What your CEO thinks about security (and how to change it)

By Larry Ponemon

October 20, 2004 12:00 PM ET

Computerworld - Up to now, enterprises' security budgets have been so lean they could almost be considered anorexic. That's because CEOs have considered security as necessary but haven't bought the argument that there is an economic advantage to going above a minimal level of security. Unfortunately, CEOs have persisted in focusing on four basic questions that too often stump the most savvy IT professionals:

What is the security return on investment?

What is the probability of a catastrophic security failure?

What is the cost of self-insuring against security risks?

What are the tangible benefits of being an industry leader for security?

To help IT professionals talk to CEOs about security issues, a newly formed think tank called the Security Leadership Institute, sponsored by Unisys Corp., has conducted in-depth interviews with CEOs and board members. Board members of the institute (including myself) -- all recognized security experts from business and government -- interviewed more than 25 CEOs and public-sector agency chiefs, focusing on what they think the value proposition of security is to their enterprise. We believe that the results from our work will help IT professionals make the case for the many benefits that can be realized from a more robust investment in security.
What We Learned
Most CEOs interviewed in our study viewed both physical and information security as purely tactical, rather than as a strategic imperative. In their minds, security means either protection of assets or prevention of IT-related risks, such as hacking attacks and other cybercrime. Some CEOs viewed security as an element of a larger business risk-management process. In almost all cases, though, CEOs in the private and public sectors didn't embrace security as something directly related to corporate mission or strategy.
In short, the CEO perspective was consistent with what we already knew. That is, they view security as an operating necessity, not as a business opportunity or marketplace advantage. The following are a few of the comments these leaders made when asked to explain, in their own words, the value proposition of security:

Security is all about preventing bad behavior from affecting our organization.

The only value of security is the prevention or fast detection of a breach or violation.

There is no real value in becoming the industry leader or exemplar for security.

Too much security and a control orientation will prevent our organization from taking justifiable risks.

Most security technologies don't work and are a waste of time and resources for our company.

Security spending is a pure cost of compliance.

Security is best handled as a middle management responsibility.

Most security problems occur because of sloppy internal procedures rather than poor IT controls and safeguards.

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Centralized Data Backup and Your WAN
Is your organization prepared to tackle the massive challenge of protecting your data in a cost effective and timely manner? With a growing...

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

An All-in-One Approach to Web Security
Granting web access to employees poses challenges to IT administrators and introduces unique security risks. Even as companies have perfected their security techniques...

Best Practices for Managing Business Risks from the Use of IT
(Source: Symantec) Based on exhaustive benchmarks conducted by the IT Policy Compliance, this session highlights the relationship between business risks and use of...

The Hidden Dangers of Spam
Beyond the well-understood productivity drain that spam inflicts on businesses, threats posed by illicit email circulating through a network are causing many security...

Managing And Protecting Your Ever Increasing Mobile Assets
(Source: Absolute Software) Your users are becoming more mobile each day. This is great for productivity - yet challenging for IT control. Natalie...

Open Source Security Myths Dispelled
(Source: Astaro) Open Source Software is computer software whose source code is available to the general public. This openly viewable nature...

Sun OpenSSO Enterprise Webinar
(Source: Sun) This webinar replay discusses Sun OpenSSO Enterprise innovation--the single, open-source solution that helps your business solve the challenges around internal access...

Best Practices for Backing Up VMware® with Veritas NetBackup™
VMware® is used by enterprises large and small to increase the efficiency and cost-effectiveness of their IT operations. With this in mind, Symantec...

Agile Enterprise Content Management (ECM) for Rapid ROI
(Source: IBM) Content rich business processes are a core feature of daily operations at just about any organization today. Very often these essential...

All White Papers | All Webcasts