A global Ernst & Young survey of 1,200 information security professionals from 350 organisations in 48 countries has identified five key security priorities that are critical to business success. The survey Achieving success in a globalised world – Is your way secure?, highlighted the issue of privacy and personal data protection as an increasing concern for businesses.

The survey also confirms that more businesses are recognising Information Security as a driver of business improvement, but that companies still need to do more to improve their information security position in the globalised business environment; where the largest opportunities also carry the greatest risks.

Paul van Kessel, Global Leader of Ernst & Young’s Technology and Security Risk Services, said, “Among the most notable priorities is privacy and personal data protection, which is the one information security issue most consumer driven. It has become a high-stakes business issue, catapulted up the board agenda by consumer concerns, caused by well publicised lapses of security and the growing response of government and legislative activism. Understandably it is the area where companies are being most active, with privacy and data protection practices becoming increasingly more formalised.”

He continued, “We have identified five major information security priorities in which companies are showing significant progress, but also where continuous improvements are necessary to keep pace with the growing requirements of effective risk management.”

The five priorities are:

Integrating information security with the organisation: embedding information security into the mainstream of the business with increased visibility and resources.

 
Extending the impact of compliance: shifting attitudes from compliance as a distraction to being an enabler, bringing advances in risk-based security for organisations.

 
Managing the risk of third party relationships: recognising the challenges, issues and actions needed to manage the risks with global suppliers and outsourced partners. 
Focusing on privacy and personal data protection: taking a proactive and comprehensive approach to mitigating the risks related to privacy and personal data protection.

 
Designing and building information security: using externally imposed compliance deadlines and security incidents as a catalyst for proactive investments in stronger capabilities and defences.

Commenting on the information security environment in Ireland Pat Moran, Partner, Risk Advisory Services, Ernst & Young in Dublin added: “The 2006 survey, which contains a specific report based on Irish participants, demonstrates real progress in information security.  Largely driven from compliance and Director responsibilities, I have personally observed significant corporate programs to improve the level of information security controls and IT governance.  The real trick now for organisations is to convert this mammoth compliance effort to quickly enable business ventures and investments happen in a secure and controlled way”.

Further Survey Findings

43% of respondents, compared with 40% in 2005, say information security is integrated with their organisations’ risk management programs and processes.
This year’s survey suggests that companies’ information security policies, roles and responsibilities are not only reasonably well-developed, but are also more clearly and effectively communicated and understood by employees.
Increasingly information security outsourcing is a topic for discussion of corporate outsourcing and is being driven in part by the limited availability of experienced and well-trained security practitioners.
More than half of survey participants confirm that their compliance work is part of an integrated organisation-wide compliance effort and risk management framework.
Over the next year, after working on compliance and privacy, more survey participants say they will be working proactively to help their organisations meet global business objectives.
Nearly 80% of survey respondents have identified and prioritised critical business processes as part of their business continuity plans; three quarters of them have undertaken an IT risk assessment in developing their plans.
Nearly half of information security executives say they have adopted or plan to adopt an information security standard.

Further concerns

More than half of survey participants have yet to take steps to integrate information risk management into their overall risk management activities.
Over 40% of survey participants indicate they are not reporting about information security issues to their board of directors and business unit leaders on a regular basis.
Only half of organisations have their information security function proactively involved in achieving regulatory compliance.
Information security is least proactive today when addressing new technologies.
One-third of survey respondents say disaster recovery timescales have not been agreed to with the business, only half of business continuity plans have been tested,  just over half of organisations have agreed on escalation procedures in response to a disaster, and less than half have developed an internal and external communication strategy for business continuity.