Companies are devoting too much of their IT security budgets trying to comply
with EU directives and regulations like
Sarbanes-Oxley
when they should be spending more on other security threats, according to the
yearly security report by Ernst and
Young.
The survey found that compliance is now the key driver for two thirds of
firms worldwide and attracts a greater spend than efforts to reduce the impact
of viruses and worms.
Ernst and Young suggested that companies are failing to look into security
issues relating to emerging technologies such as mobile computing, wireless
networks and internet telephony.
New regulations, which effectively make company executives more responsible
for the accuracy of company data, have led to firms tightening internal controls
on access to databases.
But the report concluded that this focus on what it calls "mundane remedial
things" is causing companies to overlook important security gaps.
Ernst and Young said that a key area is failing properly to assess the risks
of dealing with suppliers and outsourcing partners. It cited the example of an
Indian call centre employee who attempted to sell
confidential data to a reporter from The Sun newspaper.
The report found that a fifth of companies are not looking at the security
risks of suppliers at all, and of those that do most perform only an initial
assessment. Only 17 per cent carry out an ongoing, independent, third-party
review of supplier security.
The report also highlighted the problems of removable media, warning that
most firms had found it difficult to prevent employees downloading sensitive
data onto USB drives, iPods and MP3 devices.
And despite the known threats posed by developing technologies such as voice
over IP, open source and server virtualisation, fewer than 20 per cent of
organisations cited these as 'significant' security concerns.
Organisations consider emerging technologies in general to be a growing
security concern in the next 12 months. However, over a quarter have no plans to
take action to address those concerns during that time period or beyond.
Do you agree?
Have your say on this article