2.Define Your Boundaries

"The network boundaries have been pushed out by the connections over the Internet with third parties - we have third-party sourcing so people from outside [are] directly connecting, we have advisers connecting via the Internet," says an Australian CIO from the financial services industry. "Because we've really pushed the boundaries, we now have to determine a level of trust within each component of that network. Every time the business decides they want to do business with somebody else, their problems basically become our problems."

The trouble is, the CIO says, that the business seems to have enormous difficulty grasping that point. All they see is change in their business and a chance to do business. They do not understand the IT risks associated with that change.

"By the time they get to security, they've almost signed a contract. You can't turn around and say: 'No you can't have this arrangement or relationship with these people'. What we've really got to be doing now is becoming an enabler and trying to find ways of allowing the business to do that business with the lowest level of risk possible."

3.Rely on Multiple Solutions

Best-in-class levels understand that automated security technologies are necessary tools that must be placed in the context of best practices to yield fruit. Aberdeen says information and access technology solutions are also responsible for enabling business agility by ensuring that the information needed to fulfil company missions is available at the right time and for the right people.

"Unfortunately," the research company says, "there are more than 500 suppliers fielding security solutions and a lot of noise. Aberdeen's research clearly shows that firms operating at best-in-class levels are deploying and relying on more than one solution supplier and more than one enabling technology solution in each of the three main areas: network security and infrastructure, information and access, and governance. By contrast, the research reveals that firms operating at industry norm are relying on at least one solution in the information and access category and multiple solutions in the network and infrastructure segment. About 40 percent of all firms are performing at sub-par levels; another 40 percent are performing at an industry norm. Lastly, companies operating as industry laggards often depend on one or two key technology providers for network and infrastructure, might be using automation technologies for information and access, and rarely consider the influence governance plays in their performance outcomes."

Aberdeen says best-in-class level firms derive competitive advantage from their ability to leverage their security programs to enable business operations to function at full throttle while limiting and mitigating business risk. This competitive advantage is the result of the practices and management oversight being dedicated to security.

4.Market Your Program

It has long been recognized that people are usually the weakest link in the security chain - difficult to control, typically poorly trained and usually ignorant of what security is all about. A successful security awareness program should actively strive to change not only the mind-set but the behaviour of people towards security.

The Information Systems Audit and Control Association (ISACA) says that with proper training and education, people can become the most effective layer in an organization's defence. Hence the implementation of a security awareness program plays an important role in the drive towards a systemization of security.

The 2004 Global Information Security Survey of Ernst & Young cited "lack of security awareness by users" as the top obstacle for effective information security.

"Information security is everyone's responsibility, including the travelling sales representative, the mail room manager, the customer service associate and the CEO," says Tim Wulgaert, CISA, CISSP, author of Security Awareness: Best Practices to Serve Your Enterprise, and manager at Ernst & Young, Technology and Risk Services, Belgium. "For a security awareness program to be truly effective, everyone in the organization must do their part to promote security. Senior management and boards of directors must ensure the organization's culture puts a priority on security."

Security Awareness identifies several critical success factors to attaining a security-aware culture, including:

• A formal security awareness policy that defines the appropriate safeguards and security procedures must exist.

• Executive management support for the security awareness program is crucial.

• "Security-positive" behaviour must be one of the criteria upon which employees are evaluated.

• Security awareness activities must be part of a continuous process - not a one-time effort.

• The target audience of the security awareness program must include visitors, consultants, external staff, business partners and others that interact with the organization.

• The effectiveness of the program must be measured.

Security awareness initiatives are part of an overall information security management program, Wulgaert says. Crucial in this is the existence of a formal security awareness policy that translates the security strategy and defines the appropriate level of security and safeguards by means of a security policy document, security standards and security procedures. Equally crucial is the existence of a well structured information security organization with sufficient authority.

"I have developed what I call a targeted marketing strategy for security," says another Australian CIO in the financial services industry. "Basically, it can be one-on-one briefings, one-on-many briefings, posters, flyers, e-learning, online references, articles in our internal magazine, e-mail reminders, alerts, IS dashboards . . . all kinds of tools that are out there, depending on where people sit within the organization. I think it's very necessary, and certainly at the upper levels in the organization there is a much greater recognition now of those issues.