The Hindu Business Line : `Internal security threat needs more attention'

Mr Terry Thomas (left), Partner, Ernst & Young's Risk and Business Solutions Practice, with Mr Sunil Bhumralkar, Director, Ernst & Young India Pvt Ltd, at a press conference in Bangalore on Wednesday._ - - G. R. N. Somashekar

Bangalore , Oct. 6

INDIAN companies are aware of but do little to implement information security programmes within their organisations, according to Ernst & Young.

Its 2004 global information security survey found that although Indian business heads showed more awareness about info security compared to their Western counterparts, the companies were not fully implementing the measures they spoke of.

Announcing the results of the survey, Mr Terry Thomas, Partner E&Y's risk and business solutions practice, said that organisations worldwide were more focussed on external threats such as viruses but neglected to recognise or deal with internal threats such as from people and processes within the organisation.

"Companies will readily commit to technology purchases but are hesitant to assign priority to human capital," Mr Thomas said, adding that while technology-oriented solutions and ensuring adequate flow of investment are both important, people and organisational issues are also equally important.

Since many insider incidents are based on concealment, organisations were often unaware that they were being victimised, he said.

E&Y's global findings reveal that 70 per cent of the 1,233 organisations surveyed failed to list training and raising employee awareness of information security issues as a top initiative.

In line with global findings, Indian organisations too feel that major viruses and Internet worms are their topmost security concerns. Employee misconduct is ranked as number two worry worldwide, but is the third on the list for Indian companies.

Spam mail is considered a bigger bother in India. Accordingly, 91 per cent of Indian respondents (total 69) have anti-virus systems and 56 per cent have specific anti-spam protection for their networks.

However, less than half of them provided their employees with ongoing training in security and controls, Mr Thomas revealed.

Other highlights of the survey include the finding that while 86 per cent of Indian organisations felt that info security is of high importance in achieving their overall objectives, only 31 per cent of them strongly agreed that it rated CEO-level management.