Formal security policies are less commonplace in enterprise environments
than many people might think. Why are some organizations still dragging
their feet, and what might help give security administrators a boost?
In a worldwide study of more than 1,000 IT executives last year, Computer
Sciences Corp. (CSC) discovered that 46 percent do not have a formal
security policy in place; 59 percent do not have a formal compliance
program; and 68 percent do not regularly conduct risk analyses or security
status tracking.
Security specialists, of course, find statistics like these alarming. “If
organizations don’t develop and enforce security policies, they’re opening
themselves up to vulnerabilities,” maintains Richard Pethia, director of
the FBI’s National Infrastructure Protection Center (NIPC).
Other studies underscore these vulnerabilities. In its recently released
“2002 Computer Crime and Security Survey,” the Computer Security Institute
(CSI) conducted research among 853 security practitioners, mainly in large
corporations and government agencies.
A full 90 percent admitted to security breaches over the past 12 months,
and 80 percent acknowledged financial losses due to these breaches.
Frequently detected attacks and abuses included viruses (85 percent);
system penetration from the outside (40 percent); denial of service attacks
(40 percent); and employee abuses of Internet access privileges, such as
downloading pornography or pirated software, or “inappropriate use of email
systems” (78 percent).
Why, then, are some organizations putting security on the back burner?
Observers point to reasons ranging from insufficient staff resources, to
the growing complexities of cyberattacks and security solutions, to
difficulties in getting buy-in from business decision-makers.
“Most network administrators know what they should do about security. It’s
just that they don’t always have time to do it. No matter how hard they
run, they’re still just ‘running in place,'” says Guy Copeland, VP, Federal
Sector, for CSC.
Clearly, policy tools abound these days, running the gamut from books and
online templates to software programs. Still, though, some administrators
do struggle over the basics.
“I have been left with the responsibility of writing up our Internet
Security Policy. I suck at writing policies, and I have no clue as to what
to do. Can anyone e-mail me or post an all compiled security policy that
they may have? I need something to go by that I can modify to fit our
purpose,” writes one stymied administrator, in an Internet newsgroup
posting.
Incident reports to the FBI’s NPIC prove that cyberattacks are rising in
sophistication, as well as in sheer numbers, according to Pethia.
Meanwhile, security solutions are getting so complicated that analyst firms
are issuing entire reports dedicated to policies around specific
technologies. Take, for example, application-specific access rights. IDC
offers a report called “Managing Access Rights Efficiently: Policy-Based
Provisioning.”
“Web-based applications are proliferating. End users, ‘outside’ suppliers,
customers, and partners all expect to access back-office data and
applications, such as order status and supplies availability. The old rule
of ’employees’ versus ‘outsiders’ breaks down as different users expect
different levels of access to different types of data,” according to the
report.
Getting business buy-in can be a big headache, too. “Recognition of
security problems tends to ‘stay low’ in an organization. Often,
information only trickles up to CIOs in bits and pieces,” Pethia notes.
“Gaining executive management buy-in for an information security policy
requires understanding corporate procedures, creating a review board,
ensuring that the policy implications are understood, and providing
updates,” according to a Gartner Group report.
Yet many business decision-makers have traditionally looked at security as
“nice to have,” rather than essential, says Ron Knode, CSC’s global
director for managed security services. Business managers’ perceptions
don’t change till “something goes wrong,” according to Knode.
At this point, many observers are hoping for a quick uptick in policy
activities. Federal government officials are among them. In “Security in
the Information Age,” a 130-page federal report issued last month, security
specialists contend that government needs to induce industry to be more
open about security problems.
A big thrust of their argument is that private industry owns much of the
nation’s infrastructure, a major target of terrorists. “If both the private
sector and the federal government are targets, it makes sense for two
targets to share information with each other. The private sector is on the
front lines, yet has no access to government information about possible
threats. On the other hand, the federal government, which has unique
information and analytical capabilities, lacks specific information about
attacks – particularly computer attacks, occurring outside the government
but still within the United States,” writes U.S. Sen. Robert F. Bennett (R – Utah)
in the report.
In another section of that report, Mark Montgomery contends that business
and government security should rest on the same three “prongs”: policy,
technology, and people. “Silicon Valley and the Beltway, where the sandal
meets the wingtip, must stand side by side and on equal footing in
addressing these issues and formulating responses,” according to
Montgomery.
Meanwhile, on a day-to-day basis, administrators will keep trying to
stretch their resources, catch the ear of top management, and fight their
way through the snares of security.
»
See All Articles by Columnist Jacqueline Emigh
Huawei’s AI Update: Things Are Moving Faster Than We Think
FEATURE | By Rob Enderle,
December 04, 2020
Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 18, 2020
Key Trends in Chatbots and RPA
FEATURE | By Guest Author,
November 10, 2020
FEATURE | By Samuel Greengard,
November 05, 2020
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 02, 2020
How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 29, 2020
Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 23, 2020
The Super Moderator, or How IBM Project Debater Could Save Social Media
FEATURE | By Rob Enderle,
October 16, 2020
FEATURE | By Cynthia Harvey,
October 07, 2020
ARTIFICIAL INTELLIGENCE | By Guest Author,
October 05, 2020
CIOs Discuss the Promise of AI and Data Science
FEATURE | By Guest Author,
September 25, 2020
Microsoft Is Building An AI Product That Could Predict The Future
FEATURE | By Rob Enderle,
September 25, 2020
Top 10 Machine Learning Companies 2020
FEATURE | By Cynthia Harvey,
September 22, 2020
NVIDIA and ARM: Massively Changing The AI Landscape
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
September 18, 2020
Continuous Intelligence: Expert Discussion [Video and Podcast]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 14, 2020
Artificial Intelligence: Governance and Ethics [Video]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 13, 2020
IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI
FEATURE | By Rob Enderle,
September 11, 2020
Artificial Intelligence: Perception vs. Reality
FEATURE | By James Maguire,
September 09, 2020
Anticipating The Coming Wave Of AI Enhanced PCs
FEATURE | By Rob Enderle,
September 05, 2020
The Critical Nature Of IBM’s NLP (Natural Language Processing) Effort
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
August 14, 2020
Datamation is the leading industry resource for B2B data professionals and technology buyers. Datamation's focus is on providing insight into the latest trends and innovation in AI, data security, big data, and more, along with in-depth product recommendations and comparisons. More than 1.7M users gain insight and guidance from Datamation every year.
Advertise with TechnologyAdvice on Datamation and our other data and technology-focused platforms.
Advertise with Us
Property of TechnologyAdvice.
© 2025 TechnologyAdvice. All Rights Reserved
Advertiser Disclosure: Some of the products that appear on this
site are from companies from which TechnologyAdvice receives
compensation. This compensation may impact how and where products
appear on this site including, for example, the order in which
they appear. TechnologyAdvice does not include all companies
or all types of products available in the marketplace.