What your CEO thinks about security (and how to change it)
Computerworld -
Up to now, enterprises' security budgets have been so lean they could almost be considered anorexic. That's because CEOs have considered security as necessary but haven't bought the argument that there is an economic advantage to going above a minimal level of security. Unfortunately, CEOs have persisted in focusing on four basic questions that too often stump the most savvy IT professionals:
- What is the security return on investment?
- What is the probability of a catastrophic security failure?
- What is the cost of self-insuring against security risks?
- What are the tangible benefits of being an industry leader for security?
To help IT professionals talk to CEOs about security issues, a newly formed think tank called the Security Leadership Institute, sponsored by Unisys Corp., has conducted in-depth interviews with CEOs and board members. Board members of the institute (including myself) -- all recognized security experts from business and government -- interviewed more than 25 CEOs and public-sector agency chiefs, focusing on what they think the value proposition of security is to their enterprise. We believe that the results from our work will help IT professionals make the case for the many benefits that can be realized from a more robust investment in security.
What We Learned
Most CEOs interviewed in our study viewed both physical and information security as purely tactical, rather than as a strategic imperative. In their minds, security means either protection of assets or prevention of IT-related risks, such as hacking attacks and other cybercrime. Some CEOs viewed security as an element of a larger business risk-management process. In almost all cases, though, CEOs in the private and public sectors didn't embrace security as something directly related to corporate mission or strategy.
In short, the CEO perspective was consistent with what we already knew. That is, they view security as an operating necessity, not as a business opportunity or marketplace advantage. The following are a few of the comments these leaders made when asked to explain, in their own words, the value proposition of security:
- Security is all about preventing bad behavior from affecting our organization.
- The only value of security is the prevention or fast detection of a breach or violation.
- There is no real value in becoming the industry leader or exemplar for security.
- Too much security and a control orientation will prevent our organization from taking justifiable risks.
- Most security technologies don't work and are a waste of time and resources for our company.
- Security spending is a pure cost of compliance.
- Security is best handled as a middle management responsibility.
- Most security problems occur because of sloppy internal procedures rather than poor IT controls and safeguards.
Security
Additional Resources



White Papers & Webcasts
The State of PCI DSS Compliance at Organizations Today
Download this resource today!
Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...
Can Heuristic Technology Help Your Company Fight Viruses?
What is Heuristic Technology and how can it help safeguard your business against viruses? Learn more.
Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.
Why Email Must Operate 24/7 and How to Make This Happen
Learn how to avoid an email outage by implementing a hosted email continuity solution.
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
Eradicate Spam & Gain 100% Asurance of Clean Mailboxes
Get this paper now!
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
Mastering eDiscovery: The IT Manager's Guide to Preservation, Protection & Production
Get this paper now!
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...
