Hosted by Trends in Enterprise IT Security Andrew Briney, CISSP Editorial Director, Information Security October 15, 2003

Hosted by Agenda Security Budgets and Spending Technologies and Services: Hot & Not What Do You Value Most? The “Maturing” Profession

Hosted by Information Security Polling 2003 ISM Annual Survey 3,500 IT security professionals 2003 ISM Product Survey 1,100 IT security professionals 2003 SearchSecurity Users’ Survey 372 IT security professionals TheInfoPro (TIP), Q Survey Interviews with 160 senior IT security pros

Hosted by Global IT Security Market $17B $45B 25% CAGR Source: IDC Corp.

Hosted by Budget Changes: Since 9/11 Source: SearchSecurity 51% of organizations have increased spending

Hosted by Will your IT security budget increase in the next 12 months? 1.Yes 2.No 3.Don’t know

Hosted by Budget Changes: Source: TheInfoPro 54% of organizations will increase spending

Hosted by By how much will your IT security budget increase in the next 12 months? 1. More than 50% 2. 25% -50% 3. 10% - 24% 4. 1% - 9% 5. No change 6. Budget will decrease 7. Don’t know

Hosted by IT vs. Security Budgets % of IT Budgets Devoted to Security Source: Information Security Magazine

Hosted by 2005: 60% will have both. 2001: 7% of organizations had BOTH IDS and VA. Hot and Not (1) Source: Information Security Magazine By 2005, AV, FWs and VPNs will be deployed in 95% of organizations.

Hosted by Do you plan to invest in managed security monitoring services in 2004? 1. Yes 2. No 3. Don’t Know/NA

Hosted by Do you plan to invest in special- purpose security appliances in 2004? 1.Yes 2.No 3.Don’t Know/NA

Hosted by Hot and Not (2) In 2003, will you spend more, less or the same amount on these technology areas? Source: TheInfoPro

Hosted by What do you value most when selecting a security product? 1. Features/functionality 2. Fit with current network/data infrastructure 3. It’s own built-in security 4. Price 5. Other

Hosted by Feature Creep Source: Information Security Magazine

Hosted by What do you value most when selecting a security vendor? 1.Technical Support 2.Produce leading product 3.Financial stability 4.Strength of R&D 5.Breadth of product line 6.Other

Hosted by Vendor Value Source: Information Security Magazine

Hosted by To what extent do regulatory and legal requirements drive your security actions? 1. Never 2. Rarely 3. Sometimes 4. Mostly 5. Always 6. Don’t Know/NA

Hosted by Regulatory Impact To what extent do regulatory and legal requirements drive your security actions? Source: Information Security Magazine

Hosted by Proactive Defense At what point do you act on an emerging security threat? Source: Information Security Magazine

Hosted by Risk Analysis What type of risk methodology(ies) do you use? Source: Information Security Magazine

Hosted by Andy’s Crystal Ball 2004 Security Spending: “Y2K Effect” Functionality Converges at Perimeter “Intrusion Defense” Gets Smarter Profession Continues to Mature

Hosted by Trends in Enterprise IT Security Andrew Briney, CISSP Editorial Director, Information Security October 15, 2003