How strong is your safety net?

• Position: Information technology controls

Quick, take this pop quiz on information technology controls. True or false:

* "Our company is too small to have technology security breaches. Only big companies need to worry about that."

* "We must focus all of our security efforts on keeping out hackers."

* "All information security violations are intentional."

* "We don't have the technical sophistication or the resources to address technology controls adequately."

* "Systems security and reliability are two separate issues."

The answers? All false, says Barbara Bashein, assistant professor at the College of Business Administration at California State University in San Marcos, Calif. She's one of the authors of Meeting the Control Challenges of New Information Technologies, a soon-to-be-published Financial Executives Research Foundation study. Bashein maintains these five misconceptions are widespread in Corporate America and leave companies vulnerable to internal and external security breaches, whether intentional or unintentional. "For example, one survey found that more than 70 percent of the responding companies had lost work hours because of a computer virus," she reports.

FERF's study, co-authored by Bashein; M. Lynne Markus, professor of information science at The Claremont Graduate School in Claremont, Calif.; and Jane B. Finley, assistant professor of accounting at Belmont University in Nashville, Tenn., aims to dispel the notion that "it can't happen to us" and to demonstrate, through five case-study companies, that it's possible to implement effective, inexpensive control measures, Bashein says. All the companies (American Standard, BankAmerica, Microsoft, Norell and USAA) consider technology controls a serious business strategy issue, Bashein notes, and all have multiple safety nets, with social controls - that is, peer pressure from other employees to behave responsibly and take good security precautions - as the last line of defense. These safety nets include written procedures and guidelines...