IT Security Survey

January 5, 2007 from Canadian Technology News – “More than 1,600 North American IT managers (including over 1,000 Americans and 550 Canadians) were asked to rate the importance of security against seven different security threats, including security policy user compliance, internal user malfeasance, generic external threats (like viruses), random attacks (like password crackers), targeted external attacks, and protection of the physical server room or data centre.

The results, which were calibrated from the respondents' ranking of certain kinds of threats as “very” or “extremely” important, showed that Americans' and Canadians' attitudes toward IT security seem virtually identical, never straying farther than a few percentage points' difference.

The No. 1 concern was generic external threats, with more than 70 per cent of both Canadian and American IT managers calling it “very” or “extremely” important. This didn't surprise Brian Bourne, president of security consulting firm CMS Consulting and a member of the steering committee of the Toronto Area Security Klatch, an IT security user group. “Everyone gets spam and viruses, and it's a very visible problem. Its impact on security is easy to understand. But what most people don't understand is that when you do security really well, nothing happens. It's hard to understand the value of nothing happening,” he said.

Bourne has found that companies tend to get worked up over spam and viruses because it has an easily identifiable impact on productivity. Said Bourne: “When it comes to a leakage of information, which could also obviously have an effect on productivity, they really don't seem to worry that much.”

They're not blind to the data-leakage problem -- the second-most feared security threat is random attacks, which 60 per cent of Canadian IT managers and 56 per cent of American IT managers rated as “very” or “extremely” important in the battle against IT breaches (the fear of targeted attacks came in second-to-last, with half of the American respondents, and just over half of the Canadians, saying it was “very” or “extremely” important). Bourne said that this concern isn't even close to the fever pitch it should be hitting, in spite of the threat's easy understandability: “password cracking is happening on a mass basis.” He estimated that issues like server vulnerability are resulting in even small businesses getting five to 20 attacks daily, while larger companies get many more.

180 View – We think that the survey asked the wrong people. The CEO and CFO will be a lot more concerned.