Today’s most compelling technologies are giving you the biggest security headaches. Social networking sites such as Twitter, Facebook and LinkedIn enhance collaboration and help your company connect with customers, but they also make it easier than ever for your employees to share customer data and company secrets with outsiders.
Virtualisation and cloud computing let you simplify your physical IT infrastructure and cut overhead costs, but you’ve only just begun to see the security risks involved. Putting more of your infrastructure in the cloud has left you vulnerable to hackers who have redoubled efforts to launch denial-of-service attacks against the likes of Google, Yahoo and other Internet-based service providers. A massive Google outage earlier this year illustrates the kind of disruptions cloud-dependent businesses can suffer.
But there’s also good news. Even though the worst economic recession in decades has compelled you to spend less on outsourced security services and do more in-house, your security budget is holding steady. And more of you are employing a chief security officer.
Such are the big takeaways from the seventh annual Global Information Security Survey, which CIO and CSO magazines conducted with PricewaterhouseCoopers earlier this year. Nearly 7,300 business and technology executives worldwide responded from a variety of industries, including government, health care, financial services and retail.
These trends are shaping your information security agenda. “Every company worries about protecting their data, especially their client data,” says Charles Beard, CIO at Science Applications International Corp (SAIC). “Under the old business model, everyone had to get together in the same building in the same geographical area. Now everyone is using the Internet and mobile devices to work with each other. That’s where we see the promise of things like social networking. The flip side is we’re exposed to the dark side of cyber space. Adoption of this technology is well ahead of efforts to properly secure and govern it.”
Read on to learn what we found.
TREND #1
THE PROMISE AND PERIL OF SOCIAL NETWORKING
In less than two years, social networking has gone from an abstract curiosity to a way of life for many people. When someone updates their status on Twitter, Facebook or LinkedIn, they might do it at work or on company-owned laptops from home.
What gives IT executives heartburn is the ease with which users could share customer data or sensitive company activities while they’re telling you what they’re having for lunch. Cyber outlaws know this and use social networks to launch phishing scams.
In one popular attack, they send their victims messages that appear to be coming from a Facebook friend. The ‘friend’ may send a URL they insist you check out. It may be pitched as a news story about Michael Jackson’s death or a list of stock tips. In reality, the link takes the victim to a shady website that automatically drops malware onto the computer. The malware goes off in search of any valuable data stored on the computer or wider company network, be it customer credit card numbers or the secret recipe for a new cancer-fighting drug.
It’s no surprise, then, that every IT leader surveyed admitted they fear social-engineering-based attacks. Forty-five per cent specifically fear the phishing schemes against Web 2.0 applications.
Nevertheless, for many company executives, blocking social networking is out of the question because of its potential business benefits. Companies now clamour to get their messages out through these sites, so the challenge for CIOs is to find the right balance between security and usability.
“People are still incredibly naive about how much they should share with others, and we have to do a better job educating them about what is and isn’t appropriate to share,” says H. Frank Cervone, vice chancellor of information services with Purdue University Calumet. “We have to do a better job of enhancing our understanding of what internal organisation information should not be shared.”
But in a university setting, it’s critical to engage people through social media, Cervone adds. Even in the commercial sector, he doesn’t see how organisations can avoid it.
INCLUDING PROVISIONS
And yet this year—the first in which we asked respondents about social media, only 23 per cent said their security efforts now include provisions to defend Web 2.0 technologies and control what can be posted on social networking sites.
One positive sign: Every year, more companies dedicate staff to monitoring how employees use online assets—57 per cent this year compared to 50 per cent last year and 40 per cent in 2006. Thirty-six per cent of respondents monitor what employees are posting to external blogs and social networking sites.
To prevent sensitive information from escaping, 65 per cent of companies use Web content filters to keep data behind the firewall, and 62 per cent make sure they are using the most secure version of whichever browser they choose. Forty per cent said that when they evaluate security products, support and compatibility for Web 2.0 is essential. Unfortunately, social networking insecurity isn’t something one can fix with just technology, says Mark Lobel, a partner in the security practice at PricewaterhouseCoopers.
“The problems are cultural, not technological. How do you educate people to use these sites intelligently?” he asks. “Historically, security people have come up from the tech path, not the sociologist path. So we have a long way to go in finding the right security balance.”
Guy Pace, security administrator with the Washington State Board for Community and Technical Colleges, says his organisation takes many of the precautions described above. But he agrees with Lobel that the true battleground is one of office culture, not technology. “The most effective mitigation here is user education and creative, effective security awareness programmes,” he says.
