Symantec Research debunks myths about IT failures

Mumbai

February 6th, 2008

Symantec Corp. has launched its risk management report volume II, revealing
that awareness of the importance of IT risk management is increasing, however
several myths persist. Despite the finding that practitioners are embracing a
more balanced approach that encompasses security, availability, compliance and
performance risks, misunderstandings of IT risk management can lead to potential
IT system failures, and ultimately impact business continuity. The report also
indicates process issues cause 53 percent of IT incidents, while IT often
underestimates the frequency of data loss incidents.

"Now in its second year, the IT Risk Management Report provides IT
professionals and C-level executives with unparalleled insight into the
discipline of IT risk management-ranging from understanding what's working and
what's not to providing actionable guidance and best practices for effective
program execution," Anil Chakravarthy, VP Worldwide - Enterprise Services,
Symantec Corporation. "Better understanding of the practice of IT risk
management empowers organizations to take calculated risks with confidence and
use IT to drive competitive advantage."

Symantec's comprehensive report, driven by the analysis of more than 400
in-depth, structured surveys with IT professionals worldwide, identifies key
issues and trends, and analyzes and dispels myths.

The report also sheds light on the state of IT risk management within
particular industries and highlights include that healthcare participants
expected the most IT incidents of any industry sector.

Telecommunications ranked highest in deploying IT risk management controls,
followed closely by banking and financial services. "This is likely driven
by increased governance and compliance scrutiny of these sectors and concerns
over the protection of personal data Within an organization, IT impacts every
function, from the lowest level on up," said Sudesh Prabhu, Country
Manager, Symantec Enterprise Services, India. " Failures across a broad
spectrum of systems can impact the business operations and results.
Organizations in India are realizing that IT risk doesn't necessarily just
impact a company. It impacts all its trading partners."

The report findings confirmed that security and compliance risks often
attract attention because of their high visibility and impact. However,
increased emphasis is being placed on availability risks, which the report shows
can flow through the value chain and create impacts measuring in millions of
dollars, even from minor performance issues.

The report shows that the while some organizations take a more holistic
approach, many organizations appear to be failing to implement some fundamental
risk management controls, such as asset classification and management.

According to the report, process issues cause 53 percent of IT incidents.
Several controls also showed a decline in ratings from the previous report one
year ago, causing increasing concerns. The new report also shows very little
improvement for the low rating of the asset and inventory classification
control.

The report highlighted a 10 percent improvement in the number of participants
rating secure application development "more than 75 percent
effective." The report also signals that problem management is rising on
the agenda.

The report makes it clear that IT risk management is an evolving business
discipline, rather than a precise science, due to reliance on the experience
accumulated by individuals and organizations as they keep pace with a changing
business and technology environment. There is a growing understanding that IT
risk management incorporates elements of operational risk management, quality
control and business and IT governance. In addition, practitioners may come to
see IT risk management as a set of fixed principles and relationships,
universally applicable across industries and geographies.