IT Struggling Over Security, Compliance

IT pros are having a hard time balancing security, software patch management and IT auditing with a host of other duties, according to a survey released Monday by Shavlik Technologies.

The St. Paul, MN-based security consultancy gathered its findings from attendees at the recent RSA Conference and Infosecurity Europe events, both in April.

In summary, the group found that the No. 1 difficulty among IT pros was finding an all-encompassing approach to tackle vulnerabilities, protect data and meet compliance objectives--all while doing that pesky thing: their actual jobs.

"[What we've found is] despite efforts to apply various technologies, companies continue to struggle with efforts to manage and close vulnerability gaps, while concerns over regulatory compliance are driving them to look for more ways to simplify through automation," wrote Mark Shavlik, founder and chief executive of Shavlik, in an e-mail Monday.

Mark Shavlik added that, generally speaking, "organizations struggle to manage their security and compliance needs which leaves them open to attack or the discovery of a weak link by an auditor."

The company said that its survey of 491 IT pros, which comprised attendees of both the San Francisco and London meetings, identified the following as the top three priorities:

  • Data protection, integrity and information leakage prevention garnered the vote of 53.2 percent of respondents.

  • "Internal network security" considerations were the second-most visible priority, with 51.8 percent of respondents.

  • In third place were internal IT policy and procedure alignments and regulatory concerns -- the bane of many systems or security administrators' existence--such as Sarbanes-Oxley, HIPAA, PCI DSS and others. This clocked in at 43.8 percent.

Rounding out the other issues deemed "significant" were patch management, something IT pros in the Windows Enterprise space will have to deal with Tuesday, and the fortitude of programs and applications housed on virtual machines.

Chris Fox, an IT audit expert with the consulting firm eDelta who is currently working on a project that maps the COSO internal control frameworks to various IT enterprise risk scenarios, said such concerns should be measured by the size of one's business and the complexity of a given processing environment. He said material risks are easier to identify at smaller businesses than at large ones because larger companies typically have intricate networks of systems, processes, control environments and organizational charts of process owners and management.

"In some IT shops, you've got one person manning a computer, and that person is maybe a sales person in his spare time," Fox said. "The same goes for a programmer who is also a developer, who is also a systems administrator. If that's the case, it shouldn't be a headache for you if you can demonstrate ways to mitigate clear risks."

About the Author

Jabulani Leffall is a business consultant and an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others. He consulted for Deloitte & Touche LLP and was a business and world affairs commentator on ABC and CNN.

Featured

  • Training the Next Generation of Space Cybersecurity Experts

    CT asked Scott Shackelford, Indiana University professor of law and director of the Ostrom Workshop Program on Cybersecurity and Internet Governance, about the possible emergence of space cybersecurity as a separate field that would support changing practices and foster future space cybersecurity leaders.

  • modern college building with circuit and brain motifs

    Anthropic Launches Claude for Education

    Anthropic has announced a version of its Claude AI assistant tailored for higher education institutions. Claude for Education "gives academic institutions secure, reliable AI access for their entire community," the company said, to enable colleges and universities to develop and implement AI-enabled approaches across teaching, learning, and administration.

  • AI microchip, a cybersecurity shield with a lock, a dollar coin, and a laptop with financial graphs connected by dotted lines

    Survey: Generative AI Surpasses Cybersecurity in 2025 Tech Budgets

    Global IT leaders are placing bigger bets on generative artificial intelligence than cybersecurity in 2025, according to new research by Amazon Web Services (AWS).

  • university building surrounded by icons for AI, checklists, and data governance

    Improving AI Governance for Stronger University Compliance and Innovation

    AI can generate valuable insights for higher education institutions and it can be used to enhance the teaching process itself. The caveat is that this can only be achieved when universities adopt a strategic and proactive set of data and process management policies for their use of AI.