Special Report: Marketplace Security Survey, Risky Business - 41

and awareness (71.3 percent), information infrastructure (52.8 percent), personnel department background checks (52 percent), purchasing and acquisitions (38.5 percent), and IT department baseline documents (37.1 percent). See the results in Figure 5, page 40. Significantly, 82.2 of respondents have an information security policy or policies, 83.5 percent also have a monitoring and audit policy in place, and 73.8 percent regularly perform audits. Whether this referred to internal or external auditing wasn't addressed in the survey, but Sardino recommends regular internal and external audits. As he explains, "If you're the one who created the policies, you think they're wonderful. Having a neutral outsider look at security policy and controls can help organizations be more vigilant in fighting threats. You have to expect the policies to change, much as the threat landscape changes, which is fairly regularly. When you do make changes or updates, make sure they're implemented as soon as possible." The Good and the Bad Yes, the bad guys are out there, waiting for even the slightest security lapse to pounce. Organizations can take steps, however, to lessen those risks-employing encryption, promoting education for both system administrators and end users, and regularly auditing and updating policies. The one thing they can't do is become complacent. Threats are becoming evermore common and sophisticated, so no matter how good their current security plan is, it's likely to become outdated in short order. "You have your standard threats-phishing, spyware, malware-but thanks to automation, threats beyond those are becoming more dangerous. Unfortunately, many developers aren't taking the many ways someone can corrupt their applications into account. It's never going to stop. We need to more fully educate people and deploy the best tools we can," King says. Jim Utsler is a senior writer for IBM Systems Magazine and has been covering technology for more than 20 years. WEBINAR Sponsored Advertising Content Risky Business IBM Systems Magazine readers respond to exclusive 2016 z Systems Security Survey WHEN Tuesday, October 11 | 10 PT / Noon CT / 1 ET PART I: Learn how z Systems users are addressing security issues facing their organizations today and planning for and prioritizing future threats. PART II: CorreLog will provide insight to the security disconnect caused by enterprises working across the "two worlds of IT" (mainframe vs. distributed) and how to bridge the gap in this presentation titled "Bridging the Gap Across Mainframe and Distributed Platinum Sponsor: Security Policy Management." FEATURED SPEAKERS Doug Rock George Faucher Peter Mills Publisher IBM Systems Magazine President & CEO CorreLog, Inc. VP Development & Support CorreLog, Inc. REGISTER TODAY http://ibmsystemsmag.webex.com ibmsystemsmag.com SEPTEMBER/OCTOBER 2016 // 41 http://ibmsystemsmag.webex.com http://www.ibmsystemsmag.com

Table of Contents for the Digital Edition of Special Report: Marketplace Security Survey, Risky Business