Federal Agency IT Staff, IT Execs Not on Same Page When it Comes to Security

ISLANDIA, N.Y. and TRAVERSE CITY, Mich., April 14 /PRNewswire-FirstCall/ -- There are distinct gaps among United States federal agency IT executives and IT professional staff when it comes to their opinion on how prepared their agencies are to deal with security threats, the strength of their security profiles, and their ability to achieve security objectives. These discrepancies could affect how security resources are allocated and how threats and risks are managed and controlled. This data was revealed in a study, "Security in the Trenches:  Comparative Study of IT practitioners and Executives in the U.S. Federal Government," conducted by the Ponemon Institute, an independent research firm specializing in privacy, data protection and information security policy, and sponsored by CA, Inc. (Nasdaq: CA).

The study is a comparative look at how IT executives and the IT staff in federal agencies view their various security issues, capabilities, and preparedness. Ponemon Institute polled an independent sample of 320 IT practitioners located in various federal departments and agencies. It compared the results to an earlier study of IT executives to understand if the beliefs and perceptions between these two groups were aligned when it came to security.

"As we were reviewing the results and seeing these gaps emerge, we recognized that these discrepancies could impact an agency's ability to properly secure their IT environment and manage risk," said Dr. Larry Ponemon, chairman and founder, the Ponemon Institute. "The gaps ranged widely from the need for training, to whether there was a single person responsible for an agency's security initiatives."

The results in some critical security areas such as privileged user password management, training and overall views of meeting security objectives showed wide diversity:

• A 31 percent gap in the importance of privileged user password management (PUPM). Sixty-two percent of IT staff-level respondents deemed PUPM very important, while just 31 percent of executives felt it was very important.
• A 21 percent difference in the importance of training end users and a 20 percent gap in training of privacy and security experts. The results showed 62 percent and 63 percent of IT staff sees training of end users and security experts as very important, with just 41 percent and 43 percent of executives citing the importance.
• IT staff are significantly less confident than IT executives that their agency is compliant with all applicable regulatory requirements, such as FISMA. Of those IT staff that felt their agency was not compliant, 30 percent cited a lack of accountability and senior leadership, or support from senior management as the cause. Forty-six percent of IT executives who felt they didn't meet requirements cited lack of enforcement as the primary reason.

"The most surprising and concerning statistics from this study were the discrepancies around the need for controlling privileged users or IT administrators and the importance of training," said Dave Hansen, corporate senior vice president and general manager for CA's Security business. "Some of the biggest data breaches have been due to compromised IT administrator accounts. If not properly controlled, those accounts can provide excessive IT access to any outsider who obtains the account information, or to a single IT administrator which elevates risk to an unacceptable level and takes organizations out of compliance with some regulations and standards, such as ISO 27001."

The statistic on privileged users is consistent with results from a study released in October on privileged user management. The study was based on 270 interviews with senior IT executives working in the telecommunications, media, manufacturing, financial services and government sectors in Europe. It was conducted by Quocirca, a research and analysis company, and showed that only 26 percent of organizations surveyed have deployed technology to manage privileged user accounts; just 24 percent have deployed privileged user management systems in the government sector.

"The results of this study point out a challenge for IT security professionals that we observe in our work with government IT executives and staff -- how to effectively convey the benefit of stronger security polices and increased investment on overall security of critical federal systems," said Curt Aubley, chief technology officer of Cyber Security and Next Generation Innovations, Lockheed Martin Information Systems & Global Services."

Why the Gap?

Dr. Gilda Carle, a relationship expert who has worked with organizations including the U.S. Army, the Internal Revenue Service, and IBM, provided this analysis of the gap in perspectives: "Executives tend to see the big picture, whereas the IT staff-level sees a more focused view. The difference in viewpoints can greatly affect how well an organization achieves its objectives. CBS has even created a No. 1 hit based on this principle called Undercover Boss, where bosses become part of the rank and file, and everyone learns what life is like from the other side."

(Logo: http://www.newscom.com/cgi-bin/prnh/20090402/NYTH500LOGO)

About CA

CA (Nasdaq: CA), the world's leading independent IT management software company, helps customers optimize IT for better business results. CA's Enterprise IT Management solutions for mainframe and distributed computing enable Lean IT -- empowering organizations to more effectively govern, manage and secure their IT operations. For more information, visit www.ca.com.

Connect with CA

• CA Social Media Page
• CA Newsletters
• CA Press Releases
• CA Podcasts
• CASecurity Twitter

Legal Notices

Copyright © 2010 CA. All Rights Reserved. One CA Plaza, Islandia, N.Y. 11749. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies.

Press Contacts

SOURCE CA