Home » Data Protection » Malware/Cybercrime

The Global State of Information Security 2006

Some things are getting better slowly but security practices are still immature and, in some cases, they're regressing

By Allan Holmes

September 01, 2006 — CSO —

When it comes to information security, the reflection you see in your morning mirror is probably not that of a sharp, confident, professional IT executive. Rather, that man in the mirror is more likely to look like a gangly, awkward, not-yet-to-be-fully-trusted teenager.

That's what "The Global State of Information Security 2006" survey tells us. In its fourth edition, this largest-of-its-kind survey reveals that global information executives, still relatively new to security's disciplines, are learning and improving but are still prone to risky behaviors—behaviors that could have devastating consequences.

The study by CSO, CIO and PricewaterhouseCoopers (PwC), with 7,791 respondents in 50 countries, indicates that an increasing number of executives (CEOs, CFOs, CIOs, CSOs, and vice presidents and directors of IT and information security) across all industries and in private- and public-sector organizations continue to make incremental improvements in deploying information security policies and technologies, although the rate of improvement is slower than in previous years. They're becoming more financially independent, with some security budgets increasing at double-digit rates. And they say they're more confident in their level of security, perhaps because their networks have not had a serious virus or worm in the past 12 months.

But teenagers, as any parent knows, live in the moment and have an ability to ignore what they know they should do and do what they know they shouldn't. The survey shows us that most executives with security responsibilities have made little or no progress in implementing strategic security measures that could have prevented many of the security mishaps reported this year. Only 37 percent of respondents said they have an overall security strategy. And they're planning to focus more on tactical fixes than on strategic initiatives, ensuring that in the coming year they will be more reactive than proactive.

What's more, companies continue to do business with insecure organizations. One of the most unsettling findings in this year's study is the sad state of security in India, by a wide margin the world's primary locus for IT outsourcing. Many survey respondents in India admitted to not adhering to the most routine security practices. The problem is obvious, but right now it's apparently easier to ignore than to address.

Harder to ignore is the constant news of large organizations losing laptops packed with unencrypted personal data on millions of customers. Every year we report that such incidents should motivate companies to tighten security, but every year the survey indicates that's not happening. Similarly, even after Hurricane Katrina, which hit the Gulf Coast seven months before we launched our survey, a majority of companies still do not have a business continuity/disaster recovery plan in place, and plans to complete one this year have become less important to security officials than in 2005.