Gartner: key to security not more money but better management

gallery

Organisations that do not sufficiently protect their customers from loss of data are likely to face increasing financial penalties, analyst firm Gartner has warned.

The cost of a data breach to a company may rise by as much as 20 per cent this year and next, it has predicted.

But other research carried out by Gartner suggests that as much as 90 per cent of attacks designed to screw money out of companies could be avoided without an increase in security expenditure. This can be achieved mainly through better management and monitoring of security vulnerabilities as well as introducing identity and access management features to IT systems.

The problem that security managers face is less from mass external attacks than targeted attacks like phishing and identity-theft based penetration, suggests the company. Investments in intrusion prevention, vulnerability management and network access control have paid off when it comes to beating off the majority of viral and trojan attacks, but it is intrusions based on "legitimate" user identity is now the main threat.

"The biggest attack risk to organisations comes from targeted attacks," said John Pescatore, vice president and distinguished analyst for Gartner. "Being aware of 'inside out' communications and being able to block those as effectively as 'outside in' is becoming increasingly important. Security strategies must reduce the cost of dealing with mass attacks to free up investment and personnel resources to evolve capabilities for dealing with these more-complex targeted attacks."

The key is not spending more money but better management of resource, says Gartner, highlighting the fact that it sees no clear link between organisations that spend the most on security and organisations that are the most secure.

"The key is to identify major technology changes and start taking steps to reduce the cost of dealing with today's mature threats - viruses, worms and denial-of-service attacks - to free up funding and manpower to influence the new systems and business processes that are being built today and that will bring on the next generation of threats," said Pescatore.

Email to a friend

Print this page