Bad things happen to good customers. In the past few months, laptops containing Social Security numbers or customer information were stolen from the Veterans' Administration, Fidelity Investments, Ameriprise Financial and Ernst & Young. The theft of a file server at insurer AIG put a million customers' account data at risk. And organized criminals fraudulently withdrew money from personal accounts at several Massachusetts credit unions. Still, according to this year's CIO Insight Security Survey, IT executives remain confident in their security. Should they be?

Some of this month's survey results seem encouraging: Confidence in security technologies, most notably in antivirus software, remains high. Security spending has increased, although that's due as much to regulatory requirements as to security worries. And more respondents report their companies have an enterprisewide IT security strategy in place.

Still, there's evidence that CIOs could be overconfident. One in three companies reports a security breach in the past year, and one in four says it has been targeted by organized criminals. Management resistance and careless adherence to company security policies remain problems. And many companies still don't use encryption, or do not have policies in place for working with sensitive company data outside the office—policies that might have saved the VA, Fidelity and others a good deal of grief.

For IT security to work, companies must train and motivate personnel to consistently avoid risky behavior, build strong technical defenses that are quick to adapt to new threats, and ensure clear management support for both. What's worrisome is that too many companies aren't good at all three.

Research Guide:
Security Breaches Strike One in Three Companies

Eric Nee: Mind Your Own Business (September 2004)

Discuss September 2006 Security Survey: It Can't Happen Here—But It Does   >>> Be the FIRST to comment on this article!

>>> More Research Articles          >>> More By Allan Alter