Research

The Global State of Information Security 2008

Our annual survey finds respondents throwing technology at the problem. Which is a beginning, but only a beginning.

By Kim Nash

October 15, 2008 — CSO —

Listen to the related podcast with CSO Publisher Bob Bragdon, CIO Senior Editor Kim Nash and PricewaterhouseCoopers partner Mark Lobel.

Not to be alarmist, but WAKE UP, PEOPLE! Our information security is, in many ways, failing.

Ask the 11 alleged hackers charged in August with breaking into TJX and other retailers by way of insecure Wi-Fi. Forty million credit and debit card numbers were stolen. Ask the Medicaid claims processor at the outsourcer EDS. In February she pleaded guilty to stealing Social Security numbers and dates of birth, and selling them for use on fake tax returns. Ask the courier hired by the University of Utah Hospital to take backup tapes to offsite storage. One day in June, he used his own car instead of his company's secured van. The tapes, containing billing data for 2.2 million patients, were stolen from his front seat.

Or you could, as we did, ask 7,097 business and technology executives worldwide about their security troubles. In this, our sixth year of conducting the "Global State of Information Security" survey with PricewaterhouseCoopers, we got an earful about the challenges, worries and wins in security technology, process and personnel.

Quantifying returns on information security projects can be a struggle, often because it's hard to put a dollar value on a crisis averted. This year, a bad economy forces decision makers to squint even harder at proposals. Even so, survey results show companies are buying and applying technology tools, including software for intrusion detection, encryption and identity management, at record levels. That's pretty good news.

However—and this is serious, folks—too many organizations still lack coherent, enforced and forward-thinking security processes, our survey shows. While 59 percent of respondents said they have an "overall information security strategy," that's up just two points from last year's survey and it's not enough, says Mark Lobel, advisory services principal at PricewaterhouseCoopers. Two elements, Lobel says, correlate with lower numbers of security incidents: having a C-level security executive and developing the aforementioned security strategy. But disappointing numbers piled up this year. (For additional stats see "The Global State of Information Security.")

For instance, 56 percent of respondents employ a security executive at the C level, down 4 percent from last year. You comb network logs for fishy activity, but just 43 percent of you audit or monitor user compliance with your security policies (if you have them). This is up 6 percent from 2007, but still "not where we need to be," Lobel says.