There's a groundswell of frustration about today's endpoint security, as well as worries about how newer technologies such as virtualisation or cloud computing will impact it, according to a new study.
The Ponemon survey of 1,427 professionals in IT security and 1,582 in IT operations, working in business or government who live in the United States, the United Kingdom, Australia, New Zealand or Germany, were asked how they managed endpoint security, how things were going with the budget and security policies, and even whether the IT security and operations divisions worked well together.
The result of the Ponemon survey, titled "State of the Endpoint," paints a picture of discontent — though respondents in Germany were the most upbeat, expressing views that they were executing well on policies and their IT security budgets were holding up.
"The Germans are much more structured in their thinking about these issues, such as collaboration and policy," says Dr Larry Ponemon, chairman of Ponemon Institute, which conducted the study with sponsorship from Lumension. "They have the highest regard for policies.”
Seventy-seven percent of the respondents in Germany said they thought their network was more secure than a year ago, while only 44 percent in the United States, 42 percent in Australia and New Zealand, and 57 percent in the United Kingdom felt that way. When asked if the organisation's IT security budget supported business objectives, 51 percent in Germany said it did, but only 43 percent in Australia and New Zealand, 31 percent in the United Kingdom and a mere 27 percent in the United States answered yes.
Overall, 49 percent said "data security is not a strategic initiative" for their companies, and 56 percent believe "mobile devices are not secure." Forty-four percent said their organisations subsidise or plan to subsidise employees' mobile devices, 40 percent say employees can connect their devices to the company network and 26 percent have policies permitting employees to connect their own devices to the company network.
There was a widely noted disconnect between how well the IT security and operations people work together on security-related projects, plus frustration about the level of involvement of the CIO. Seventeen percent of all respondents described the collaboration between the IT and security operations as "excellent," 52 percent said it "could be improved" and 31 percent said it was "poor."
Ponemon said IT operations people tend to have a "git 'er done" attitude while security people more often will want to hold back as they contemplate the impact of new IT undertakings on risk.
He also noted that US respondents view technology as "the main driver for confidence in the security infrastructure" and are eager buyers. However, he added that putting several different point solutions in place can make the IT operations people "upset."
The five most important features for managing endpoint security identified in the survey were: antivirus and antimalware; whole disk encryption; application control; patch and remediation management; and IT asset management.
In terms of what the survey's respondents said about technology use today, they reported an average of 3.7 software agents installed on each endpoint for purposes of managing security, and 3.9 software management consoles to deal with. Some 83 percent of the survey's respondents said that within the next 12 to 24 months they intend to have an "integrated endpoint security suite"that would include functions such as vulnerability assessment, data-loss prevention, antivirus/antimalware and other capabilities.
The things that the IT security and operations people are worrying about appear to include increasing use of technologies that involve open source, Web 2.0 applications, cloud computing and virtualisation, plus mobile computing.