IT firms under-spend on Info-Security – Study

Research organization dedicated to the promotion of developmental research and information, the IT Policy Compliance Group, has announced the availability of its latest benchmark report titled, “Managing Spend on Information Security and Audit to Improve Results.”

A press statement from the group, disclosed that based on research conducted with more than 2,600 firms, the study reveals that 68 per cent of firms were under-spending on information security relative to the financial risks and losses they are experiencing.

“Yet incremental increases toward the funding of best practices are responsible for financial returns that can exceed more than 200 per cent for most organizations,” the group said.

The new research sponsored by the Computer Security Institute, The Institute of Internal Auditors, Protiviti, ISACA, IT Governance Institute, and Symantec Corp. outlined a risk-based approach to budgeting for information security that rewards results; the practices responsible for managing business and financial risks from the use of IT; and the substantial reductions in spending on audit in IT.

Regional specialist manager, Symantec IRM, Errol Rhoden, said that like an insurance deductible, “all organisations are willing to sustain some level of financial risk and loss from theft of customer data or some level of business downtime from IT disruptions,” he said

Rhoden said that the research findings showed that an organisation’s loss-tolerance is exceedingly low, and the financial returns for small improvements are extraordinarily high.

The research further said that firms ranked three business risks from IT well ahead of other possible risks, namely confidentiality of sensitive information; Integrity of information, assets and controls in IT; and Availability of IT services.
The IT PCG report equally leverages on current benchmarks to measure the performance of firms against these three risk areas, which result included that worst outcomes, normative outcomes, and best outcomes.

On the worst outcomes, the study outlined that 19 per cent of all firms were experiencing more than 15 losses or thefts of data each year, 80 or more hours of business downtime from IT failures, and more than 15 audit-failing deficiencies.

The normative outcomes, according to the report, indicated that 68 per cent of all firms were operating at ‘normal’ levels experiencing between 3-15 losses or thefts of data each year, between 7-79 hours of business downtime from IT failures, and between 3-15 audit-failing deficiencies.

In addition, the best outcomes had 13 per cent of all firms achieving the best results, experiencing fewer than 3 losses or thefts of sensitive information each year, less than 7 hours of business downtime, and fewer than 3 audit-failing deficiencies.

The financial returns among these organisations range from 22 per cent to more than 3,000 per cent annually.

“Surprisingly, the difference in outcome between the worst performers and the best performers was not as a result of the size of security budgets,” the study revealed, noting that in the actual sense, the differences in size of security budgets were negligible.

“What mattered was how those budgets were used,” the study further stated.

ITREALMS Online ... delivering news for ICT4D