Our InformationWeek Analytics survey of 326 business technology professionals suggests that C-level executives not only recognize the importance of information security, but they actively support their IT organizations' efforts to protect corporate assets and reduce risk.
Frankly, we're a bit surprised by these results. We hear rants from IT pros about stingy executives who are ignorant of critical security issues and regard security as an impediment to doing business.
Indeed, conflicts between executives and IT organizations are still common, our follow-up interviews reveal. Moneymaking opportunities that present considerable security risks still go forward over the objections of information security teams. Conversely, security teams don't always appreciate that risk can't be entirely eliminated, or that some security measures go so far as to make information and technology too cumbersome to be useful.
McNabb's goal: "bombproof from the get-go"
Photo by Chris Crisman
We see four reasons for this high level of executive support. First is the rise of high-volume theft of credit card information, Social Security numbers, and other personal data. Such attacks began to make headlines in 2005, when DSW Shoe Warehouse and ChoicePoint were hit. In the DSW case, thieves stole 1.4 million credit card numbers from stores in 25 states. Meanwhile, poor controls at ChoicePoint enabled scam artists posing as legitimate businesses to access consumer records and perpetrate identity theft. Since then, a string of larger information thefts from the likes of the Hannaford Bros. grocery chain, job site Monster.com, retailer TJX, and, most recently, Heartland Payment Systems has put executives on notice: Such breaches can no longer be dismissed as merely isolated incidents.
Second, the high-profile thefts have triggered a number of state breach-disclosure laws, which compel companies to publicize the theft or loss of personally identifiable information. Companies also face industry data-protection standards, the most prominent of which is the Payment Card Industry Data Security Standard, which requires a variety of security measures for businesses that accept and process credit cards.
U.S. companies paid an average of $202 per exposed record in 2008, up from $197 in 2007, according to a report by the Ponemon Institute, a privacy management researcher. The report also says the average total cost per breach for each company was $6.6 million in 2008, up from $6.3 million in 2007 and $4.7 million in 2006.
The fourth major trend is the damage to a company's brand and reputation. While it's hard to put a price on the loss of customer trust or efforts to repair a brand, no CEO wants to have to try to do that math.