News
Survey: IT Struggling Over Security, Compliance Issues
IT pros are having a hard time balancing security, software patch management and IT auditing with a host of other duties, says a Shavlik Technologies survey.
IT pros are having a hard time balancing security, software patch management
and IT auditing with a host of other duties, according to a survey released
Monday by
Shavlik Technologies.
The St. Paul, Minn.-based security consultancy gathered its findings from attendees
at the recent RSA
Conference and Infosecurity
Europe events, both in April.
In summary, the group found that the No. 1 difficulty among IT pros was finding
an all-encompassing approach to tackle vulnerabilities, protect data and meet
compliance objectives -- all while doing that pesky thing: their actual jobs.
"[What we've found is] despite efforts to apply various technologies,
companies continue to struggle with efforts to manage and close vulnerability
gaps, while concerns over regulatory compliance are driving them to look for
more ways to simplify through automation," wrote Mark Shavlik, founder
and chief executive of Shavlik, in an e-mail to Redmondmag.com on Monday.
Mark Shavlik added that generally speaking, "organizations struggle to
manage their security and compliance needs which leaves them open to attack
or the discovery of a weak link by an auditor."
The company said that its survey of 491 IT pros -- which comprised attendees
of both the San Francisco and London meetings -- identified the following as
the top three priorities:
- Data protection, integrity and information leakage prevention garnered the
vote of 53.2 percent of respondents.
- "Internal network security" considerations were the second-most
visible priority, with 51.8 percent of respondents.
- In third place were internal IT policy and procedure alignments and regulatory
concerns -- the bane of many systems or security administrators' existence
-- such as Sarbanes-Oxley,
HIPAA, PCI
DSS and others. This clocked in at 43.8 percent.
Rounding out the other issues deemed "significant" were patch management,
something IT pros in the Windows enterprise space will have to deal with on
Tuesday, and the fortitude of programs and applications housed on virtual
machines.
Chris Fox, an IT audit expert with the consulting firm eDelta who is currently
working on a project that maps the COSO internal control frameworks to various
IT enterprise risk scenarios, said such concerns should be measured by the size
of one's business and the complexity of a given processing environment. He said
material risks are easier to identify at smaller businesses than at large ones
because larger companies typically have intricate networks of systems, processes,
control environments and organizational charts of process owners and management.
"In some IT shops, you've got one person manning a computer, and that
person is maybe a sales person in his spare time," Fox said. "The
same goes for a programmer who is also a developer, who is also a systems administrator.
If that's the case, it shouldn't be a headache for you if you can demonstrate
ways to mitigate clear risks."
About the Author
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.