IT security weakened by compliance issues

Compliance is now the key security driver for two thirds of firms

Companies are devoting too much of their IT security budgets trying to comply with EU directives and regulations like Sarbanes-Oxley when they should be spending more on other security threats, according to the yearly security report by Ernst and Young.

The survey found that compliance is now the key driver for two thirds of firms worldwide and attracts a greater spend than efforts to reduce the impact of viruses and worms.

Ernst and Young suggested that companies are failing to look into security issues relating to emerging technologies such as mobile computing, wireless networks and internet telephony.

New regulations, which effectively make company executives more responsible for the accuracy of company data, have led to firms tightening internal controls on access to databases.

But the report concluded that this focus on what it calls "mundane remedial things" is causing companies to overlook important security gaps.

Ernst and Young said that a key area is failing properly to assess the risks of dealing with suppliers and outsourcing partners. It cited the example of an Indian call centre employee who attempted to sell confidential data to a reporter from The Sun newspaper.

The report found that a fifth of companies are not looking at the security risks of suppliers at all, and of those that do most perform only an initial assessment. Only 17 per cent carry out an ongoing, independent, third-party review of supplier security.

The report also highlighted the problems of removable media, warning that most firms had found it difficult to prevent employees downloading sensitive data onto USB drives, iPods and MP3 devices.

And despite the known threats posed by developing technologies such as voice over IP, open source and server virtualisation, fewer than 20 per cent of organisations cited these as 'significant' security concerns.

Organisations consider emerging technologies in general to be a growing security concern in the next 12 months. However, over a quarter have no plans to take action to address those concerns during that time period or beyond.