Research

Analysis: 2007 Global State of Information Survey

Five years ago, when CIO, CSO and PricewaterhouseCoopers collaborated on the first "Global State of Information Security" survey, very few people knew how bad the problem was. Now everyone knows. They just don't know how to fix it.

By Scott Berinato

"What I hear from CIOs," says Johnson, "is at the end of the day they're responsible for failures anyway. They're on the line whether security is separate or not." Why wouldn't the CIO want to control something he's ultimately responsible for?

On the other hand, maybe security was never as separate as it seemed. Companies created CISO-type positions but never gave them authority. "I continually see security people put in the position of fall guy," says Woerner of TD Ameritrade. "Maybe some of that separation was, subconsciously, creating a group

to take the hit." Woerner also believes that the trend of the security budget folding into the IT department could be a direct result of security auditing that focuses primarily on infrastructure.

That is, when auditors look at information security weaknesses, they recommend technological fixes. And IT buys the

technology. Why should IT be charged for another depart-

ment's expenses?

Whatever the reason, the trend is disturbing to some security professionals, especially at a time when they play an ever more central role in corporate crises, and in society in general.

The state of Internet security is eroding quickly. Trust in online transactions is evaporating and it will require strong security leadership for that trust to be restored. For the Internet to remain the juggernaut of commerce and productivity it has become will require more, not less, input from security.

But right when the best and brightest security minds are needed most, they're being valued less. n

Other stories by Scott Berinato

• Email
• Print
• Comments
• Digg This
• SlashDot

• Conventional Wisdom
• The Global State of Information Security 2006
• The Global State of Information Security 2005
• Best Practices: The 2004 Global Information Security Survey