Companies demand IT security assurances

More than half of UK organisations are now required by their customers or suppliers to provide formal assurances on IT security, according to exclusive Computing research.

And 49 per cent of the survey respondents say they actively promote the strengths of their IT security to build relationships with clients.

The research, conducted in association with IT supplier Unisys and covering 200 public and private sector organisations, also shows that 72 per cent of UK organisations now employ an individual with specific responsibility for security - 59 per cent of whom either sit on the company board or report directly to the senior executive team.

Security expert Neil Barrett, author of the book Traces of Guilt, says companies are working together much more closely, meaning they also have to tie their systems together more closely.

'If one company is vulnerable, then the other also gets scuppered,' said Barrett. 'Both sides need to be protected from one another.'

Barrett says that companies typically look for evidence of technical and organisational standards for IT security, such as the technology in use, the processes in place, and measures for reporting or escalating problems.

'But often the assurances are kept at the policy level, rather than looking at things such as penetration testing reports to check conformance to the standards,' he said.

Hackers are increasingly trying to exploit the commercial relationships between companies to extend their attacks.

'It is not a big step for them to run riot across links between organisations,' said Barrett. 'Viruses spread quickly through business trust networks, the same as they do between friends.'

But the increasing awareness of security problems in firms is not always leading to greater co-operation between business and IT functions.

The research suggests that in 63 per cent of companies, IT is the only department involved in planning security strategy.

What do you think? Email feedback@computing.co.uk

If you want to be first with the news, visit Computing every day.