Feeds

Corporates focus on basics for IT security defences

They don't believe the hype

  • alert
  • submit to reddit

Seven Steps to Software Security

IT departments in large organizations still see firewalls, intrusion detection and prevention, and anti-virus software as priority security defences despite recent hype about newer more exotic security technologies and threats, according to a survey by analysts Gartner.

"Organisations are more concerned about viruses and worms than any other security threat," said Rich Mogull, vice president in Gartner's information security and risk research practice and one of the analysts who directed the survey. "Outside hacking, or cracking, as well as identity theft and phishing also are considered significant issues. Cyber-terrorism was ranked last among the 11 threats listed in the survey."

The survey is based on responses from 133 North American organizations with a mean average of nearly 2,300 worldwide IT employees and a mean average of $207.4m in worldwide IT budget. Half these respondents said they increased IT security spending this year and expected to do so again in 2006. More than one-third of the respondents said the need to comply with new regulatory requirements, such as those mandated by the Sarbanes-Oxley Act (SOX), was a key driver in security spending.

In addition to firewalls, intrusion detection and prevention, and anti-virus defenses, other spending priorities include patch management, strong user authentication, remote access, vulnerability assessment, identity management, security event correlation and reporting, spam filtering and web-site filtering or blocking. More than half the respondents said they preferred buying 'best-of-breed' products from multiple technology providers while a third of those quizzed preferred integrated security suites, a preference catered for by a growing list of firms selling integrated security appliances.

Top security threats, as ranked by IT staff quizzed by Gartner:

  1. Viruses and Worms
  2. Outside Hacking or Cracking
  3. Identity Theft and Phishing
  4. Spyware
  5. Denial of Service
  6. Spam
  7. Wireless and Mobile Device Viruses
  8. Insider Threats
  9. Zero Day Threats
  10. Social Engineering
  11. Cyber-Terrorism

Highlights of the survey results were presented at Gartner's 11th annual IT Security Summit last week in Washington D.C. During the conference, Gartner slammed "over-hyped" security threats concerning mobiles viruses and wireless LANS that appear at seventh place on a list of what punters perceive as top security threats. Gartner also warned against equating regulatory compliance with security. But its latest survey shows that complying with laws like SOX is a key driver in security spending.

Scoping information security threats is a difficult process not helped by the hype frequently propagated by segments of the industry. The most sensible approach to information security is based on a risk assessment grounded in the business needs of an organisation. Let's hope IT managers practice that regardless of what arguments they need to advance to secure their budget. ®

Related stories

Gartner lambasts security FUDmongers
Security barometer survey - the results are in
Public sector IT abuse still rife
Pharming casts shadow over rising ecommerce sales
Liberty goes after phishers
Hackers plot to create massive botnet
ISPs urged to throttle spam zombies

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.