Feeds

Corporates focus on basics for IT security defences

They don't believe the hype

  • alert
  • submit to reddit

Combat fraud and increase customer satisfaction

IT departments in large organizations still see firewalls, intrusion detection and prevention, and anti-virus software as priority security defences despite recent hype about newer more exotic security technologies and threats, according to a survey by analysts Gartner.

"Organisations are more concerned about viruses and worms than any other security threat," said Rich Mogull, vice president in Gartner's information security and risk research practice and one of the analysts who directed the survey. "Outside hacking, or cracking, as well as identity theft and phishing also are considered significant issues. Cyber-terrorism was ranked last among the 11 threats listed in the survey."

The survey is based on responses from 133 North American organizations with a mean average of nearly 2,300 worldwide IT employees and a mean average of $207.4m in worldwide IT budget. Half these respondents said they increased IT security spending this year and expected to do so again in 2006. More than one-third of the respondents said the need to comply with new regulatory requirements, such as those mandated by the Sarbanes-Oxley Act (SOX), was a key driver in security spending.

In addition to firewalls, intrusion detection and prevention, and anti-virus defenses, other spending priorities include patch management, strong user authentication, remote access, vulnerability assessment, identity management, security event correlation and reporting, spam filtering and web-site filtering or blocking. More than half the respondents said they preferred buying 'best-of-breed' products from multiple technology providers while a third of those quizzed preferred integrated security suites, a preference catered for by a growing list of firms selling integrated security appliances.

Top security threats, as ranked by IT staff quizzed by Gartner:

  1. Viruses and Worms
  2. Outside Hacking or Cracking
  3. Identity Theft and Phishing
  4. Spyware
  5. Denial of Service
  6. Spam
  7. Wireless and Mobile Device Viruses
  8. Insider Threats
  9. Zero Day Threats
  10. Social Engineering
  11. Cyber-Terrorism

Highlights of the survey results were presented at Gartner's 11th annual IT Security Summit last week in Washington D.C. During the conference, Gartner slammed "over-hyped" security threats concerning mobiles viruses and wireless LANS that appear at seventh place on a list of what punters perceive as top security threats. Gartner also warned against equating regulatory compliance with security. But its latest survey shows that complying with laws like SOX is a key driver in security spending.

Scoping information security threats is a difficult process not helped by the hype frequently propagated by segments of the industry. The most sensible approach to information security is based on a risk assessment grounded in the business needs of an organisation. Let's hope IT managers practice that regardless of what arguments they need to advance to secure their budget. ®

Related stories

Gartner lambasts security FUDmongers
Security barometer survey - the results are in
Public sector IT abuse still rife
Pharming casts shadow over rising ecommerce sales
Liberty goes after phishers
Hackers plot to create massive botnet
ISPs urged to throttle spam zombies

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.