TREND #2
JUMPING INTO THE CLOUD, SANS PARACHUTE
Given the expense to maintain a physical IT infrastructure, the thought of replacing server rooms and haphazardly configured appliances with cloud services is simply too hard for many companies to resist. But rushing into the cloud without a security strategy is a recipe for risk.
According to the survey, 43 per cent of respondents are using cloud services such as software-as-a-service or infrastructure-as-a-service. Even more are investing in the virtualisation technology that helps to enable cloud computing. Sixty-seven per cent of respondents say they now use server, storage and other forms of IT asset virtualisation. Among them, 48 per cent actually believe their information security has improved, while 42 per cent say their security is at about the same level. Only 10 per cent say virtualisation has created more security holes.
Fears about vendors dominate cloud security risks. Security may well have improved for some, but experts such as Chris Hoff, director of cloud and virtualisation solutions at Cisco Systems, believe that both consumers and providers need to ensure they understand the risks associated with the technical, operational and organisational changes these technologies bring to bear.
THE DEFINITION
“When you look at how people think of virtualisation and what it means, the definition of virtualisation is either very narrow—that it’s about server consolidation, virtualising your applications and operating systems, and consolidating everything down to fewer physical boxes—or it’s about any number of other elements: client-side desktops, storage, networks, security,” Hoff says.
“Then you add to the confusion with the concept of cloud computing, which is being pushed by Microsoft and a number of smaller, emerging companies. You’re left scratching your head wondering what this means to you as a company. How does it impact your infrastructure?”
Fortunately, there’s some evidence of companies proceeding with caution. One example is Atmos Energy, which is using Salesforce.com to speed its response time to customers and help the marketing department manage a growing pool of clients, according to CIO Rich Gius.
The endeavour is successful thus far, so Gius is investigating the viability of running company e-mail in the cloud. “It would help us address the growing challenge where e-mail-enabled mobile devices like BlackBerrys are proliferating widely among the workforce,” he says. But he’s not ready to take such a big step because the risks, including security, remain hard to pin down.
One example of the disruption that cloud-dependent companies can experience came in May, when search giant Google—whose content accounts for five per cent of all Internet traffic—suffered a massive outage. When it went down, many companies that have come to rely on its cloud-based business applications (such as e-mail) were dead in the water.
The outage wasn’t caused by hackers, but there are signs that cyber criminals are exploring ways to exploit the cloud for malicious purposes. On the heels of the outage, attackers added insult to injury by flooding Google search results with malicious links, prompting the US Computer Emergency Response Team (US CERT) to issue a warning about potential dangers to cloud-based service sites.
The attack poisoned several thousand legitimate websites by exploiting known flaws in Adobe software to install a malicious program on victims’ machines, US CERT says. The program would then steal FTP login credentials from victims and use the information to spread itself further. It also hijacked the victim’s browser, replacing Google search results with links chosen by the attackers. Although the victimised sites were not specifically those offering cloud-based services, similar schemes could be directed at cloud services providers.
VULNERABILITIES
IT organisations often make an attacker’s job easier by configuring physical and cloud-based IT assets so poorly that easy-to-find-and-exploit flaws are left behind. Asked about the potential vulnerabilities in their virtualised environments, 36 per cent cited misconfiguration and poor implementation, and 51 per cent cited a lack of adequately trained IT staff (whose lack of knowledge leads to configuration glitches). In fact, 22 per cent of respondents cited inadequate training, along with insufficient auditing (to uncover vulnerabilities) to be the greatest security risk to their company’s cloud computing strategy.
It’s this awareness that makes Atmos Energy’s Gius proceed with caution. “We have no CSO. If we were a financial services firm, it might be a different story, or if we had a huge head count,” Gius says. “But we are a small-to-medium-sized company, and the staff limitations make these kinds of implementations more difficult.” Even with the right resources, security in the cloud is a matter of managing a variety of risks across multiple platforms.
There’s no single cloud. Rather, “there are many clouds, they’re not federated, they don’t natively interoperate at the application layer and they’re all mostly proprietary in their platform and operation,” Hoff says. “The notion that we’re all running out to put our content and apps in some common [and secure] repository on someone else’s infrastructure is unrealistic.”
Lobel, with Pricewaterhouse Coopers, says perfect security is not possible. “You have to actively focus on the security controls while you are leaping to these services,” he says. It’s difficult for companies to turn back once they have let their data and applications loose because they are often quick to rid themselves of the hardware and skills they would need to bring the services back in-house.
“If you dive down a well without a rope, you may find the water you wanted, but you’re not going to get out of the well without the rope,” he says. “What if you have a breach and you need to leave the cloud? Can you get out if you have to?”
