Press Release: Symantec Corp. (Nasdaq: SYMC) recently released the findings of its global 2010 State of Enterprise Security study. The study found that organizations globally and in Malaysia rate security their top issue.
This isn’t a surprise, considering that 75 percent of organizations globally and 50 percent in Malaysia experienced cyber attacks in the past 12 months.
These attacks cost enterprise businesses an average of US$2 million per year globally. Finally, organizations reported that enterprise security is becoming more difficult due to understaffing, new IT initiatives that intensify security issues and IT compliance issues. The study is based on surveys of 2,100 enterprise CIOs, CISOs and IT managers from 27 countries in January 2010.“Protecting information today is more challenging than ever,” said Paul Woo, principal consultant for enterprise security, Malaysia, Symantec. “By putting in place a security blueprint that protects their infrastructure and information, enforces IT policies, and manages systems more efficiently, businesses can increase their competitive edge in today’s information-driven world.”
Study Highlights:
- Security is of great concern to global and Malaysian enterprises. Cyber risk was ranked as a key concern, more than natural disasters, terrorism, and traditional crime. Reflecting that perception, IT is intently focused on enterprise security. On average globally, IT assigns 120 staffers to security and IT compliance. Enterprises rated “better manage business risk of IT” as a top goal for 2010, and 84 percent globally (100 percent in Malaysia) rated it absolutely/somewhat important. Nearly all the enterprises surveyed (94 percent globally and 100 percent in Malaysia) forecasted changes to security in 2010, with 48 percent globally and 75 percent in Malaysia expecting major changes.
- Enterprises are experiencing frequent attacks. In the past 12 months, 75 percent of enterprises globally and 50 percent in Malaysia experienced cyber attacks.
- Every enterprise (100 percent) experienced cyber losses in 2009. The top three reported losses globally were theft of intellectual property, theft of customer credit card information or other financial information, and theft of customer personally identifiable information. Globally, these losses translated to monetary costs 92 percent of the time. The top three costs were productivity, revenue, and loss of customer trust. Globally, enterprises reported spending an average of US$2 million annually to combat cyber attacks. In Malaysia, the most common reported losses were theft of customer credit card information, theft of customer personally identifiable information, theft of customer personal health information, theft of other corporate data, identity theft, and downtime of environment; at 25 percent respectively.
- Enterprise security is becoming more difficult due to a number of factors. First, enterprise security is understaffed, with the most impacted areas being network security (50 percent in Malaysia), endpoint security, messaging security, IT audit and compliance, vulnerability assessment and intrusion detection, incident response, security systems management (at 25 percent respectively). Second, enterprises are embarking on new initiatives that make providing security more difficult. Initiatives that IT rated as most problematic from a security standpoint include infrastructure-as-a-service, platform-as-a service, server virtualization, endpoint virtualization, and software-as-a-service. Finally, IT compliance is also a huge undertaking. The typical enterprise is exploring 19 separate IT standards or frameworks and are currently employing eight of them. The top standards include ISO, HIPAA, Sarbanes-Oxley, CIS, PCI, and ITIL.
“Abu Dhabi Commercial Bank is a good example of an organization that has put an effective security strategy into place with an emphasis on addressing issues proactively,” continued Woo. “The company has a complete solution set of products and services that provide 24-hour protection, threat monitoring and response, all for a fixed annual cost. This approach is more cost-effective than securing a network after it has been compromised.”
Recommendations
- Organizations need to protect their infrastructure by securing their endpoints, messaging and Web environments. In addition, defending critical internal servers and implementing the ability to back up and recover data should be priorities. Organizations also need the visibility and security intelligence to respond to threats rapidly.
- IT administrators need to protect information proactively by taking an information-centric approach to protect both information and interactions. Taking a content-aware approach to protecting information is key in knowing where sensitive information resides, who has access, and how it is coming in or leaving your organization.
- Organizations need to develop and enforce IT policies and automate their compliance processes. By prioritizing risks and defining policies that span across all locations, customers can enforce policies through built-in automation and workflow and not only identify threats but remediate incidents as they occur or anticipate them before they happen.
- Organizations need to manage systems by implementing secure operating environments, distributing and enforcing patch levels, automating processes to streamline efficiency, and monitoring and reporting on system status.
