Network security in shaky state

Resourceful I.T. security professionals are getting the job done, but their efforts have been hampered by undersized staffs and underfunded budgets that limit choices ranging from what products they buy to the vendors they work with.

The third annual Strategic Deployment Survey conducted by Secure Enterprise, an InformationWeek sister publication, polled more than 1,500 IT-security pros about their companies' security and their tactics for dealing with challenges. Follow-up interviews provided even more details on the state of IT security.

The survey shows IT security staffing almost unchanged from last year--and, in a word, deficient. Forty-four percent of this year's respondents describe their security groups as moderately understaffed, with 21% saying they're severely understaffed. Linked to frustration about understaffing is concern that not enough IT dollars are earmarked for security. And sometimes, IT-security managers say, that translates directly to greater organizational vulnerability.

Several diverse factors influence how security managers spend the money they have based on a diverse set of drivers. The top drivers in this year's survey were improved business practices, auditing regulations, industry standards, security breaches from external sources, legislative regulations and protection of brand or corporate image. Other organizations are building an overall "culture of security." Even when a dedicated security staff exists, the job often involves educating IT and non-IT staff about security risks and needs.

Survey results also show a growing commitment to put higher-level people in charge of security. Last year, only 12% of survey respondents reported that their organizations had a chief security officer. This year, that number rose to 18%. Similarly, only 12% of last year's respondents said they had a chief information security officer; this year, that figure climbed to 22%.

Full survey results can be downloaded here .

CATEGORIES: 1survey, 1staffing, 1budgets, 1compliance, 1drivers