Home > Security

Computerworld - Up to now, enterprises' security budgets have been so lean they could almost be considered anorexic. That's because CEOs have considered security as necessary but haven't bought the argument that there is an economic advantage to going above a minimal level of security. Unfortunately, CEOs have persisted in focusing on four basic questions that too often stump the most savvy IT professionals:

• What is the security return on investment?


• What is the probability of a catastrophic security failure?


• What is the cost of self-insuring against security risks?


• What are the tangible benefits of being an industry leader for security?

To help IT professionals talk to CEOs about security issues, a newly formed think tank called the Security Leadership Institute, sponsored by Unisys Corp., has conducted in-depth interviews with CEOs and board members. Board members of the institute (including myself) -- all recognized security experts from business and government -- interviewed more than 25 CEOs and public-sector agency chiefs, focusing on what they think the value proposition of security is to their enterprise. We believe that the results from our work will help IT professionals make the case for the many benefits that can be realized from a more robust investment in security.
What We Learned
Most CEOs interviewed in our study viewed both physical and information security as purely tactical, rather than as a strategic imperative. In their minds, security means either protection of assets or prevention of IT-related risks, such as hacking attacks and other cybercrime. Some CEOs viewed security as an element of a larger business risk-management process. In almost all cases, though, CEOs in the private and public sectors didn't embrace security as something directly related to corporate mission or strategy.
In short, the CEO perspective was consistent with what we already knew. That is, they view security as an operating necessity, not as a business opportunity or marketplace advantage. The following are a few of the comments these leaders made when asked to explain, in their own words, the value proposition of security:

• Security is all about preventing bad behavior from affecting our organization.


• The only value of security is the prevention or fast detection of a breach or violation.


• There is no real value in becoming the industry leader or exemplar for security.


• Too much security and a control orientation will prevent our organization from taking justifiable risks.


• Most security technologies don't work and are a waste of time and resources for our company.


• Security spending is a pure cost of compliance.


• Security is best handled as a middle management responsibility.


• Most security problems occur because of sloppy internal procedures rather than poor IT controls and safeguards.