Symantec 2010 State of Enterprise Security Study Shows Frequent,
Effective Attacks on Worldwide Business
75 Percent of Organizations Have Suffered a Cyber Attack Losing
an Average of $2 Million Annually
MOUNTAIN VIEW, CA--(Marketwire) - Symantec
Corp. (NASDAQ: SYMC)
today released
the
findings of its global 2010 State of
Enterprise Security study. The study found that 42 percent of
organizations rate security their top issue. This isn't a surprise,
considering that 75 percent of organizations experienced cyber attacks
in
the past 12 months. These attacks cost enterprise businesses an average
of
$2 million per year. Finally, organizations reported that enterprise
security is becoming more difficult due to understaffing, new IT
initiatives that intensify security issues and IT compliance issues.
The
study is based on surveys of 2,100 enterprise CIOs, CISOs and IT
managers
from 27 countries in January 2010.
"Protecting information today is more challenging than ever," said
Francis
deSouza, senior vice president, Enterprise Security, Symantec Corp. "By
putting in place a security blueprint that protects their infrastructure
and information, enforces IT policies, and manages systems more
efficiently, businesses can increase their competitive edge in today's
information-driven world."
Study Highlights:
- Security is of great concern to global enterprises. Forty-two
percent
of enterprises rank cyber risk as their top concern, more than natural
disasters, terrorism, and traditional crime combined. Reflecting that
perception, IT is intently focused on enterprise security. On average,
IT
assigns 120 staffers to security and IT compliance. Enterprises rated
"better manage business risk of IT" as a top goal for 2010, and 84
percent
rated it absolutely/somewhat important. Nearly all the enterprises
surveyed (94 percent) forecasted changes to security in 2010, with
almost
half (48 percent) expecting major changes.
- Enterprises are experiencing frequent attacks. In the past 12
months,
75 percent of enterprises experienced cyber attacks, and 36 percent
rated
the attacks somewhat/highly effective. Worse, 29 percent of enterprises
reported attacks have increased in the last 12 months.
- Every enterprise (100 percent) experienced cyber losses in 2009.
The
top three reported losses were theft of intellectual property, theft of
customer credit card information or other financial information, and
theft
of customer personally identifiable information. These losses
translated
to monetary costs 92 percent of the time. The top three costs were
productivity, revenue, and loss of customer trust. Enterprises reported
spending an average of $2 million annually to combat cyber attacks.
- Enterprise security is becoming more difficult due to a number of
factors. First, enterprise security is understaffed, with the most
impacted areas being network security (44 percent), endpoint security
(44
percent), and messaging security (39 percent). Second, enterprises are
embarking on new initiatives that make providing security more
difficult.
Initiatives that IT rated as most problematic from a security standpoint
include infrastructure-as-a-service, platform-as-a service, server
virtualization, endpoint virtualization, and software-as-a-service.
Finally, IT compliance is also a huge undertaking. The typical
enterprise
is exploring 19 separate IT standards or frameworks and is currently
employing eight of them. The top standards include ISO, HIPAA,
Sarbanes-Oxley, CIS, PCI, and ITIL.
"Abu Dhabi Commercial Bank is a good example of an organization that has
put an effective security strategy into place with an emphasis on
addressing issues proactively," continued de Souza. "The company has a
complete solution set of products and services that provide 24-hour
protection, threat monitoring and response, all for a fixed annual cost.
This approach is more cost-effective than securing a network after it
has
been compromised."
Recommendations
- Organizations need to protect their infrastructure by securing their
endpoints, messaging and Web environments. In addition, defending
critical
internal servers and implementing the ability to back up and recover
data
should be priorities. Organizations also need the visibility and
security
intelligence to respond to threats rapidly.
- IT administrators need to protect information proactively by taking
an
information-centric approach to protect both information and
interactions.
Taking a content-aware approach to protecting information is key in
knowing
where sensitive information resides, who has access, and how it is
coming
in or leaving your organization.
- Organizations need to develop and enforce IT policies and automate
their compliance processes. By prioritizing risks and defining policies
that span across all locations, customers can enforce policies through
built-in automation and workflow and not only identify threats but
remediate incidents as they occur or anticipate them before they
happen.
- Organizations need to manage systems by implementing secure
operating
environments, distributing and enforcing patch levels, automating
processes
to streamline efficiency, and monitoring and reporting on system
status.
Click
to Tweet: Study from @Symantec says cyber
attacks cost large enterprises $2 million annually. http://bit.ly/bhOwmV
Resources
About Business Solutions from Symantec
Symantec helps organizations secure and manage their information-driven
world with
IT
Compliance,
discovery
and retention management,
data
loss prevention, and
messaging
security
solutions.
About Symantec
Symantec is a global leader in providing security, storage and systems
management solutions to help consumers and organizations secure and
manage
their information-driven world. Our software and services protect
against
more risks at more points, more completely and efficiently, enabling
confidence wherever information is used or stored. More information is
available at www.symantec.com
NOTE TO EDITORS: If you would like additional information on
Symantec Corporation and its products, please visit the Symantec News
Room
at http://www.symantec.com/news.
All prices noted are in U.S. dollars and
are valid only in the United States.
Symantec and the Symantec Logo are trademarks or registered trademarks
of
Symantec Corporation or its affiliates in the U.S. and other
countries. Other names may be trademarks of their respective owners.
FORWARD-LOOKING STATEMENTS: This information is about pre-release
software.
Any unreleased update to the product or other planned modification is
subject to ongoing evaluation by Symantec and therefore subject to
change.
This information is provided without warranty of any kind, express or
implied. Customers who purchase Symantec products should make their
purchase decision based upon features that are currently available.