
IT security’s stock continues to rise
According to research from Forrester,
the general gloom around business
spending is not affecting security. Its
survey of 1,200 enterprise and small and
medium business (SMB) security decision
makers found that a fifth
expected to increase their
security budgets in 2009, while three-quarters expected no
cuts. Only 6% needed to deal
with cutbacks in their security
budgets. It says that security
spending now makes up 10%
of overall IT operating budgets,
up from 8% last year.
The survey, presented at Forrester’s
recent Security Forum, also found
that security and risk professionals
were enjoying a renaissance period.
Their influence was also on the rise
within companies, with nearly half
of those responsible for security
and risk reporting directly to the board, CEO or
executive committee, rather than being simply
embedded within the IT department.
“This is an exciting time to be in security,” said
Forrester Research principal analyst Khalid Kark.“We are in a period of immense change in which
we have the opportunity to define the future of
our profession. Security and risk professionals
are faced with a rapidly changing technology
landscape and business environment. To achieve
success in the role today, they need to be open to
new ideas and embrace change.”
Instead of protecting the perimeter, security
professionals are increasingly focused on data.
Over half of respondents to Forrester’s survey said
that protecting corporate intellectual property
and customer data was their top priority over the
next 12 months. Business continuity and disaster
recovery planning is also being taken much more
seriously with 42% of respondents saying it was
very important, up from 33% in 2007.
Exploding security myths
With companies facing an increasing number of
threats, it’s vital that security professionals choose
where to invest their budgets wisely. Unfortunately
security is one area where misinformation is rife,
which makes this decision sometimes difficult.
To help enterprises, analyst Gartner has recently
described what it considers are the most common
myths in security:
-
The hackers are winning and security is a retreating action;
-
Data breaches are increasing in frequency;
-
Application and operating system security is the responsibility of the vendors – and they are working hard to protect us;
-
Regulatory compliance covers 100% of the security needs for most organisations;
-
Hackers actually help the industry by finding problems and publicising them;
-
Security is there to stop business from doing anything;
-
Quality of security equals money invested in security infrastructure and personnel.
“Organisations can only afford to focus their resources on real issues,” said Eric Ouellet, research vice president at Gartner. “The security department must become adept at identifying the real threats to ensure that security becomes an enabler for business innovation, rather than an inhibitor,” Approaching security as a reactionary control will not resolve or minimise the risks, he added. Instead it recommends that organisations should view security as a tool that can help it manage risk and take advantage of market opportunities it was never able to before.



