Executive Summary

CSO magazine's recent study found that the majority (60%) of companies surveyed have an employee dedicated to IT security. This is a fairly new position for most, with an average of two years and five months experience as head of security. While the security position is a recent addition, in most companies its creation preceded September 11 2001, signalling that IT security was a priority well before the terrorist attacks.

According to the 1,009 executives surveyed, 32% of security experts hold senior-level titles including CIO, CTO, CSO/CISO and vice president. Forty per cent of security experts listed security as their primary and singular responsibility, and 11% indicated that they were also responsible for the company's physical security. Currently, 39% of security heads report directly to the CEO, COO, CFO or other officer, while 26% report to the CIO or top IT executive.

Security executives say that electronic attacks pose the biggest concern for their company, compared to physical attacks or electronic attacks with physical consequences (eg., electronic attack of a nuclear power plant) and that current employees are a greater threat to their company's technology infrastructure than external persons and former employees. Close to one quarter (22%) of companies in our survey already have insurance to cover losses caused by cyber crime.

CSO Research Prediction

While 41% of the survey respondents are directors and managers currently, CSO magazine believes that responsibility for protecting the organisation’s information assets will be elevated to senior level and that the chief security officer title and position will become more prevalent. New privacy and security laws such as the anti-terrorism USA Patriot Act of 2001, and the Foreign Intelligence Surveillance Act will have a direct impact on business, specifically privacy issues and sharing of customer information. Organisations' security will be under greater scrutiny than in the past by regulators, legislators, auditors, business partners and customers. In addition to understanding technology and the business, the head of security must have the ability to team up with both business managers and the CIO to secure the organisation’s assets. Additionally, the head of security must set security policy and communicate the importance of such practices to senior management and the user community alike.

Key Findings

Title and Reporting Structure More than half (60%) of the 1,009 respondents to our survey reported that their company employs a person dedicated to technology. Among the companies that do not have a dedicated security person, the majority (83%) have no plans currently to hire a head of security and 14% plan to hire in 2003 or beyond.

Thirteen per cent of the 1,009 respondents were CIOs, CTOs or vice presidents of technology while 19% had the title of chief security officer, chief information security officer or VP of technology. Forty-one per cent were directors or managers of IT and slightly more than one quarter (27%) held business or military titles. When asked about their job responsibilities, 40% of the security experts surveyed said that security is their primary, singular responsibility. Sixty per cent reported that security was one of their responsibilities.

Approximately one quarter (26%) of those surveyed report directly to the CIO or head of IT and 22% report to a COO/CFO/VP or other officer. Only 17% report to the CEO or president. Fifteen per cent of the survey base report to a director and 15% listed "other."

Years Experience and Background On average, security experts have been in their current job for 2 years and 10 months. More than half (52%) were hired from outside the company while 48% were promoted from within. When asked about previous work experience, respondents most frequently included IT/IT consulting (100%), logistics/engineering/manufacturing (51%), accounting/administration (49%), FBI/Secret Service/military (30%) and security consulting (28%) in their work experience. Security experts included in our survey earn an average of $USUS105,000 annually.

Security Budget Most companies (80%) include security as part of the IT budget, but 20% maintain a separate security budget, according to the 1,009 survey respondents. On average, 9.5% of the overall IT budget is allocated to security and close to half (42%) of security budgets include physical and IT security. Survey respondents reported an average annual IT budget of $US8.4 million.

Security Threats Current employees pose the greatest threat to technology infrastructure, according to 53% of the security experts in our survey. Twenty-eight per cent said that external persons posed the greatest threat. In terms of the kinds of attacks companies were most concerned with, respondents listed electronic attacks (59%) most frequently. The majority (87%) of those surveyed monitor cyber crime attempts and close to one quarter (22%) have insurance for cyber crime losses.

When asked what effects pending security regulations will have on business, respondents were most concerned about a decrease in customer confidence regarding privacy and an inability for corporations to guarantee privacy to their customers and employees. Roughly half of the respondents believe that government, companies and their own company are better prepared to respond to a cyber attack today than before 9/11.

Methodology

CSO magazine's Security Sensor survey was administered online in July 2002. Subscribers to CSO magazine were invited to take the survey. The results shown here are based on the responses of 1,009 security professionals. When asked about title, 37% were senior-level including CIOs, CTOs, CSO/CISO and vice presidents. Forty-five per cent of respondents were director or managers. The margin of error for this study is +/- 3.1%.

In terms of company size, approximately 41% of the survey respondents worked at companies with annual revenue of $US1 billion or greater. Roughly 23% were from companies with annual revenue between $US100 million and $US999.9 million, and 36% listed revenue at less than $US100 million.

Respondents represented a wide range of industries including finance/banking (16%), local, state or federal government (16%), computer-related industries (7%) and telecommunications/electric/gas/transportation industries (6%).

Survey Questions

Does your organisation have a person dedicated to IT security, like a chief security officer?

Which title best describes your level of responsibility?

Which statement best describes your level of responsibility with regards to your organisation’s or division's security:

To whom do you report directly?

To whom does your direct manager report to directly?

How long have you held the title of CSO or equivalent head of security title?

Years as head of security:

Average years as head of security: 2 years, 5 months How long have you been in your current position?

Were you hired for your current position from outside the company or promoted from within?

In which areas do you have previous work experience? (Check all that apply.)

Is your company's security budget separate from the IT budget or a line item/part of IT budget?

If your security budget is part of the overall IT budget, please estimate the per cent of your IT budget, including for security products, systems, services and staff, that was allocated to information security in 2002:

What is your organisation’s approximate annual budget for security products, systems services and/or staff?

Does your security budget include physical and IT security?

When do you anticipate a major cyber attack by a terrorist organisation (ie., al Qaeda) will happen?

Which of the following do you believe are better prepared to respond to and recover from a cyber attack today than on September 11 2001. (Check all that apply.)

Who poses the greater threat to your company's technology infrastructure?

In general, what kinds of attacks pose the biggest concern for your company?

What do you believe is the #1 cyber security concern for the nation?

What is the monetary value of losses your company has sustained due to cyber crime in the past year?

Regarding cyber crime, does your company: (Check all that apply.)

Does your company have insurance covering losses caused by cyber crimes?

Within the next 18 months, are you planning to adopt biometrics (ie., retina-scans, fingerprint scans) for any applications at your company?

Do you think technology vendors need to tighten up the security configuration of their products?

Corporate lawyers are facing novel business issues due to new laws (ie., anti-terrorism USA Patriot Act of 2001, Foreign Intelligence Surveillance Act) impacting privacy and the sharing of customer information with the Federal Government. What do you anticipate the potential impact of these new or existing laws will be on your organisation?