November 16, 2005—New threats and soaring costs are two factors driving the integration of traditional and information security functions in a growing number of US-based global companies, according to the results of a new study commissioned by three leading international security organizations, ASIS International (ASIS), Information Systems Audit and Control Association (ISACA) and Information Systems Security Association (ISSA).
The study, Convergence of Enterprise Organizations, was conducted by Booz Allen Hamilton (BAH) and surveyed chief security officers (CSO), chief information security officers (CISO) and other security professionals representing 36 companies with revenues ranging from $1 billion to more than $100 billion. BAH also conducted 14 in-depth interviews in addition to the surveys. The results of the study indicate that convergence is a trend that impacts not just the security function of a given business, but rather, the business as a whole. Such integration ensures that all functions within the organization work together, and enables the organization to prevent, detect, respond to and recover from any type of security incident.
Another factor identified in the study as contributing to the security convergence trend is the migration in the types of assets many organizations need to protect. Companies assets are now increasingly information-based and intangible, and even most physical assets rely heavily on information. Technology is also now allowing companies to offer more information products. As these products become increasingly intangible, there is a greater need to integrate traditional and information security, as well as security throughout the entire enterprise.
The advance of technology itself is blurring the line between traditional and information security, and is a third component driving convergence. Physical access control technologys merge with network access technology is one example cited in the study. The smart card demonstrates a technology that is integrating once disparate parts of security, by verifying a persons identity and tracking his or her physical location.
As the convergence of security functions within organizations continues to increase, the study concludes that the role of security should no longer be viewed as a sunk cost, but rather, a value adding activity.
A Webcast about the study will be available at the ASIS, ISACA and ISSA web sites in December.
For more information or to download a free copy of Convergence of Enterprise Organizations, please visit the ASIS, ISACA or ISSA Web sites.
