Feeds

Corporates focus on basics for IT security defences

They don't believe the hype

  • alert
  • submit to reddit

Reducing security risks from open source software

IT departments in large organizations still see firewalls, intrusion detection and prevention, and anti-virus software as priority security defences despite recent hype about newer more exotic security technologies and threats, according to a survey by analysts Gartner.

"Organisations are more concerned about viruses and worms than any other security threat," said Rich Mogull, vice president in Gartner's information security and risk research practice and one of the analysts who directed the survey. "Outside hacking, or cracking, as well as identity theft and phishing also are considered significant issues. Cyber-terrorism was ranked last among the 11 threats listed in the survey."

The survey is based on responses from 133 North American organizations with a mean average of nearly 2,300 worldwide IT employees and a mean average of $207.4m in worldwide IT budget. Half these respondents said they increased IT security spending this year and expected to do so again in 2006. More than one-third of the respondents said the need to comply with new regulatory requirements, such as those mandated by the Sarbanes-Oxley Act (SOX), was a key driver in security spending.

In addition to firewalls, intrusion detection and prevention, and anti-virus defenses, other spending priorities include patch management, strong user authentication, remote access, vulnerability assessment, identity management, security event correlation and reporting, spam filtering and web-site filtering or blocking. More than half the respondents said they preferred buying 'best-of-breed' products from multiple technology providers while a third of those quizzed preferred integrated security suites, a preference catered for by a growing list of firms selling integrated security appliances.

Top security threats, as ranked by IT staff quizzed by Gartner:

  1. Viruses and Worms
  2. Outside Hacking or Cracking
  3. Identity Theft and Phishing
  4. Spyware
  5. Denial of Service
  6. Spam
  7. Wireless and Mobile Device Viruses
  8. Insider Threats
  9. Zero Day Threats
  10. Social Engineering
  11. Cyber-Terrorism

Highlights of the survey results were presented at Gartner's 11th annual IT Security Summit last week in Washington D.C. During the conference, Gartner slammed "over-hyped" security threats concerning mobiles viruses and wireless LANS that appear at seventh place on a list of what punters perceive as top security threats. Gartner also warned against equating regulatory compliance with security. But its latest survey shows that complying with laws like SOX is a key driver in security spending.

Scoping information security threats is a difficult process not helped by the hype frequently propagated by segments of the industry. The most sensible approach to information security is based on a risk assessment grounded in the business needs of an organisation. Let's hope IT managers practice that regardless of what arguments they need to advance to secure their budget. ®

Related stories

Gartner lambasts security FUDmongers
Security barometer survey - the results are in
Public sector IT abuse still rife
Pharming casts shadow over rising ecommerce sales
Liberty goes after phishers
Hackers plot to create massive botnet
ISPs urged to throttle spam zombies

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.