Analysts tell CISOs: Learn about your business

IDG News Service - Chief information security officers need to learn more about the business side of the companies they work for to effectively communicate the importance of computer security, analysts said today at the Gartner IT Security Summit 2005 in London.
The relationship between business managers and IT security employees at many companies is "not very healthy at all" because of communication barriers, said Paul E. Proctor, a Gartner Inc. analyst. "The future means that you've got to care about the business," he told security managers.
The most effective companies have a risk management officer who ideally understands technical security issues but can also evaluate whether it's right to invest in equipment. That subjective information can be passed along to the business side, Proctor said.
Such evaluations are new and foreign to many businesses, although a handful of companies are already successfully integrating the two sides, he said.
The two-day Gartner conference focuses on how IT managers can deal with a range of security issues affecting their companies, including phishing, compliance with government regulations and consumer confidence.
The threats to corporate computer systems are growing more serious because people who don't have sophisticated computer skills are able to engage in activities like stealing credit card information and laundering money, said Gartner analyst Jay Heiser.
While awareness of various security problems is increasing, businesses are overly optimistic about how robust their systems are, he said. In particular, as more services are included in operating systems, there is more opportunity for unauthorized access by hackers or other corporate intruders.
"We think it's getting better, but we don't see that Windows will be innately secure in the next five years," Heiser said.
Other threats, such as viruses, mean that you can't take a machine with the Windows operating system "out of the box and expect it to survive," Heiser said.
In a separate session, Klaus Brunnstein, a professor of applied informatics at Germany's University of Hamburg, said risks come from software that is "full of programming faults." Programs have become so complex that the security remedies for them are also complicated, and it's difficult to identify vulnerabilities, he said.
E-mails containing active HTML or XML code may have malicious content that is hidden from the user, making it difficult to evaluate the risks that companies face, Brunnstein said.
The key to solving security issues lies with both the manufacturers and the companies that use the systems, said Bob Bruce, vice president of mobile solutions at Nokia Enterprise Solutions.