LEADING MARKET RESEARCH FIRM UNCOVERS IT SECURITY FEARS STIFLING BUSINESS INNOVATION AT 80 PERCENT OF ORGANIZATIONS WORLDWIDE

EMC's RSA Security Division mobilizes world's top security executives to define progressive risk management strategies to reverse troubling trend

Contacts

News Summary

BEDFORD, MA. — OCTOBER 01, 2008 — RSA, The Security Division of EMC (NYSE: EMC), today released the results of two new research initiatives that explore the volatile relationship between information security and business innovation. The first survey — conducted by global market intelligence firm IDC — reveals a growing chasm between security and innovation and examines the business impact of this disconnect on leading companies around the globe. The second study, also published today, taps an elite group of security executives to define the industry’s first portfolio of advanced information risk management strategies aimed at closing this gap.

“The inextricable link between security and innovation is clear, but organizations are still really struggling with how to strike the right balance between driving new innovations to market and instituting effective IT security practices,” said RSA President Art Coviello. “Security has long been a global business issue and this research tells us it is a top priority for today’s senior management teams. There has never been a better time for companies to make the cultural, philosophical and technological shifts required to better align their security and business innovation strategies.”

IDC Survey Reveals IT Security Risk is a Significant Innovation Inhibitor

Commissioned by RSA, an IDC survey of nearly 200 top business executives and security professionals titled, “Innovation and Security: Collaborative or Combative*,” showed that the majority of organizations believe creating an environment ideal for innovation is critical to staying ahead of the competition. However, survey respondents revealed that in spite of their best intentions, IT security risk is impeding business innovation. In fact, 80 percent of those surveyed, admitted that their organizations have backed away from new innovation opportunities because of information security concerns.

IDC also found that although 80 percent of CEOs believe their security teams are being held formally accountable for their contributions to business growth and innovation, only 44 percent of security leaders believe they are being measured on their contributions to innovation. This finding points to a surprising lack of alignment between the expectations of C-level management and the priorities of security professionals. And while the need to link IT security strategies directly to business goals is a widely-recognized imperative, only 21 percent of respondents believe their organizations have successfully made the transition to an approach that is proactive and business-aligned, and enables rather than impedes innovation.

“Today’s businesses cannot grow in the absence of a healthy environment for the realization of new innovations,” says Chris Christiansen, Vice President, IDC. “It is evident that in spite of some good progress, the relationship between innovation and security is still very strained. The reality is that innovation and security don’t need to be competing priorities; they are in fact complementary. In the end, we believe organizations that demand early IT involvement in business innovation efforts and lay out explicit business innovation metrics for their security teams have a much better chance of advancing their overall organizational goals.”

Closing the Gap:  Security Leaders Call for a New Approach to Risk Management

RSA also today released the latest report from the Security for Business Innovation Council, which is comprised of 10 of the top minds in information security from some of the largest companies in the world. This report, “Mastering the Risk/Reward Equation: Optimizing Information Risks to Maximize Business Innovation Rewards ,” explores why legacy methods of evaluating information security risk don’t work in today’s connected world, in which any new business innovation inherently carries some level of risk to information. In this landscape, the security focus must move from solely mitigating risk to also maximizing business reward. Based on the collective best practices of these leading security executives, the report offers a blueprint for making risk/reward calculations that help drive business value, and ensure they are executed and governed for enterprise success.

“Ultimately, the biggest risk any company faces isn’t that a particular piece of information is compromised or a particular platform is disabled, it’s that the company will fail to meet customer expectations,” said Bill Boni, Corporate Vice President, Information Security and Protection, Motorola. “To achieve business advantage, companies must take calculated risks and rely on security measures that allow them to be both adaptive and responsive.”

As a critical starting point, the Council report recommends some key shifts in organizational thinking and behavior including:

1. Move the security team’s focus from “Information Security” to “Information Risk Management” to signal that the goal is to achieve an acceptable level of risk;
2. Use a cross-organizational approach to understand and formalize the enterprise’s risk appetite;
3. Build a risk assumption model to delineate where and with whom risk decision responsibilities lie; and
4. Create a repeatable, step by step process, for making risk/reward calculations for new business initiatives and ensure it is rolled out across the organization.

The Security for Business Innovation Council – Individual Experiences, Collective Insight

The Security for Business Innovation Council is comprised of 10 highly-successful Global 1000 security executives who are committed to sharing their own insights and experiences to help move information security forward at organizations worldwide.

Council members include: Anish Bhimani, Managing Director, IT Risk Management, JP Morgan Chase; Bill Boni, Corporate Vice President, Information Security and Protection, Motorola; Dave Cullinane, Vice President and CISO, eBay; Roland Cloutier, Vice President, CSO, EMC Corporation; Dr. Paul Dorey, Vice President, Digital Security and CISO, BP; Renee Guttmann, Vice President, Information Security & Privacy, Time Warner; David Kent, Vice President, Security, Genzyme; Dr. Claudia Natanson, CISO, Diageo; Craig Shumard, CISO, Cigna Corporation; and Andreas Wuchner, Head IT Risk Management, Security & Compliance, Novartis.

As enterprises attempt to look at risk management more holistically, processes for assessing information risks must be integrated into these overall risk assessment efforts. As such, this report also features contributions from Julia Allen, one of the leading researchers in the area of enterprise security and governance from CERT® at Carnegie Mellon University's Software Engineering Institute.

Today’s report is the second to be released from the Security for Business Innovation Council. The first report in the series, “The Time is Now: Making Information Security Strategic to Business Innovation,” was published earlier this year and offered seven recommendations for making information security more strategic to business innovation. “Becoming a risk vs. reward expert” was one of the key recommendations outlined in this first report, setting the stage for the in-depth findings announced today.

Those interested in learning more about the Security for Business Innovation Council reports can visit the RSA Thought Leadership website at RSA.com/securityforinnovation/ and view and download both studies.

Methodologies

The IDC survey was designed to measure the effect of IT security on business innovation. The survey results are summarized in the IDC White Paper “Innovation and Security: Collaborative or Combative,” which was released today. The survey was conducted online by IDC and the following data collection and analysis took place in Q2 2008. Survey respondents were screened for their direct involvement in IT security, and include senior management and line-of-business managers. Approximately 200 individuals were screened and qualified to complete the survey.

• 80 percent of respondent company revenues are $1B or above
• 73 percent of respondents are VP-level executives or above
• 60 percent of respondent companies have 5000 employees or more
• 73 percent of the participants were based in North America; 14 percent were drawn from the UK; two percent from India; six percent from Australia; and five percent from other countries

RSA produces each Security for Business Innovation Council report based on in-depth, one-on-one interviews with all Council members. The reports reflect the collective lessons learned, best practices and candid insights of 10 of the world’s most innovative and accomplished security leaders. Their views are offered in the spirit of advancing the achievements of the entire industry. RSA expects to release more original Council reports over the coming months.

Photos

EMC Executive
Art Coviello , Executive Vice President, EMC Corporation and President, RSA, The Security Division of EMC

Bill Boni
Corporate Vice President, Information Security and Protection, Motorola

Julia Allen
Senior Researcher, CERT, Software Engineering Institute (SEI), Carnegie Mellon University

Chris Christensen
Program Vice President, Security Products and Services

Click here for more photos

About EMC

About RSA