Traditional Approaches to Information Security Are No Longer Sufficient

It is clear that the threats to information security have grown dramatically in scope and sophistication—and that most companies are not keeping pace. New research from Accenture, in collaboration with the Ponemon Institute, reveals the true state of corporate security readiness, and identifies five principles that can help companies achieve high performance in information security.

Learn more about Accenture’s Security Capabilities

The threat to the digital assets of governments and enterprises worldwide has grown in scope and sophistication over the past five years. The cyber attacks’ principal mission, according to General Keith Alexander, commander of the US Cyber Command and director of the US Security Agency, has moved beyond stealing sensitive and valuable information, or disrupting computer operations, to actually destroying large-scale systems and other physical equipment.

It also appears that these attacks are becoming more successful.

In collaboration with the Ponemon Institute, Accenture recently conducted a comprehensive global study to find out whether companies are up to the challenge of protecting their organizations against the growing security threats. The study was designed to determine the current state of information security strategy and posture (which we define as an enterprise’s ability to solve and resolve vulnerabilities) among mid and large-size companies in 12 countries, and included a survey of 1,894 IT and non-IT practitioners around the world.

• Information security, in many organizations, is flying blind—with either no strategy or with one that does not effectively defend the organization against possible threats.

• Information security often is not integrated with IT operations and business strategy.

• Information security strategies and business goals are often at odds.

• Many organizations don’t understand their risk profile.

• Preventing malicious or criminal attacks is not the top priority for the information security function.

• As the threat landscape continually evolves, companies find themselves overwhelmed by determining how to defend themselves.

• Many respondents said their organizations do not have the budget and the expertise to meet their IT security mission.

• An information security strategy based on compliance does not definitively improve a company’s information security posture.

• New technologies are changing the threat landscape, but many companies are not actively addressing the impact.

While these findings show that companies are on average struggling to put in place the right strategies and capabilities to protect their digital assets, Accenture identified a minority of some 12 percent of the total sample that appears to be doing a much better job.

Accenture developed a diagnostic to evaluate the sophistication and effectiveness of all participating companies’ information security capabilities. Using this diagnostic, we characterized information security leaders as those that employ the following industry-leading practices:

• Develop a superior information security posture that is characterized as proactive.

• Align security and business strategies.

• Use formal methods to assess or evaluate various aspects of the security posture.

• Devote sufficient resources to security functions.

• Coordinate security operations with other areas of business.

• Create an effective security strategy that is updated regularly.

Overall, the study found that these leaders experienced not only a lower incident of serious attacks on their digital infrastructure in the past year, but also a lower incident of breaches in the same time period than other companies in our study.

Based on our study findings—and particularly on what security leaders are doing—we have identified five key principles that can help companies achieve high performance in information security:

• Security is not an IT issue, but an organization-wide concern.

• A formal security strategy, tightly aligned with the overall business strategy and updated regularly, is the foundation of a strong security posture.

• The primary focus of the security organization should not be meeting compliance obligations.

• Effective security requires sufficient resources.

• The best defense is a good offense.

Contact us to learn how Accenture can help your organization develop an effective information security strategy that drives high performance.