Companies getting clued up about info security

Firms are more aware of how information security can affect business, with a rising number integrating information security with their risk management processes, according to an Ernst & Young survey.

The survey, which spoke to 1,200 information security professionals from 350 organisations in 48 countries, found some 43 per cent of the respondents integrated information security and risk management programs and processes, compared with 40 per cent in 2005.

However, this leaves more than half of the survey participants who have yet to integrate information risk management into their overall risk management activities. Furthermore, over 40 per cent of participants revealed they were not keeping the board of directors and business leaders regularly informed about information security issues.

Also causing concern was the finding that a third of those surveyed said disaster recovery timescales have not been agreed to; only half of business continuity plans have been tested; a little over half of organisations have agreed on escalation procedures for disaster responses; and less than half have developed an internal and external communication strategy for business continuity.

On the flip-side, the survey found that companies' information security policies, roles and responsibilities are reasonably well-developed, and are also being more clearly communicated to employees.

Companies are also increasingly considering information security outsourcing, driven in part by the limited availability of experienced and well-trained security staff.

Moreover, there were improvements in the area of risk assessment, with three quarters of survey respondents undertaking an IT risk assessment in developing their business continuity plans. Furthermore, almost half of information security executives claimed to have adopted, or said they plan to adopt, an information security standard.

The survey also identified five key security priorities that it considered critical to business success, highlighting privacy and personal data protection as an increasing concern for businesses.

"Among the most notable priorities is privacy and personal data protection, which is the one information security issue most consumer driven. It has become a high-stakes business issue, catapulted up the board agenda by consumer concerns, caused by well publicised lapses of security and the growing response of government and legislative activism," said Paul van Kessel, global leader of Ernst & Young's Technology and Security Risk Services.

"Understandably, it is the area where companies are being most active, with privacy and data protection practices becoming increasingly more formalised."

The other four areas of importance identified by the survey were integrating information security with the organisation; extending the impact of compliance; managing the risk of third party relationships; and designing and building information security.

"The 2006 survey, which contains a specific report based on Irish participants, demonstrates real progress in information security," said Pat Moran, partner, Risk Advisory Services, Ernst & Young.

"Largely driven from compliance and director responsibilities, I have personally observed significant corporate programmes to improve the level of information security controls and IT governance. The real trick now for organisations is to convert this mammoth compliance effort to quickly enable business ventures and investments happen in a secure and controlled way."

Copyright © 2006, ENN