Security Spending Cloaked in Compliance

While regulatory compliance is the primary driver of corporateinformation security projects it is a dangerous strategy that couldweaken enterprise defenses, according to Ray Wagner, Gartner’sinformation security and privacy research vice president.

Compliance has led to increased security spending, but it should be a by-product of a much broader strategy, he said.

Organizations are cloaking their pet projects in compliance to getfunding. “We have reached a point where the information security budgetis peaking and downward pressure will begin to emerge,” he said, addingthat the current spend is about 6 percent of the IT budget.

Jack Jones, chief information security officer (CISO) at NationwideMutual Insurance Company, said that when companies try to manage risksby using a checklist of compliance items, there is “a very real danger”of overlooking other critical security issues. “Checklists cast theworld in black-and-white terms,” Jones said.

Neal Wise, partner with IT security consultancy firm Assurance.com.au,warned many companies approach compliance and security as anopportunity to kill two birds with the one stone.

“Legislation is getting some companies to invest in security, but insome cases they are just doing the bare minimum and this could givethose companies a false sense of security,” he said.

“In some cases, because companies have to look externally for securityrecommendations, they may use regulations to start building their ownsecurity frameworks.”

Ben Rothke, a senior security consultant at ThruPoint, said the problemwith compliance is that people tend to take a myopic view of what needsto be done whenever new regulations come out.

“The point needs to be made that those organizations with a solidsecurity framework in place could easily handle any regulations thrownat them,” he added.

James Turner, Frost & Sullivan security analyst, said compliance is about transparency.

“Obfuscating funds by using the compliance hot button is going to getstomped on … of course this doesn’t mean shonky people won’t try it,and ironically these are the very people that regulations are beefed upto address,” Turner said.

By Michael Crawford – Computerworld Today (Australia) (Jaikumar Vijayan of Computerworld (US) contributed to this report.)