Author: admini

– Disaster recovery/business continuity
– Employee awareness programs
– Data backup
– Overall information security strategy
– Network firewalls
– Centralized security information management system
– Periodic security audits
– Monitoring employees
– Monitoring security reports (log files, vulnerability reports and so on)
– Spending on intellectual property protection

This list further reinforces the reactive nature of information security. Awareness programs often score high as a strategic priority because they’re relatively low-cost. One should expect number 10 on this list will shoot up in priority next year, given the steady stream of identity thefts and other major information crimes.

http://www.csoonline.com/read/100105/survey_topten.html

Here are two theories, both of which probably play some role: One, the regs are confusing and difficult to comply with.

Companies don’t fear any serious repercussions for not complying with the regulations, either because the mandates are too vague to really be enforced, or the regulatory agencies aren’t devoting resources to enforcement.

Supporting the “lack of teeth” theory is the fact that only a third of respondents reported having compliance testing in place, and only a quarter link their security organization to the compliance group.

Lobel offers a third factor: “There’s just a lot of regs for these guys to deal with.”

http://www.csoonline.com/read/100105/survey_compliance.html

Issues:

Intellectual property left on a laptop that’s gone missing.
Corporate espionage rings that stretch from the United Kingdom to the Middle East and use IT to infiltrate companies.
Phishing scams by the thousands: puddle phishing, Wi-phishing, pharming.

We haven’t even mentioned good old viruses and worms, but those still work too.

To borrow from forestry parlance, information security is an escaped wildfire.And according to “The Global State of Information Security 2005,” a worldwide study by CIO, CSO and PricewaterhouseCoopers (PwC), you are the firefighters,desperately trying to outflank the fireline and prevent flare-ups and firestorms.It’s a thankless, impossible business.

In this environment, just holding your ground is a victory, and that’s what you’re doing.

This is the third annual edition of the survey—once again the largest of its kind with more than 8,200 IT and security executives responding from 63 countries on six continents. Each year the data has shown incremental improvement in the tactical battle to react to and fight off security incidents.

At the same time, the data shows a notable lack of focus on actions and strategies that could prevent these incidents in the first place.

There’s also a remarkable ambivalence among respondents about compliance with government regulations, a clear lack of risk management discipline, and a continuing inability to create actionable security intelligence out of mountains of security data.

Just 37 percent of respondents reported that they had an information security strategy—and only 24 percent of the rest say that creating one is in the plans for next year. With increasingly serious, complex, targeted and damaging threats continuously emerging, that’s not a good thing. “When you spend all that time fighting fires, you don’t even have time to come up with the new ways to build things so they don’t burn down,” says Mark Lobel, a security-focused partner with PricewaterhouseCoopers. “Right now, there’s hardly a fire code.”

Lobel compares the global state of information security to Chicago right before the great fire. “Some folks were well-protected and others weren’t,” he says, but when the ones that weren’t protected began to burn, the ones that were protected caught fire too. ”

Of course, with the survey’s thousands of pages of data and tens of thousands of data points, the overall security picture is a little more complex than “Everyone’s tactical; no one’s strategic.” Some respondents show signs of embracing a more holistic approach than others. Maybe even create a fire code so that if a cow does knock over a lantern,the whole city won’t burn.

http://www.csoonline.com/read/100105/survey.html