Trend #3
INSOURCING SECURITY MANAGEMENT
A few years ago, technology analysts were predicting unlimited growth for managed security service providers (MSSPs). Many companies then viewed security as a foreign concept, but laws such as Sarbanes-Oxley, the Health Insurance Portability and Accountability Act and the Gramm-Leach-Bliley Act (affecting financial services) were forcing them to address intrusion defence, patch management, encryption and log management.
Attacks on data have increased faster than any other security exploit. The top target: databases. Convinced they couldn’t do it on their own, companies chose outsourcers to do it for them. Gartner estimated the MSSP market in North America alone would reach US$900 million in 2004 and that it would grow another 18 per cent by 2008.
Then came the economic tsunami, which appears to have cast a shadow over outsourcing plans even though security budgets are holding steady. Although 31 per cent of respondents this year are relying on outsiders to help them manage day-to-day security functions, only 18 per cent said they plan to make security outsourcing a priority in the next 12 months.
SPECIFIC FUNCTIONS
When it comes to specific functions, the shift has already begun. Last year, 30 per cent of respondents said they were outsourcing management of application firewalls, compared to 16 per cent today. Respondents cited similar reductions in outsourcing of network and end-user firewalls. Companies have also cut back on outsourcing encryption management and patch management.
At the same time, more companies are spending money on these and other security functions. Sixty-nine per cent said they’re budgeting for application firewalls, up slightly compared to the past two years. Meanwhile, more than half of respondents said they are investing in encryption for laptops and other computing devices. The results surprise Lobel of PricewaterhouseCoopers. “When you think about it logically, some IT organisations have the resources and maturity to manage their operating systems and patches, but many don’t,” he observes. “Hopefully, the numbers simply mean IT shops have grown more mature in their security understanding.”
Security budgets are holding steady. More companies are increasing spending than cutting it. Gius of Atmos Energy offered another possible explanation: Companies see a lot of chaos in the security market with an avalanche of mergers and acquisitions. One independent security vendor after another has merged with or been acquired by other companies. Examples include BT’s acquisition of Counterpane and IBM’s acquisition of Internet Security Systems. IT leaders are simply getting out of the way until the industry settles down.
HANDLING IT IN-HOUSE
Gius says Atmos Energy is handling most of its security in-house right now. “We pursued a number of open-source and lower-cost solutions to manage it ourselves,” he says. “We invested in two people to help ensure we had the skills to manage that environment.” But he’d like to outsource more if it makes sense financially.
He notes that security is increasingly integrated into the platforms provided by the likes of Microsoft, Cisco and Oracle, as well as telecom providers such as Comcast and Verizon. It makes sense to him to have those providers manage the security of their systems.
Beard, with SAIC, says that no matter what drives security spending decisions, companies should understand their specific security strategies and where managed security providers can offer unique value. Smart business executives understand that they must maintain control of the big picture at all times, even if a third party is managing many of the levers.
Keeping an eye on security service providers and the risks they are encountering is essential. “CIOs and security officers may outsource certain functions to various degrees, but they should never outsource their responsibility,” Beard advises.
Trend # 4
A NEW CORPORATE COMMITMENT
CIOs may still struggle with the quality of their data security, but the response to this year’s survey suggests their executive peers have agreed, finally, that security can’t be ignored.
Companies’ budget plans tell part of the story. Not only are more companies investing in security technologies, but overall security investments are largely intact, despite the economy.
Twelve per cent of respondents expect their security spending to decline in the next 12 months. But 63 per cent say their budgets will hold steady or increase (although fewer foresee increases than did last year).
For starters, more companies are hiring CSOs or chief information security officers (CISOs). Eighty-five per cent of respondents said their companies now have a security executive, up from 56 per cent last year and 43 per cent in 2006. Just under one-third of security chiefs report to CIOs, 35 per cent to CEOs and 28 per cent to boards of directors. Two factors are influencing companies to maintain security as a corporate priority: Seventy-six per cent say the increased risk environment has elevated the importance of cyber security among the top brass, while 77 per cent said the increasingly tangled web of regulations and industry standards has added to the sense of urgency.
Respondents were asked how important various security strategies had become in the context of harsher economic realities. Seventy per cent cited the growing importance of data protection while 68 per cent cited the need to strengthen the company’s governance, risk and compliance programmes.
Notes Mauricio Angée, senior manager of IT security and compliance and CSO at Universal Orlando: “For segregation of duty purposes, it’s interesting to see how companies are being asked—by compliance auditors, qualified security assessors and through legislation—to hire IT security managers with a much-more-defined set of roles and responsibilities.” Such roles include setting the company’s security policy, making the security budget pitch (instead of the CIO) and delegating responsibility among lower-level IT security administrators and engineers.
