Security: Lots more work to do

A panel of security experts at the RSA Conference last week said businesses still overlook fundamental security questions when buying or building software.

That’s critical because Gartner estimates that 70% of security vulnerabilities are at the application layer (see our coverage of the panel).

A survey by the Secure Software Forum, which pulled together the panel for the conference, shows that although companies are beginning to develop secure coding programs, only 27% have integrated security into their development processes.

Because perimeter security can only do so much, this software vulnerability may be responsible for the recent uptick in unauthorized use of computer systems, as shown by the newly released 10th annual “Computer Crime and Security Survey.” The study, conducted by the Computer Security Institute (CSI) and the FBI, reports that after declining for four years, the unauthorized use of computers increased in 2005: Of the companies surveyed, 56% reported unauthorized use, up from 53% in 2004. As for the rest, 31% reported no unauthorized use, and 13% were unsure.

That survey also showed that – contrary to the popular notion that insiders are the graver threat – just about as many unauthorized incidents were perpetrated by outsiders as by insiders. Perhaps even more important, a large percentage of respondents simply don’t know where the misuse came from. When asked how many incidents came from outside, 35% said they didn’t know. Asked the same about misuse from inside, 44% said they were unsure.

The lesson, the CSI/FBI survey concludes, is that “organizations have to anticipate attacks from all quarters.”

Despite the increase in computer misuse and companies’ uncertainty about what they are battling, the CSI/FBI survey suggests that, based on spending trends, companies seem to think they are doing enough to fight back. Security spending as a percentage of IT budgets remained essentially flat in 2005 compared with 2004.

Forty-eight percent of the respondents spend 1% to 5% of their IT budget on security, 19% spend 6% to 10%, and 8% said they spend more than 10%. Remarkably, 25% said they still spend less than 1% of their IT budget on security.

The take-away is that there is a lot of work left to do.