in the coming year, according to a 2007 survey by Accenture and CMP Technology’s InformationWeek.
The tenth annual survey of nearly 3,000 IT professionals from the U.S. and China also revealed that the security challenges, plans and priorities of Chinese companies are aligning more closely with U.S. organizations. Chinese companies are taking a more sophisticated approach to their security posture – – in fact, they expect to spend an average of 19 percent of their IT budgets on security, compared to 12 percent for U.S. organizations.
Survey highlights and trends include:
Security spending is expected to grow significantly this year. Thirty- nine percent of the respondents in the U.S. and 55 percent of the respondents in China expect security spending to increase this year compared with 2006.
IT professionals in China perceive themselves to be more vulnerable than their counterparts in the U.S. Fifty-eight percent of respondents in China feel their organization is more vulnerable to malicious code attacks and security breaches than a year ago, versus 16 percent of respondents in the U.S. Vulnerability is attributed to increased sophistication of such threats as SQL injection, more ways to attack corporate networks, including wireless, and an increased volume of attacks.
Assessing security risk and then modifying plans and budgets accordingly is problematic across the board. More than 20 percent of U.S. companies and nearly a quarter of Chinese companies do not regularly assess security risk and threats. Of those who do regularly assess risk, only 34 percent of U.S. companies and 39 percent of Chinese companies use the information strategically to drive budgets and planning.
Measuring the value of security is difficult. Forty-three percent of U.S. companies measure value in terms of fewer worker hours spent on security-related issues. Twenty-four percent of respondents do not even attempt to measure the value of security investments.
Threat Response and Risk Management
Top ranking tactical security priorities for both the U.S. and China in the coming year include installing better access controls, securing remote access and installing monitoring software.
Consistent across geographies, viruses and worms pose the biggest security threat. Over the past year, 68 percent of Chinese companies and 49 percent of U.S. companies suffered from computer viruses, followed by 55 percent and 35 percent, respectively, from worms. As a result, 65 percent of U.S. respondents and 75 percent of Chinese respondents said dealing with viruses and worms are a top priority, followed by spyware or malware and then spam.
The primary methods of attack differ across geographies. Over the past year, U.S. and Chinese companies both suffered when known operating- system vulnerabilities (43 percent and 66 percent, respectively) and known application vulnerabilities (24 percent and 41 percent, respectively) were exploited. In China, however, companies also suffered from exploited access control (38 percent) and database vulnerabilities (30 percent), attacks that were not as prevalent for U.S. organizations (18 percent and 7 percent, respectively).
In both regions, companies suspected computer hackers, malicious coders and unauthorized users to be responsible for breaches or espionage in the past year.
Chinese companies have fallen victim to public data breaches five times more often than U.S. companies. Thirty-two percent of Chinese companies suffered from a publicized data breach or data loss over the past year, compared with only six percent of U.S. companies.
Compliance and Data Privacy
Over the past 12 months, respondents in both the U.S. and China said improved storage management and improved document management have been beneficial to achieving regulatory compliance. In the U.S., improved infrastructure security was also considered helpful, and in China, classified e-mail content has been beneficial.
The U.S. more aggressively monitors employee activities, with more than half monitoring e-mail use, compared with 34 percent of Chinese companies. In the U.S., 40 percent of respondents monitor web-site use, compared with a quarter of their Chinese counterparts. Thirty-five percent of U.S. companies monitor phone usage versus 22 percent of Chinese respondents. Instant message monitoring is nearly even across the U.S. and Chinese with 29 percent and 30 percent, respectively.
Security Responsibility
— C-level responsibility for security budget and policy differ across regions. CEOs and presidents hold the purse strings for security spending for 53 percent of U.S. companies, while the majority of security policies are made by CIOs and directors of information services/IT. In China, the majority of security spending is determined by CFOs and finance directors, with policies set by CEOs and presidents. In both regions, the majority of Chief Information Security Officers or equivalent, report directly to the CEO.
Sixty-two percent of companies in China are attempting to integrate physical and IT security, compared to 36 percent of companies in the U.S.
Security Vendors and Outsourcing
Price is the dominant factor in security product or service selection in both the U.S. and China. Sixty-four percent of U.S. respondents and 48 percent of Chinese respondents said price was the most important determinant in selecting security products and services, followed closely by the overall technical strength of the product.
Chinese companies are more likely to use a managed security provider for security functions, with 36 percent currently using managed security providers and 31 percent planning to, versus only 13 percent and seven percent, respectively, of U.S. companies.
The majority of companies in the U.S. expect to spend the same amount on security outsourcing this year compared with 2006, while the majority of companies in China expect to increase spending on security outsourcing. Sixty-six percent of U.S. companies expect security outsourcing to remain the same this year compared to last year and 27 percent plan to spend more. In China, 51 percent of companies plan to spend more and 45 percent expect to spend the same amount on security outsourcing in 2007.