Corporates focus on basics for IT security defences

They don't believe the hype

By John Leyden, 16th June 2005

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

IT departments in large organizations still see firewalls, intrusion detection and prevention, and anti-virus software as priority security defences despite recent hype about newer more exotic security technologies and threats, according to a survey by analysts Gartner.

"Organisations are more concerned about viruses and worms than any other security threat," said Rich Mogull, vice president in Gartner's information security and risk research practice and one of the analysts who directed the survey. "Outside hacking, or cracking, as well as identity theft and phishing also are considered significant issues. Cyber-terrorism was ranked last among the 11 threats listed in the survey."

The survey is based on responses from 133 North American organizations with a mean average of nearly 2,300 worldwide IT employees and a mean average of $207.4m in worldwide IT budget. Half these respondents said they increased IT security spending this year and expected to do so again in 2006. More than one-third of the respondents said the need to comply with new regulatory requirements, such as those mandated by the Sarbanes-Oxley Act (SOX), was a key driver in security spending.

In addition to firewalls, intrusion detection and prevention, and anti-virus defenses, other spending priorities include patch management, strong user authentication, remote access, vulnerability assessment, identity management, security event correlation and reporting, spam filtering and web-site filtering or blocking. More than half the respondents said they preferred buying 'best-of-breed' products from multiple technology providers while a third of those quizzed preferred integrated security suites, a preference catered for by a growing list of firms selling integrated security appliances.

Top security threats, as ranked by IT staff quizzed by Gartner:

Viruses and Worms
Outside Hacking or Cracking
Identity Theft and Phishing
Spyware
Denial of Service
Spam
Wireless and Mobile Device Viruses
Insider Threats
Zero Day Threats
Social Engineering
Cyber-Terrorism

Highlights of the survey results were presented at Gartner's 11th annual IT Security Summit last week in Washington D.C. During the conference, Gartner slammed "over-hyped" security threats concerning mobiles viruses and wireless LANS that appear at seventh place on a list of what punters perceive as top security threats. Gartner also warned against equating regulatory compliance with security. But its latest survey shows that complying with laws like SOX is a key driver in security spending.

Scoping information security threats is a difficult process not helped by the hype frequently propagated by segments of the industry. The most sensible approach to information security is based on a risk assessment grounded in the business needs of an organisation. Let's hope IT managers practice that regardless of what arguments they need to advance to secure their budget. ®