Survey assesses the State of information security worldwide.

• Author: Swartz, Nikki
• Position: Up front: news trends & analysis

In 2004, security will become much more strategic as companies invest greater resources in developing strategy, defining architecture, and assessing risk, according to a worldwide study.

The survey of more than 7,500 respondents, "The State of Information Security 2003," conducted by CIO magazine and PricewaterhouseCoopers, found that companies responded to new and emerging threats in 2003 with education and communication campaigns, tightened policies and procedures for overall security, disaster recovery, and business continuity plans. However, it is still a reactive culture with security initiatives driven largely by external factors such as regulations and industry practices and not by risk-assessment objectives.

In terms of security policy, the survey found that companies are addressing user behavior, employee awareness, and network and system administration issues. But only one third or less included monitoring standards, enforcing standards, incident response, or classifying data value in their policies, and 10 percent of those surveyed said their organization had no formal security policy whatsoever.

Other highlights from the survey include:

* Sixty-two percent of those surveyed said they will increase security spending, compared to only 50 percent in 2002.

* Twenty-nine percent budgeted less than $10,000 for security in 2003, compared to 39 percent in 2002.

* More than one-third (36 percent) of survey respondents indicated that their organization had not experienced any negative security events in the past 12 months.

* Companies are getting better at preventing attacks and recovering from them, with 26 percent of those surveyed reporting no down time in the past 12 months due to a security...