"I would estimate that half or more of security breaches are not highly organized criminals trying to steal your corporate information," says Laura Koetzle, principal computing and security analyst at Forrester Research in Cambridge, Mass. "They are stupid things that happen. Most of these things are committed in ignorance."
With ever-increasing external threats compounded by unpredictable computer users, a CIO's challenge can be daunting. That's one reason why CIOs should seek out new security products that anticipate computer-user mistakes as a given.
"Make your rules easy to follow," Koetzle suggests. "You need a one-pager in plain English. Tell them what to do and what not to do."
But, she cautions: "The process only works if you motivate people."
Of course, it's not always the IT department's customers who are causing the trouble. Sometimes human error means that security tools aren't configured properly or have not been maintained or updated on schedule. According to Deloitte Touche Tohmatsu's 2004 Global Security Survey, one third of senior information technology executives said security technologies acquired by their organizations were not being utilized effectively.
Auditing products can help. Preventsys, for example, points out that while many firms have strong security policies, their networks aren't audited often enough to see if the policies are being honored. Firms such as Preventsys offer a variety of auditing tools while KaVaDo Inc.'s ScanDo performs Web application scanning to identify security loopholes in Web applications and recommends solutions. Outside consultants also be hired to perform audits, said Koetzle.