Click here to receive your FREE subscription to Campus Technology
Research Focus
IT Struggling Over Security, Compliance
5/15/2008
IT pros are having a hard time balancing security, software patch management and IT auditing with a host of other duties, according to a survey released Monday by Shavlik Technologies.
The St. Paul, MN-based security consultancy gathered its findings from attendees at the recent RSA Conference and Infosecurity Europe events, both in April.
In summary, the group found that the No. 1 difficulty among IT pros was finding an all-encompassing approach to tackle vulnerabilities, protect data and meet compliance objectives--all while doing that pesky thing: their actual jobs.
"[What we've found is] despite efforts to apply various technologies, companies continue to struggle with efforts to manage and close vulnerability gaps, while concerns over regulatory compliance are driving them to look for more ways to simplify through automation," wrote Mark Shavlik, founder and chief executive of Shavlik, in an e-mail Monday.
Mark Shavlik added that, generally speaking, "organizations struggle to manage their security and compliance needs which leaves them open to attack or the discovery of a weak link by an auditor."
The company said that its survey of 491 IT pros, which comprised attendees of both the San Francisco and London meetings, identified the following as the top three priorities:
- Data protection, integrity and information leakage prevention garnered the vote of 53.2 percent of respondents.
- "Internal network security" considerations were the second-most visible priority, with 51.8 percent of respondents.
- In third place were internal IT policy and procedure alignments and regulatory concerns -- the bane of many systems or security administrators' existence--such as Sarbanes-Oxley, HIPAA, PCI DSS and others. This clocked in at 43.8 percent.
Rounding out the other issues deemed "significant" were patch management, something IT pros in the Windows Enterprise space will have to deal with Tuesday, and the fortitude of programs and applications housed on virtual machines.
Chris Fox, an IT audit expert with the consulting firm eDelta who is currently working on a project that maps the COSO internal control frameworks to various IT enterprise risk scenarios, said such concerns should be measured by the size of one's business and the complexity of a given processing environment. He said material risks are easier to identify at smaller businesses than at large ones because larger companies typically have intricate networks of systems, processes, control environments and organizational charts of process owners and management.
"In some IT shops, you've got one person manning a computer, and that person is maybe a sales person in his spare time," Fox said. "The same goes for a programmer who is also a developer, who is also a systems administrator. If that's the case, it shouldn't be a headache for you if you can demonstrate ways to mitigate clear risks."
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others. You can contact Jabulani at editor@entmag.com.
Cite this Site
copy text (above) for proper citation
Recommended Reading
- Tufts Grants Rights for Mileage-Increasing Transportation Technology to Electric Truck
Tufts University has optioned rights to a technology that can recharge the batteries of any hybrid electric and electric-powered vehicle while it is driven. The Tufts-developed technology could increase by 20 percent to 70 percent the miles per gallon or total driving range performance of vehicles like the Honda Civic, Ford Escape, and Toyota Prius hybrids and the Tesla Motors and Phoenix Motorcars electric vehicles.
- U Florida and Cyntellect Collaborate to Unlock Mysteries of Cancer Stem Cells
The University of Florida has entered into a research agreement with life sciences company Cyntellect. The university's Interdisciplinary Center for Biotechnology Research will work with the company to focus on a variety of research areas including the purification and analysis of cancer stem cells (CSCs), rare cells believed to be directly involved in propagating cancers.
- George Mason U Receives Grant To Deploy Intergraph Apps for Intelligence Curriculum
George Mason University (GMU) in Fairfax, VA has been awarded a grant from Intergraph to enable students enrolled in GMU's Geospatial Intelligence Graduate Certificate program to use the company's geospatial production and exploitation software as part of their core curriculum.
- Institute for Cyber Security at U Texas, San Antonio Opens Incubator
The University of Texas at San Antonio (UTSA) Institute for Cyber Security (ICS) has launched a new Internet security incubator. The incubator was developed to commercialize promising technologies that address major cyber security and privacy issues. The first companies to enter the incubator are Denim Labs and SafeMashups.
- ISO/IEC Publishes Office Open XML Standard
ISO/IEC has published the Office Open XML (OOXML) file format standard, formally known as ISO/IEC 29500:2008. It describes file formats originally designed by Microsoft for its Office 2007 productivity suite, which are used in presentation, spreadsheet and word processing applications.
- Dynamics NAV 2009 ERP Coming Next Month
Microsoft exec Kirill Tatarinov Wednesday described some new features to expect in the forthcoming Microsoft Dynamics NAV 2009 enterprise resource planning solution. He gave the keynote address at Microsoft's Convergence 2008 event in Copenhagen, Denmark.
