Why technology isn't the answer to better security

Not to be alarmist, but WAKE UP, PEOPLE! Our information security is, in many ways, failing.

Ask the 11 alleged hackers charged in August with breaking into TJX and other retailers by way of insecure Wi-Fi. Forty million credit and debit card numbers were stolen. Ask the Medicaid claims processor at the outsourcer EDS. In February she pleaded guilty to stealing Social Security numbers and dates of birth, and selling them for use on fake tax returns. Ask the courier hired by the University of Utah Hospital to take backup tapes to offsite storage. One day in June, he used his own car instead of his company's secured van. The tapes, containing billing data for 2.2 million patients, were stolen from his front seat.

Or you could, as we did, ask 7,097 business and technology executives worldwide about their security troubles. In this, our sixth year of conducting the "Global State of Information Security" survey with PricewaterhouseCoopers, we got an earful about the challenges, worries and wins in security technology, process and personnel.

Quantifying returns on information security projects can be a struggle, often because it's hard to put a dollar value on a crisis averted. This year, a bad economy forces decision makers to squint even harder at proposals. Even so, survey results show companies are buying and applying technology tools, including software for intrusion detection, encryption and identity management, at record levels. That's pretty good news.

However-and this is serious, folks-too many organizations still lack coherent, enforced and forward-thinking security processes, our survey shows. While 59 percent of respondents said they have an "overall information security strategy," that's up just two points from last year and it's not enough, says Mark Lobel, advisory services principal at PricewaterhouseCoopers. Two elements, Lobel says, correlate with lower numbers of security incidents: having a C-level security executive and developing the aforementioned security strategy. But disappointing numbers piled up this year. (For additional stats see " The Global State of Information Security.")

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine