Organizations anticipatesecurity breaches, believe they are less effective at process controls,and demonstrate misalignment within their own internal IT organizationregarding risk perception
CUPERTINO, Calif. – Feb. 5, 2007 – Symantec Corp. (NASDAQ: SYMC)today released the Symantec IT Risk Management Report, highlightingthat 60 percent of respondents expect at least one major IT incidentper year that could halt or disrupt a critical part of the business.The Symantec IT Risk Management Report, a new report aimed at helpingexecutives and IT operational personnel understand the criticalelements involved in an effective IT risk management strategy, is basedon input from quantitative and qualitative survey research conductedover a twelve month period ending October 2006. Symantec collectedinformation from more than 500 respondents from IT managers to top ITexecutives in organizations with worldwide operations, in a widerepresentation of industry segments.
“The ING Renault F1 Team's IT infrastructure is critical to ourrelationships with customers and partners and therefore, we arecommitted to managing IT risk as part of our larger business strategy,”said Graeme Hackland, IT manager, ING Renault FI Team. "In today’senvironment, understanding our exact risk profile and how we can betterprioritize our resources to ensure an effective IT risk strategy is topof mind.”
Organizations Anticipate Security Breaches, Incidents
The Symantec IT Risk Management Report survey data indicated that amajority of respondents expect to be impacted by some type of securityor compliance incident in the next one to five years. Specifically, 66percent of respondents expect a major regulatory incident at least onceevery five years. Additionally, 58 percent of respondents expect amajor data loss caused by events such as data center outage, corruptionof data, or breach of security systems, at least once every five years.
Deployment of Process Controls Falls Behind Technology Controls
Effective IT risk management requires a strong combination of expertiseand investment in process controls and technology controls. The mosteffective IT risk management programs use defined controls that combinewell-chosen technologies and best-practice processes. The Symantec ITRisk Management Report revealed that professionals surveyed at alllevels of organizations, across industries, scale, and geographicreach, view their organizations’ capabilities with technology controlsas more effective than with process controls.
The report findings indicated that authentication, authorization, andaccess was the process control rated highest for effectiveness, with 68percent of respondents rating their organization more than 75 percenteffective. The report also underlined a specific process controlproblem in identifying, classifying and managing IT assets. Only 38percent of respondents rated themselves more than 75 percent effectivein implementing asset inventory, classification and management processcontrols. These controls are of fundamental importance in building anIT risk management program which reflects the organization’spriorities. Without careful risk assessment, all assets are likely tobe treated equally, where some may be overprotected and others underprotected.
“Organizations are beginning to see the value in taking a proactive,rather than reactive approach to their IT risk management strategy,said Jon Oltsik, senior analyst at Enterprise Strategy Group.“Effective IT risk management requires organizations to assess boththeir technology and processes, as well as have clear understanding andagreement about different risks that may impact their systems, andtheir overall business.”
Misalignment Exists Within Internal IT Organizational Roles RegardingPerception of Risk The Symantec IT Risk Management Report revealed anoticeable difference in the way IT staff and IT executives view theirorganization’s IT risk exposure, particularly around perceived riskrelated to both business process and compliance risk. For example, 8percent of IT executives rate business process risk as critical totheir IT operations compared to 22 percent of IT directors, and 23percent of IT executives rate compliance risk as critical to their IToperations compared to 16 percent of IT directors.
Symantec believes that strong alignment between all areas of IT and thebusiness must exist in order for IT risk management investments to besuccessful. These differing internal IT viewpoints could even createrisk by producing poor coordination with the larger business. This mayresult in over- or under- investment in controls, leading to wastedresources and ineffective IT risk management programs. “Asorganizations are growing more and more dependent on their IT systemsto conduct business, IT risk has become a primary concern for businessleaders, and one that should be addressed as part of a larger businessrisk management strategy” said Greg Hughes, executive vice president,Symantec Global Services. “The Symantec IT Risk Management Reportoffers organizations a comprehensive view of IT risk perceived byvarious organizations worldwide.”
Holistic Approach to IT Risk Management Yielded Fewer Incidents
Data from the Symantec IT Risk Management Report identified a trendrelated to Best-in-Class organizations. In this report, Symantecdefines Best-in-Class organizations as the top 25 percent ofrespondents who rated their effectiveness in implementing 16 controlareas. These organizations experience higher levels of compliance andbusiness process risk, but lower levels of IT incidents. A detailedanalysis revealed that Best-in-Class organizations perform with higheffectiveness across a variety of controls, including process controls,creating a holistic approach. The data also indicated thatlower-performing organizations typically focus on a small number ofmore tactical technology controls rather than implementing a broadrange of control areas.
The Symantec IT Risk Management Report provides organizations with thebenchmarks and recommendations that they need to evaluate theeffectiveness of their own IT Risk Management strategy.
The Symantec IT Risk Management Report is available on Symantec’s Web site at www.symantec.com.
About Symantec
Symantec is a global leader in infrastructure software, enablingbusinesses and consumers to have confidence in a connected world. Thecompany helps customers protect their infrastructure, information, andinteractions by delivering software and services that address risks tosecurity, availability, compliance, and performance. Headquartered inCupertino, Calif., Symantec has operations in 40 countries. Moreinformation is available at www.symantec.com.
NOTE TO EDITORS: If you would like additional information onSymantec Corporation and its products, please visit the Symantec NewsRoom at http://www.symantec.com/news. All prices noted are in U.S. dollars and are valid only in the United States.
Symantec and the Symantec Logo are trademarks or registeredtrademarks of Symantec Corporation or its affiliates in the U.S. andother countries. Other names may be trademarks of their respectiveowners.
[ 本帖最后由 mamigo 于 2007-6-24 09:02 编辑 ] |
楼主: mamigo
楼主