Anyone who has ever watched The IT Crowd and who happens to actually work in IT will appreciate that it is funny because there is more than a grain of truth in it. Not only is the IT department often located out of sight in the basement, but management is often inclined to take a hands-off approach where IT voodoo is concerned. This is, sadly, still particularly true when it comes to security where a bottom up rather than top down strategy is applied. If you can call it a strategy, that is.

Unfortunately, with the number of breaches growing and the number of threats diversifying all the time, managers literally cannot afford to ignore the importance of managing the security of business information. Those security professionals at the coal face of the battle to protect business data understand this all too well. A new survey of more than 2,400 IT and security managers from 126 countries, the ISACA Top Business and Technology Issues survey, reveals that 80% of those taking part were concerned about the lack of senior management involvement when it came to setting the direction of information security policy. Top down commitment is not just preferable, it’s essential and that’s all there is to it unless the IT crowd are, broadly speaking, going to continue to fight a losing battle against the bad guys.

As Tony Noble, a member of ISACA’s Guidance and Practices Committee, says “This year’s survey shows more clearly than ever that information technology cannot be managed in a vacuum. From the growing number of government regulations to consumer privacy concerns to hacktivist attacks, enterprise IT assets are being challenged in ways that go far beyond the server room”.