Newsletter Sign-Up

Receive the latest technology news and information.

What your CEO thinks about security (and how to change it)

By Larry Ponemon

October 20, 2004 12:00 PM ET

Computerworld - Up to now, enterprises' security budgets have been so lean they could almost be considered anorexic. That's because CEOs have considered security as necessary but haven't bought the argument that there is an economic advantage to going above a minimal level of security. Unfortunately, CEOs have persisted in focusing on four basic questions that too often stump the most savvy IT professionals:

What is the security return on investment?

What is the probability of a catastrophic security failure?

What is the cost of self-insuring against security risks?

What are the tangible benefits of being an industry leader for security?

To help IT professionals talk to CEOs about security issues, a newly formed think tank called the Security Leadership Institute, sponsored by Unisys Corp., has conducted in-depth interviews with CEOs and board members. Board members of the institute (including myself) -- all recognized security experts from business and government -- interviewed more than 25 CEOs and public-sector agency chiefs, focusing on what they think the value proposition of security is to their enterprise. We believe that the results from our work will help IT professionals make the case for the many benefits that can be realized from a more robust investment in security.
What We Learned
Most CEOs interviewed in our study viewed both physical and information security as purely tactical, rather than as a strategic imperative. In their minds, security means either protection of assets or prevention of IT-related risks, such as hacking attacks and other cybercrime. Some CEOs viewed security as an element of a larger business risk-management process. In almost all cases, though, CEOs in the private and public sectors didn't embrace security as something directly related to corporate mission or strategy.
In short, the CEO perspective was consistent with what we already knew. That is, they view security as an operating necessity, not as a business opportunity or marketplace advantage. The following are a few of the comments these leaders made when asked to explain, in their own words, the value proposition of security:

Security is all about preventing bad behavior from affecting our organization.

The only value of security is the prevention or fast detection of a breach or violation.

There is no real value in becoming the industry leader or exemplar for security.

Too much security and a control orientation will prevent our organization from taking justifiable risks.

Most security technologies don't work and are a waste of time and resources for our company.

Security spending is a pure cost of compliance.

Security is best handled as a middle management responsibility.

Most security problems occur because of sloppy internal procedures rather than poor IT controls and safeguards.

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Jump to comments

Security

Additional Resources

WHITE PAPER

Do You Know the 7 Steps to Successful Data Migration?

Approximately 60 percent of data migration projects overrun time or budget, while some fail completely. Download this white paper, "Enhancing Your Chance for Successful Data Migration," to learn the critical steps you need to take to execute a data migration project with minimum cost and risk to your business.

WHITE PAPER

Total Cost of Ownership of Server Computing Vs. PCs

Read the Gartner research note to learn why the TCO of a server-based computing deployment used to deliver all applications to users is around 50% lower than that of an unmanaged desktop deployment.

WHITE PAPER

IDC White Paper: Linux in a Global Recession

Economic downturns have a tendency to accelerate emerging technologies, boost the adoption of effective solutions, and punish solutions that are not cost competitive or that are out of synch with industry trends. This IDC White Paper presents the results of an IDC survey of 330 companies in Western Europe, Asia/Pacific and the Americas that measures the receptiveness to Linux and takes into consideration changing views driven by the disruptive economic environment that businesses face today.

White Papers & Webcasts

Informatica 9 Launch: Transform your Business. Transform your world.

LIVE Nov 10, 2009 12:00 PM ET

Architecting Business Intelligence Applications for Change: The Open Solution

LIVE Nov 12, 2009 02:00 PM ET

The State of PCI DSS Compliance at Organizations Today
Download this resource today!

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Can Heuristic Technology Help Your Company Fight Viruses?
What is Heuristic Technology and how can it help safeguard your business against viruses? Learn more.

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Why Email Must Operate 24/7 and How to Make This Happen
Learn how to avoid an email outage by implementing a hosted email continuity solution.

Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!

Eradicate Spam & Gain 100% Asurance of Clean Mailboxes
Get this paper now!

Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!

Mastering eDiscovery: The IT Manager's Guide to Preservation, Protection & Production
Get this paper now!

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

All White Papers | All Webcasts