Symantec Corp. has released the findings of its global 2010 State of Enterprise Security study, which has found that 42 percent of organizations rate security as their top issue. The security, storage and systems management solutions provider says this is not surprising, considering 75 percent of organizations experienced cyber attacks in the past 12 months that cost enterprise businesses an average of $2 million per year. The study said that organizations have reported challenges with enterprise security due to understaffing, new IT initiatives that intensify security issues and IT compliance issues. The study is based on surveys of 2,100 enterprise CIOs, CISOs and IT managers from 27 countries in January 2010.
Francis deSouza, senior vice president, Enterprise Security, Symantec, said protecting information today is more challenging than ever, and business can increase their competitive edge by establishing a security blueprint that protects their infrastructure and information, enforces IT policies, and manages systems more efficiently.
 The study found that forty-two percent of enterprises rank cyber risk as their top concern, ahead of natural disasters, terrorism, and traditional crime combined, and therefore IT is intently focused on enterprise security. On average, IT assigns 120 staffers to security and IT compliance. Enterprises rated “better manage business risk of IT” as a top goal for 2010, and 84 percent rated it absolutely/somewhat important. Nearly all the enterprises surveyed (94 percent) forecast changes to security in 2010, with almost half (48 percent) expecting major changes.
Enterprises are experiencing frequent attacks. In the past 12 months, 75 percent of enterprises experienced cyber attacks, and 36 percent rated the attacks somewhat/highly effective. Worse, 29 percent of enterprises reported attacks have increased in the last 12 months, the study said. Each enterprise surveyed experienced cyber losses in 2009 according to the study, with the top three reported losses being theft of intellectual property, theft of customer credit card information or other financial information, and theft of customer personally identifiable information. These losses translated to monetary costs 92 percent of the time. The top three costs were productivity, revenue, and loss of customer trust. Enterprises reported spending an average of $2 million annually to combat cyber attacks.
Enterprise security is becoming more difficult due to a number of factors, prime among which is understaffing. Most impacted areas include network security (44 percent), endpoint security (44 percent), and messaging security (39 percent). Additionally, new initiatives that make providing security more difficult include infrastructure-as-a-service, platform-as-a service, server virtualization, endpoint virtualization, and software-as-a-service. Finally, the study found that IT compliance is also a huge undertaking, with the typical enterprise exploring 19 separate IT standards or frameworks and presently employing eight of them. The top standards include ISO, HIPAA, Sarbanes-Oxley, CIS, PCI, and ITIL.
The study has the following recommendations: Organizations need to protect their infrastructure by securing their endpoints, messaging and web environments, while according priority to defending critical internal servers and implementing the ability to back up and recover data. IT administrators need to adopt an information-centric approach to protect information proactively. Taking a content-aware approach to protecting information is key in knowing where sensitive information resides, who has access, and how it is coming in or leaving your organization. Organizations need to develop and enforce IT policies and automate their compliance processes. By prioritizing risks and defining policies that span across all locations, customers can enforce policies through built-in automation and work flow and not only identify threats but remedy incidents as they occur or anticipate them before they happen. Organizations need to manage systems by implementing secure operating environments, distributing and enforcing patch levels, automating processes to streamline efficiency, and monitoring and reporting on system status. |