Security spending cloaked in compliance

23.11.2005
While regulatory compliance is the primary driver of corporate information security projects it is a dangerous strategy that could weaken enterprise defenses, according to Ray Wagner, Gartner's information security and privacy research vice president.

Compliance has led to increased security spending, but it should be a by-product of a much broader strategy, he said.

Organizations are cloaking their pet projects in compliance to get funding. "We have reached a point where the information security budget is peaking and downward pressure will begin to emerge," he said, adding that the current spend is about 6 percent of the IT budget.

Jack Jones, chief information security officer (CISO) at Nationwide Mutual Insurance Company, said that when companies try to manage risks by using a checklist of compliance items, there is "a very real danger" of overlooking other critical security issues. "Checklists cast the world in black-and-white terms," Jones said.

Neal Wise, partner with IT security consultancy firm Assurance.com.au, warned many companies approach compliance and security as an opportunity to kill two birds with the one stone.

"Legislation is getting some companies to invest in security, but in some cases they are just doing the bare minimum and this could give those companies a false sense of security," he said.