Less than a third of global businesses have an IT risk management program capable of addressing the risks related to the use of new technologies like cloud computing, according to a survey.
In spite of the rapid emergence of new technology, just one in ten companies consider examining new and emerging IT trends a very important activity for the information security function to perform.
A significant increase in use of external service providers and business adoption of new technologies, such as cloud computing, social networking and Web 2.0, is recognized to increase risk for 60 percent of respondents. Yet, in spite of this, less than half intend to increase annual investment in information security.
Over half of respondents state that increased workforce mobility poses a considerable challenge to the effective delivery of information security initiatives, due to widespread use of mobile computing devices. For almost two-thirds employees' level of security awareness is recognized as a considerable challenge.
Half of respondents plan to spend more over the next year on data leakage and data loss prevention -- up 7 percent from last year. To address potential new risks, 39 percent are making policy adjustments, 29 percent are implementing encryption techniques and 28 percent are implementing stronger identity and access management controls. For the first time, continuous availability of critical IT resources was identified as one of the top five risks. 23 percent of respondents are using cloud computing services, a further 15 percent plan to use within the next 12 months. For 85 percent of respondents, external certification of cloud service providers would increase trust; 43 percent state that certification should be based upon an agreed standard and 22 percent require accreditation for the certifying body.
Comment from Paul van Kessel, Ernst & Young Global IT Risk and Assurance Leader: Technology advances provide an increasingly mobile workforce with seemingly endless ways to connect and interact with colleagues, customers and clients. These advances represent a massive opportunity for IT to deliver significant benefits to the organization but new technology also means new risk. It is vital that companies not only recognize this risk, but take action to avoid it. As the mobile workforce continues to grow, so does the level of risk. In addition to implementing new technology solutions and re-engineering information flows, companies must focus on informing the workforce about risks. The delivery of effective, and regular, security awareness training is a critical success factor as companies attempt to keep pace with the changing environment.
About the survey: Ernst & Young's 2010 Global Information Security Survey was conducted between June and August 2010. Nearly 1,600 organizations in 56 countries and across all major industries participated.
Contact: http://www.ey.com
No comments:
Post a Comment