Risk
7/11/2007
04:30 PM
50%
50%

Are You Spending Your IT Security Dollars Wisely? If You Don't Know, You're Not Alone

How do companies know they're getting their money's worth when they invest in IT security products and services? InformationWeek's upcoming 10th Annual Global Security Survey indicates that a surprising number of companies don't measure the value of their security investments at all. (Hint: it's up from last year).

How do companies know they're getting their money's worth when they invest in IT security products and services? InformationWeek's upcoming 10th Annual Global Security Survey indicates that a surprising number of companies don't measure the value of their security investments at all. (Hint: it's up from last year).It was one of the most surprising results I came across as I studied the data in preparation to write this year's security survey story, which will debut on InformationWeek.com July 14. IT budgets have always been tightly controlled; some companies won't even talk about how much they spend. But security is different. Companies have a longer leash when it comes to spending on security because no one wants to be the next company to make headlines because of a major data breach, either through lost or stolen information.

That's why the Veterans Affairs Department last year signed up SMS Inc. to a $3.7 million contract to install GuardianEdge Technologies and Trust Digital mobile encryption software on all laptops. Is that investment paying off? Hard to say because the VA has since found new ways of losing information about the men and women who've served this country. In January, an IT specialist with the VA lost an external hard drive that may have contained information on more than 1 million vets as well as non-VA physicians, and it's unclear how much of that information was encrypted. What is clear is that not all of that information was encrypted, a condition that pokes holes in the VA's efforts following the landmark theft of a VA laptop in May 2006 containing about 27 million records.

Maybe this is why not every organization measures the value of its security investments. In the 2006 Annual Global Security Survey, about half of the U.S. respondents measured value based on workers spending less time on security-related issues, while 41% used any decline in the amount of network downtime to justify security spending. Forty-percent cited better protection of customer records as an important factor in determining whether their security investments cut the muster. Yet 22% of U.S. survey respondents said they didn't measure the value at all.

Are IT security dollars that easy to come by, or have companies simply written IT security off as an exercise in futility? Be sure to check out the 10th Annual Global Security Survey next week to see how you compare with your peers.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.