The Information Security Confidence Game

Feeling insecure about your organization’s information security? In this case, perception may be everything.

Last fall, an annual information security survey conducted by PricewaterhouseCoopers and our sister magazine, CIO, found stark differences in infosec practices and outcomes. Security practitioners who rated themselves as “confident” in their organizations’ information security fared dramatically better than those rating themselves as “not confident.” Companies that said they are not confident suffered more incidents and monetary losses.

This year, in CSO’s quarterly “Security Sensor” poll, we revisited the confidence question to understand the underlying cause of insecurity.

Not surprisingly, the companies that lacked confidence in their information security are the same companies that were less likely to imple-ment infosecurity best practices. Consider that a larger percentage of the nonconfidents fear insider breaches yet do less to address them. The nonconfidents also are less likely to be prepared to respond to an incident.

But the killer finding suggests that the root of the problem is a lack of effective security leadership.

Companies without infosec confidence suffered greater damages. Senior management at these companies were also informed less frequently about information security. Clearly, the security function needs to improve its efforts to communicate with senior management.

Source: CSO “Security Sensor” survey. Full results and methodology are available at www.csoonline.com/printlinks. The “Security Sensor” survey had 510 respondents, including infosecurity leaders and other corporate officers.