Data leaks put company reputation in danger
Wednesday, 16 December 2009 — Regardless of pressure on security budgets and resources as a result of the current economic climate, spending on information security is increasing, according to the 12th annual Ernst & Young 2009 Global Information Security Survey.
The survey, which canvassed nearly 1,900 senior executives in more than 60 countries, revealed that with unprecedented economic, regulatory, industry and technology change, information security leaders are facing considerable risk and challenges that may significantly affect their information security profile, including 25% increase in internal attacks and 41% increase in external attacks.
The growing areas of data theft, fraud and privacy leaks can potentially contribute to significant brand reputation issues. 61% of respondents linked information security to protecting brand and reputation, as their most important driver. Managing privacy and the protection of personal information (53%) and achieving compliance with regulations (46%) are also top priorities for information security leaders.
Mike Trovato, Ernst & Young’s Information Security Leader explains, “Increasingly threats on IT systems including internal and external attacks and data theft are also prevalent. It is paramount that companies undertake a specific, targeted risk assessment exercise to identify their potential exposure and put in place appropriate risk-based responses, to meet regulatory and other obligations and to protect brand.”
Trovato says, "With escalating levels of risk - government, industry, and company policy compliance remains the key driver in information security. Regulators are stressing holistic solutions, which will draw a need for diverse approaches." To address these challenges, Trovato says "the survey revealed that finding adequate resources and budget and achieving organisational awareness of increased vulnerability are top priority issues for information security leaders."
Leveraging technology
Due to a heightening occurrence of data breaches, data protection and privacy is at the forefront of many information security leaders’ minds. Implementing or improving Data Leakage Prevention (DLP) technologies is a security priority in the coming 12 months, identified by 40% of respondents as one of their top three priorities. Data leakage prevention is the combination of tools and processes for identifying, monitoring and protecting sensitive data or information.
One of the most startling findings is how few companies are encrypting their laptops. Only 41% of respondents are currently encrypting them with only 17% planning to do so in the next year. This is surprising for a number of reasons: the number of breaches that have occurred due to loss or theft of laptops; the fact that the technology is readily available and affordable to implement; and that the impact to users during deployment is relatively low and should no longer be a barrier.
Trovato concludes: “Our survey shows that the levels of internal and external risks continue to increase. Managing information security risks requires an approach that is flexible and focused on what matters most to the organisation, protecting critical information. Only by understanding the use of information within critical business processes can an organisation, and in particular its information security function, truly begin to manage its security needs.”
-ends-
About the survey
The Ernst & Young 2009 Information Security Survey was developed with help from Ernst & Young’s assurance and advisory clients in more than 60 countries including 124 organisations in Australia and New Zealand. The fieldwork was conducted between June and August 2009. The results were primarily collected through interviews held with executives from approximately 1,900 organizations across all major industries. The full report is available on request or at www.ey.com
About Ernst & Young
Ernst & Young is a global leader in assurance, tax, transaction and advisory services. Worldwide, our 144,000 people are united by our shared values and an unwavering commitment to quality. We make a difference by helping our people, our clients and our wider communities achieve their potential. For more information, please visit www.ey.com.
Ernst & Young refers to the global organisation of member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
This news release has been issued by Ernst & Young Australia, a member firm of Ernst & Young Global Limited.
Liability limited under a scheme approved under Professional Standards Legislation.
Contact details
Gabrielle Kopke
Ernst & Young
Tel: +61 3 9655 2542
