Ernst & Young's Global Information Security Survey 2006 has been released, showing positive results both globally and in SA.
Although there are encouraging trends that security is becoming more integrated into both overall risk management and company culture, the survey indicates companies need to do more to improve their information security posture in the globalised business environment.
The report polled 1 200 senior information security professionals in 48 countries, as well as benchmarked the information security practices of more than 350 organisations in 38 countries.
Justin Williams, senior manager of technology and security risk services at Ernst & Young, comments: "We have identified five major information security priorities in which companies are showing significant progress, but also where continuous improvements are necessary to keep pace with the growing requirements of effective risk management.
"Among the most notable priorities is privacy and personal data protection, which is the one information security issue that is most consumer-driven.
"It has become a high-stakes business issue, catapulted up the board agenda by consumer concerns caused by well-publicised lapses of security and the growing response of government and legislative activism.
"Understandably, it is the area where companies are being most active, with privacy and data protection practices becoming increasingly more formalised."
The five priorities Ernst & Young identified are:
* Integrating information security with the organisation.
* Extending the impact of compliance.
* Managing the risk of third-party relationships.
* Privacy and personal data protection.
* Using externally imposed compliance deadlines and security incidents as a catalyst for proactive investment.
SA ahead
Ernst & Young's parallel survey of the local market showed South African businesses are ahead of the curve in some trends.
Fifty-four percent of local companies reported information security fully integrated with overall risk management, compared with a global figure of 43%. Twenty-three percent reported requiring independent security reviews of third-party providers, considerably more than the global figure of 14%.
South African respondents also said compliance with regulation (85%), and privacy and data protection (69%) would be the top drivers in the next 12 months.
Williams says it is encouraging that 62% of South African respondents report having formal procedures in place for integrating information security with their organisation's overall risk management policy.
"Notable, too, is the fact that all respondents indicated some level of integration of information security with broader risk management policies," he says.
"Driving the surge in awareness of privacy issues is the notoriety corporations and government agencies have received from well-publicised lapses in consumer data security, combined with a significant increase in the collection and sharing of information.
"Inherent in globalisation is the risk to business information as it is more frequently and easily moved, used by companies globally and entrusted to third parties."
Share