HOW IT COSTS YOU
Losses from incidents average US$833,000.None of these developments, however, make a focus on information security a sure bet in the eyes of IT leaders. Just because companies feel they have to spend money on security doesn’t mean executives view it as an essential, even beneficial business process instead of a pain-in-the-neck task being forced upon them.
Angée said CIOs and security leaders still have to fight hard for every penny. Meanwhile, security execs don’t have the same decision-making power as other C-level leaders in every company, says PricewaterhouseCoopers’ Lobel.
CIOs can bring in a CSO or CISO without a strategy and budget for that person to work with and end up achieving nothing. If something goes wrong, he concludes, “all you’ll have is somebody to blame and fire.”
Bill Brenner is a senior editor with CSO magazine and CSOonline.com.
BOX 1:
Top IT Security Priorities
New investments are focused on protecting data, authenticating users.
Biometrics
Web content filters
Data leakage prevention
Disposable passwords/smart cards/tokens
Reduced or single-sign-on software
Voice-over-IP security
Web 2.0 security
Identity management
Encryption of removable media
BOX 2: GSIS 2009 Methodology
The seventh-annual ‘Global State of Information Security Survey’—a worldwide study by CIO, CSO and PricewaterhouseCoopers—was conducted online from 20 April 2009, through 23 June 2009. CIO and CSO print and online customers and clients of PricewaterhouseCoopers from around the globe were invited to take the survey. Results are based on responses from 7,276 security and information technology professionals from more than 100 countries. Thirty-two per cent of respondents were from North America, followed by Asia (27 per cent), Europe (26 per cent), South America (14 per cent) and the Middle East and South Africa (two per cent). The margin of error for this survey is plus or minus one per cent.
BOX 3: KEY GSISS Highlights
The economic downturn, as a major driver of information security spending, has slammed onto the executive agenda.
The number of respondents who say that their organisation has a data loss prevention (DLP) capability in place has leapt this year—from 29 per cent in 2008 to 44 per cent this year.
Last year, the survey revealed significant misalignment among business and IT decision-makers. This year, the tide has changed.
One of the strongest trends this year is the increasing interest in the virtualisation of IT assets.
BOX 4:
Asia
North American and Asian security practices are no longer on a par with one another, as survey responses last year indicated. On the one hand, gains in Asia—across every major security domain, from strategy and assessment to technology—have advanced very significantly over the past 12 months. On the other hand, gains in North America have advanced even further. That may change this year. Here’s why:
Spending: Asian respondents are far more likely than their North American colleagues to estimate that spending on security over the next year will either increase or stay the same (73 per cent versus 59 per cent).
Deferrals and cancellations: Decision-makers in Asia are much more likely to view deferrals and cancellations of some security-related initiatives as short-term impacts over a six-month period than their North American counterparts who believe the project and funding impacts will last for a longer period of time.
Understanding threats: Asian organisations have a deeper understanding about where the threats to their assets are coming from than do North American ones. They’re much more likely, for example, to know the number of security incidents occurring in the past 12 months as well as the likely source and type of the attack.
Incidents: With a deeper understanding of their threat environment, Asian organisations have uncovered valuable information: i.e., that the attacks are more numerous than expected. And that the incidents have actually been much more successful in exploiting data and networks—rather than devices, applications and users—than Asian companies estimated last year.
China takes the global lead: As China muscles its way through the economic downturn, its security capabilities have stepped nimbly ahead of India’s—in a dramatic shift from last year’s trend—and, in the same one-year sweep, ahead of those in the US and most of the world.
North America
After vying with Asia last year for regional dominance in global security practices, North America has stepped ahead in many, though not all, important security domains. Yet as the downturn plays out, North America appears to have eased off on security-related investment in comparison with other regions. This mild slowing in investment, however, may carry implications for future years, particularly since Asia’s momentum in security shows no signs of slowing.
A strong portfolio of capabilities: In the midst of the downturn, North American organisations are falling back on a relatively mature set of security and privacy-related capabilities established over years of investment. North America leads other regions, for example, in areas that range from having an overall information security strategy (73 per cent versus 66 per cent in Asia, 56 per cent in South America, and 59 per cent in Europe) to conducting employee awareness security programs (63 per cent versus 55 per cent in Asia, 46 per cent in South America, and 40 per cent in Europe).
Investment deferral: North American organisations are more likely, however, to spread security-related project deferrals across a year or longer, unlike Asian and South American organisations which have scheduled more of these delays within a shorter six-month period.
Enterprise risk management: One emerging area of weakness for North America—at least on a regional comparison basis—is in managing risks at the enterprise level. While North America (30 per cent) trails both South America (43 per cent) and Asia (37 per cent) in adopting enterprise risk management, it’s only a few percentage points ahead of Europe (28 per cent).
