Security Tools Not Enough, Say Execs

After what seemed forever, the execs are finally realising that security is more than about products.

"Installing more technology doesn't solve the entire problem of protecting corporate data", users said in the wake of recent security incidents at Polo Ralph Lauren and other companies. "User awareness, training and risk-mitigation efforts are also vital", they noted.

"Technological breakdowns are rarely the source of the breach," said Tim O'Pry, chief technology officer at The Henssler Financial Group in Marietta, Ga. "More often than not, it's good old-fashioned human frailties."

Addressing that issue often requires companies to increase their investments in user awareness, training and education, said Matt Kesner, CTO at Fenwick & West LLP, a law firm in Mountain View, Calif. Security managers "pay lip service to the issue but don't do a good job of training our users and employees," Kesner said. "A lot of people, even in senior positions, aren't aware of the threat every time you attach a computer to the Internet."