Feeds

IT bosses: directors don't take security seriously

Their fault for not talking the board's language?

The Power of One eBook: Top reasons to choose HP BladeSystem

Most IT managers believe that while their board-level superiors pay lip service to compliance and security, they don't really take it seriously, according to a survey carried out for software developer NetIQ.

The survey also revealed that 51 percent of the 218 UK companies queried still do not have the processes and procedures in place to manage risk and comply with rules such as PCI and MIFID.

Ulrich Weigel, NetIQ's security products director, acknowledged that the survey only measured the perceptions of IT and security managers, but said he was still surprised at the degree of scepticism that they showed.

With all the publicity that regulatory compliance has received, you might have expected company directors to understand the importance of IT security by now, but it seems they are as clueless as ever. However, Weigel suggested that's partly the fault of the IT department.

"IT tends to talk about the technical aspects of security, but the business manager needs to understand the risk they're running," he said. "That gets you into predictive management, and while most companies do that for systems management, very few do it from the security point of view."

Thomas Raschke, an analyst with Forrester Research, said that the gap in understanding between IT and the rest of the business tied in with his own research.

"We are currently in a time of transition, one that can make CISOs [chief information security officers] with less business-side experience acutely uncomfortable," he added. "In the interim, legacy CISOs and other security managers still struggle with gaining visibility and influence within the business."

Weigel suggested that IT managers need to learn how to discuss the security risks in financial and business terms, so they can explain that "the cost [of security] is ridiculously small compared to the cost of a breach."

They must also bring the way their departments work into line with other parts of the business, he said, for example by acquiring systems and security management and reporting tools that "connect people to processes" by turning IT activities into workflows. Not surprisingly, NetIQ sells exactly that, in the shape of its Vigilant Policy Centre.

"Systems management traditionally has well-defined workflows," he said. "The challenge is making sure those are followed and are auditable."®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.