Firms 'still finding data security difficult'

2009-09-28

Many firms are still finding dealing with data security difficult and are placing people at risk of identity theft, recent research has indicated.

According to an Imperva and Ponemon Institute poll of over 500 US and multinational IT security practitioners, nearly three-quarters (71 per cent) admitted to not making information security a top strategic initiative, which may mean they are more at risk from a data breach. Over half (55 per cent) said that they only secure credit card data and not sensitive information such as social security numbers and bank account details, even with the Payment Card Industry's (PCI) Data Security Standard (DSS) in place.

"Security departments are using PCI compliance as leverage to gain more budget, but these resources are not always translating into greater security for sensitive customer data," commented Larry Ponemon, chairman and founder of the Ponemon Institute.

"The results of our study indicate that while some companies have figured out how to convert PCI standards into an overall security mandate - many more have not," he added.

Shlomo Kramer, Imperva's chief executive officer, said that while no one is in business to be compliant, protecting consumers as required by the PCI DSS standard, there is a great opportunity to enhance their overall security posture.

Other results from the research revealed that 60 per cent of respondents do not believe they have sufficient resources to comply with PCI and create a necessary level of cardholder security.

Meanwhile, 28 per cent of smaller companies with between 501 and 1,000 employees comply with PCI. This is in comparison to 70 per cent of larger companies with 75,000 or more workers.

Amichai Shulman, chief technology officer at Imperva, said that his firm is recommending that the PCI DSS Council change requirements for larger and smaller companies to take on board the different environments and security needs.

The PCI Security Standards Council was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa.

Read more security news.