As an outsource security partner BAI provides managed security, managed firewall, managed ids, content filtering, internet security, network security, penetration testing, and vulnerability testing.

IT directors are finding it harder than ever to justify spending on IT security to their boards, despite the dramatic growth in business expense resulting from information security exposures.

Nino Moscardini, a Gartner Consulting VP, recently told the British Computer Society’s Elite IT Directors, By 2005, politically or financially motivated attacks will account for 60% of the cost to business of security breaches.

But, David Spinks, EDS' global director of operational risk, said, "IT budgets are harder than they have ever been."

Boards will only take security proposals seriously if they can be shown to save or make money, said Spinks. He advised IT directors to present simple graphs to the board rather than reams of numbers and jargon. "Pictorial representation of risk is most powerful," he said.

Directors should be spurred on by the regulatory bodies and rating agencies which, he said, are concerned about "the track record of serious loss from inadequate controls".

GLBA for Banking and HIPPA for Healthcare; many experts predict this is just the beginning, as businesses continue to fail to adapt to the changing needs of information security. Even the basics in terms of periodic auditing, policies, and event monitoring are still not being treated as a priority when it comes to budgeting.

Consultant William List said that when seeking to convince the board about the need for IT security, managers should explain it in terms board members will listen to: warn them of the risk of bad press coverage, court action, loss of revenue, increased costs, or loss of business.

However, IT security measures count for nothing, said Peter Wood of First Base Technologies, when people can walk into an organization from the street armed with just a clipboard and pen and then go into the machine room and steal a tape. He warned of rogue cleaners who could plug a simple keyboard logger into the back of a computer and harvest it for passwords the following day.

Michael Bruck, BAI Security President & CEO, explained, “In a random sampling of one dozen information security audits performed in this past quarter, we achieved a major penetration result in 75% of those audited. We continue to see more evidence that companies worldwide and across a multitude of industry sectors are unknowingly at risk today.”

We are interested in your feedback. Let us know what your thoughts are on this subject (i.e., what advise to you have for other IT executives and managers, problems you face, etc.). Your responses will be kept confidential and represented only by statistics in a future article. feedback@baisecurity.net