Half of all German enterprises do not invest sufficient time in order to secure their in-house IT systems. Quite often there is no comprehensive IT security strategy for the entire company. Furthermore, many investments in this respect are ineffective given that individual measures are not consistent so that security loopholes arise. These findings were the result of the “IT-Security 2007″ study carried out by the InformationWeek magazine.
This study also reveals that one third of IT managers and IT security experts believe that the insufficient risk awareness of managing directors is also to blame for failed investments in IT security. In two out of three companies interviewed top managers decide on how much to spend on information security. And even though fifty percent of all companies know that the IT risk management in place does often not even meet legal requirements, only few managing directors turn their attention to this issue.
After all, 69.8% of all companies have a security policy which is mainly based on the protection manual by the Federal agency for security in information technology (BSI). Nevertheless, regular checking procedures are not in place. Thus, in 32.8% of the companies interviewed the respective security guidelines are only checked for their effectiveness if required.
On the other hand, in some businesses security measures and strategies are so frequently adapted and amended, that staff are not able to adequately familiarize themselves with constantly new IT security guidelines or tools. This in turn reduces the effect of these security measures.
Also, 17.4% of the IT specialists interviewed even have the feeling that they can hardly cope with guidelines that are too often amended. A quick reaction to a changed security environment is important and good, according to the study, but only if employees are motivated enough to implement a new strategy.
533 IT managers and IT security experts from Germany took part in the “IT-Security 2007″ study. The survey was supported by the Steria Mummert Consulting company. 