In-Depth

Compliance, New Threats Drive Security Spending

Enterprise security is an expensive proposition – one that's likely to get even more expensive as organizations take steps to protect themselves.

• By Stephen Swoyer
• 07/15/2008

Pity U.S. IT organizations: not only must they grapple with rising regulatory and compliance costs, but many are coming to grips with another rising cost: security. Enterprise security is an expensive proposition – one that's likely to get even more expensive as organizations take further steps to protect themselves.

The good news, according to a new survey from security software vendor CA Inc., is that all of that money seems to have been well-spent.

CA's latest Security and Identity Access Management (IAM) Survey found an overall decrease in the number of organizations that reported virus, network, and denial-of-service attacks last year.

What's more, CA indicates, almost 15 percent of shops said they hadn't experienced (known) attacks of any kind. That's up from 11 percent in 2006.

That figure includes virus outbreaks. Last year, almost 60 percent of enterprises grappled with virus attacks, down from almost 70 percent in 2006. Meanwhile, just 40 percent of U.S. enterprises battled network attacks last year; that's down from half of all shops in 2006.

The denial-of-service (DoS) -- that old hacking standby -- appears to be on the wane: just over a quarter (26 percent) of organizations were victims of DoS activity in 2007, CA says. That's a steep decline from 2006's tally of 40 percent.

Even as IT organizations have clamped down on traditional attack vectors, they're increasingly coming to grips with another line of attack: breaches from within.

According to CA, the percentage of survey respondents who experienced internal security breaches increased slightly from its 2006 survey, climbing to 44 percent in 2007 (an uptick of 2 percentage points). That's a sharp spike from half-a-decade ago, when less than one-sixth of IT organizations experienced an internal breach.

"The increase of internal threat also appears to be making it more difficult for organizations to successfully manage and contain the costs associated with security attacks/breaches," the CA survey indicates.

Serious Breaches

The numbers paint a grim picture. In 2007, more than a third of organizations reported losing confidential customer or transactional data as a result of security breaches; that compares with just 22 percent two years ago. What's more, internal breaches have disastrous real-world consequences, in terms of both costs and irate customers. According to the CA survey, one-third of organizations say they suffered reduced customer satisfaction as a result of breach or attack, while almost two-thirds (61 percent) experienced diminished productivity.

This, of course, plays to one of CA's product categories: IAM. "U.S. businesses and governments recognize it doesn't take much to shake consumer confidence, and they recognize the need to do all they can to assure consumers and constituents," said Lina Liberti, vice president, CA Security Management, in a statement. "As the growth of security threats change from external attacks [such as] distributed denial of service to the insider threat, businesses are turning to identity and access management solutions to combat that internal threat. This survey indicated that the number of organizations planning to roll out identity and access management solutions in the next 12 to 18 months increased 11 [percentage points], moving from 49 percent in 2006 to 60 percent in 2008."

Increasingly, a majority of organizations are devoting a majority of their IT spending to security compliance. In 2007, for example, four-fifths of survey respondents reporting spending 10 percent or more of their IT budgets on security compliance, while more than half (56 percent) said that their firms spend 20 percent or more of their IT dollars on security compliance.

Over time, security budgets will gobble up an ever-larger share of overall IT spending, according to CA officials.

"The survey points to an increase in the severity of consequences of internal breaches. The implications are now tied squarely to dollars and reputation," said Liberti. "The potential aftershocks of an internal breach [have] the attention of both the business and IT, and for enterprise organizations the priority has now shifted from reactive to proactive security strategies to deal with this threat."