First published: September 2008
by Jon Collins
Much has been written about the existence of various threats, internal and external, and vendors are only too quick to proffer solutions to the problems. But what really needs to exist for security to work? This report considers some of the more behavioural aspects of security best practice, such as the role of awareness, policy and communications.
IT security matters - but some organisations are doing better than others
While IT security is generally seen as important to our IT-oriented research sample, there is a general feeling that such aspects as the level of security awareness, and how seriously IT security is taken by business management, could be better. Such characteristics can be used to determine organisations that generally are ahead of the pack, and those who are lagging behind.
Leading organisations believe themselves to be better protected, and rightly so
In general, organisations that we have categorised as ’leaders’ believe themselves to be better protected than the ’laggards’. It is not always as simple as this when it comes to a reduction in threat levels, as it will tend to be those threats that are directly influenced by good security practices, that show the most marked improvements.
Having a comprehensive security policy is fundamental to good security practice
Organisations with a fully comprehensive, dynamic security policy are less likely to suffer security breaches such as web site defacement, or indeed theft. It is therefore no surprise to note that the more leading organisations are twice as likely to have such a policy in place than the sample as a whole. Equally notable is that organisations with outdated policies fare less well than those with no policy in place at all.
Communication between the business and IT is also important
Few would doubt that business risks should be prioritised as an input to implementing good security practice. There is a big difference of opinion between the leaders and the laggards however, concerning how important it is to communicate this information both to IT, and to the workforce. And indeed, such co-ordination has a tangible impact on risk reduction.
More progressive IT security organisations are deploying more complex tooling
IT security tools are in general bought more on the basis of simplicity than need - tools that are easy to cost-justify and deploy are far more likely to be in place than more complex tools. However, leading edge organisations are installing the more challenging tools. The lesson is not to install everything, but to review one’s own situation and make the necessary improvements that become apparent.
The research upon which this report is based was designed and interpreted on an independent basis by Freeform Dynamics. Feedback was gathered from 1,102 IT and business professionals during the online study, which was conducted in partnership with The Register.
This report is free of charge. Click above to download the PDF or view the interactive e-document.
If you experience any problems during this process please contact us at;
email@example.com or call +44 (0)1425 626501 / 620008
By Dale Vile, Tony Lock
If it has been a while since you thought about your DR measures, or a review has been prompted by a risk assessment, compliance audit, actual disaster or some other scare, it’s worth taking some time to understand what can be achieved in light of important changes that have taken place over the past few years. ...more
By Tony Lock
With the advent of digitisation, all public sector environments generate and capture a significant amount of electronic data. Against this background, this paper explores how to manage costs and risks while meeting these changing needs through ‘active archiving’. ...more
By Dale Vile
In some organisations, the tension between IT and business teams has come to a head around the topic of devices & the so called ‘Bring Your Own Device’ phenomenon.It’s time for IT and business managers to get together & start a proper dialogue about to deal with evolving requirements. ...more
By Dale Vile
By Dale Vile
Organisations of all sizes are trying to understand the security implications of mobile working, device proliferation and BYOD. But with IT vendors offering up a broad range of options, it can be hard to know where to focus your efforts ...more
By Tony Lock
While the importance of business information is almost universally recognised, few organisations have enjoyed either the time or the resources required to ensure that the data they store across an expanding range of computer systems is adequately protected. ...more
By Dale Vile
With more departmental applications, collaboration and sharing environments, and even cloud-based services, with access via desktops, laptops, tablets and smartphones, are we in danger of losing control of our business information? ...more