Security role is evolving

Communications News, Feb, 2008

A growing number of organizations recognize information security can provide more than just protection of corporate assets, with the delivery of IT and operational efficiencies and improving overall business performance emerging as critical objectives. That is the word from Ernst & Young's 10th annual global information security survey. The survey canvassed nearly 1,300 senior executives in more than 50 countries.

[ILLUSTRATION OMITTED]

"Over the past 10 years, we have seen a positive evolution in the role of information security," says Paul van Kessel, global leader of Ernst & Young's technology and security risk services.

Among the survey's key findings:

Information security is better aligned with organizational risk initiatives. Four out of five (82 percent) respondents reporting at least some levels of integration. The number of organizations that have fully integrated information security with risk management has nearly doubled since last year (from 15 percent to 29 percent).

Information security is now credited with improving IT and operational efficiency. More than two-thirds (69 percent) of respondents feel that information security improves IT and operational efficiencies.

Compliance continues to be the primary driver of information security improvements and a top-ranked influencer in risk-management integration. For the third year in succession, respondents (64 percent in 2007) ranked compliance as the principal information security driver.

Privacy and data protection increased significantly as drivers of information security. Fifty-eight percent of this year's respondents placed privacy and data protection in the top three drivers, up from 41 percent in 2006.

The greatest challenge is the availability of experienced and trained resources. More than half of the respondents indicated that the lack of experienced and skilled resources is the number one challenge to delivering information security projects. Correspondingly, more than 60 percent of respondents say they are outsourcing certain elements of information security.