If you’ve ever struggled with finding the argument for an investment in information security, here it is: According to a survey recently published by Symantec, 40% of the worth of organizations is derived from the information they own. The link goes to a German site and the extract of that survey specific to Germany but the report is in English. The global version can be found here. There are other interesting numbers: 57% of the German respondents expect a loss of customers and 48% brand damage in case of a leak of information (and breach notification). The global numbers aren’t that different. On a global basis, information is estimated to be 49% of the organizations total value, while 49% expect loss of customers and 47% brand damage in a data leak event.
These are numbers that help to argue better with business managers. They also prove what we’ve been observing over the past few years: Information Security is a hot topic again. Business cares about information security (and notably not about “technology security” – it’s about the I in IT, not the T). And thus, business needs information security. One of the reasons is simply that some years ago when sensitive or valuable data leaked this was only mentioned on page 7 or so of a computer magazine. Nowadays you might make it to the opening headline of the daily news on TV, or the business newspapers (Wall Street Journal, Financial Times, etc.).
Numbers like the ones from the Symantec report help in showing the value of Information Security investments, by first showing that it is about information security and then showing the potential impact of leaks and breaches to the business. The numbers also clearly indicate that this “IT risk” of leaking information is about business risks: Operational risks, reputational risks, and even strategic risks, if you lose too many customers or damage the brand too much – or if you’re competitor gains access to your most valuable intellectual properties.
There is a good reason that information security is one of the two key drivers for what we at KuppingerCole have worked out as the KuppingerCole IT paradigm, our approach on structuring IT to deal with the fundamental changes like Cloud Computing, Social Computing, and Mobile Computing and to deliver what business really wants:
- Business wants the (IT) services they really need when they need them – and they want to order business services, not technology services for which they then wait endlessly for IT to deliver
- Business wants their information secured appropriately – this is where information security comes into play and, over the past few years, became a real concern of business managers