Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


12:41 PM
Connect Directly

Deloitte: Tech, Media, And Telecom Industries Reduce Security Spending

Six out of 10 firms worldwide say they're falling behind or trying to catch up with threats

Even among technology firms, security spending is dropping amid economic and budgetary pressures, according to a new report released today from Deloitte Touche Tohmatsu.

The Deloitte survey of technology, media, and telecommunications firms from around the world found these industries are spending less on security -- even as they voice concerns about social networking and other security risks. More than 30 percent have chopped their security budgets during the past 12 months, and more than half have allocated less than 6 percent of their overall IT budgets to security, according to the report.

What makes these vertical markets unique from others, such as financial services, is that they aren't as heavily regulated, and their security spending trends reflect that. "The drivers are a little different here," says Irfan Saif, a principal with Deloitte. "In other surveys [by Deloitte], financial services was increasing its security spending. I would attribute a lot of that to the regulatory landscape there."

About 60 percent of the technology, media, and telecom firms in the study said they are falling behind or still trying to catch up with the security threats they face. That's up from 49 percent last year, Saif notes.

And they're worried about Web 2.0-based security threats. "We asked them what they believed were the key threats to information security, and 83 percent said the exploit of vulnerabilities in Web 2.0 was a high risk to them," Saif says.

Those concerns correlate with their confidence about their risk to internal threats: Only 28 percent said they are "very" or "extremely" confident, down from 51 percent last year. More than 41 percent had experienced a security breach in the past 12 months.

Meanwhile, technology, media, and telecom firms are struggling to get upper management support for meeting security regulatory requirements. Nearly 60 percent said their senior executives either aren't effectively supporting their compliance efforts, or these efforts are not being sufficiently funded. And more than 67 percent said regulatory requirements are "somewhat effective" in securing their systems and data.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-03-01
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previousl...
PUBLISHED: 2021-03-01
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request...
PUBLISHED: 2021-03-01
In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite notebooks in projects that they are not authorized to access.
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.