Gartner says IT security spending will stabilise as operational efficiency improves

Australian organisations feel less safe than their US counterparts

Sydney, July 17, 2006 — The most efficient organisations – those that have reached a high level of IT security practice maturity – can safely reduce the share of security in the IT budget to between three and four percent by the end of 2008, according to research and advisory firm Gartner. By contrast, organisations that are inefficient or have historically underinvested in security may spend upwards of eight percent of their IT budget on security. This means that many organisations will still be investing aggressively for the next few years.

Rich Mogull, research vice president and conference chair of the Gartner IT Security Summit to be held in Sydney this week, said that there are now solutions to most information security problems, and it’s a matter of implementing the technology efficiently and effectively so resources can be focused on new threats. While information security has become a highly specialised branch of IT, commodity security functions are often being returned to IT operations, he said.

“Organisations that are still impacted by everyday, routine threats must ramp up and become more mature in their approach,” said Mr Mogull. “The message to be conveyed is not ‘we need more security’ but rather ‘we need more security process’. Security now has executive attention, and we need to treat it like a business issue, not just a technology problem.”

At the IT Security Summit, Gartner analysts will describe how to spend less and become more secure and examine the trends that will change today's approaches to security.

This week Gartner released its updated Hype Cycle for information security technologies, designed to help executives make decisions about how to allocate their security budgets. It shows technologies such as spam filtering and web services security standards moving rapidly towards broad acceptance, while the widespread adoption of biometrics remains more than 10 years away.

“Aside from the age-old need to ‘keep the bad guys out’ and ‘let the good guys in’, compliance with government and industry regulations are now playing a significant role in security spending decisions,” said Mr Mogull. “In deciding when to adopt a new security technology, timing is crucial. Invest too soon and you risk the pain and expense of an immature technology; invest too slowly and you risk being left behind and leaving your organisation vulnerable.”

Mr Mogull also said that functional convergence in security products is occurring, for example, host firewalls, antivirus, anti-spam, and basic host intrusion prevention are combining into single desktop agents. In the future, this would make security less complex, he said.

Australian organisations feel less safe than their US counterparts. In a US telephone survey conducted by Gartner, seven out of 10 large organisations (71 percent) said they consider the systems and processes of the IT unit in which they work more secure than one year ago and only six percent felt less secure. An audience survey at last year’s IT Security Summit in Sydney found that only 22 percent in Australia felt more secure, while a third of Australian organisations surveyed felt less secure.

For more information about Gartner’s IT Security Summit, please visit www.gartner.com/ap/itsecurity

Contact:


Laurence Goasduff
Gartner
+ 44 1784 267 195
laurence.goasduff@gartner.com


About Gartner:
Gartner, Inc. (NYSE: IT) is the world's leading information technology research and advisory company. Gartner delivers the technology-related insight necessary for its clients to make the right decisions, every day. From CIOs and senior IT leaders in corporations and government agencies, to business leaders in high-tech and telecom enterprises and professional services firms, to technology investors, Gartner is the indispensable partner to 60,000 clients in 10,000 distinct organizations. Through the resources of Gartner Research, Gartner Consulting and Gartner Events, Gartner works with every client to research, analyze and interpret the business of IT within the context of their individual role. Founded in 1979, Gartner is headquartered in Stamford, Connecticut, U.S.A., and has 4,000 associates, including 1,200 research analysts and consultants in 80 countries. For more information, visit www.gartner.com.