LONDON, KYIV, 16 OCTOBER 2008 – The Ernst & Young 2008 Global Information Security Survey shows that a growing number of organizations recognize the link between information security and a strong brand and reputation.

The survey, which canvassed nearly 1,400 senior executives in more than 50 countries, shows that most believe that a security incident would have a greater impact on reputation and brand than on revenues, with 85% of respondents citing damage to reputation and brand as significant, compared with 72% for loss of revenues. Regulatory sanction is cited by only 68%.

Paul van Kessel, Global Leader of Ernst & Young’s Technology and Security Risk Services, comments: “A good brand and reputation can take years to build but can be severely damaged or even destroyed by a single security incident. The media coverage surrounding security breaches underscores just how devastating these failures can be to a firm’s reputation. For the past few years, most improvements in information security stemmed from regulatory compliance. Now, the desire to protect brand and reputation is motivating many organizations to do more than just tick regulatory and corporate compliance boxes.”

Despite tightening economies, the survey indicates that organizations are increasing investments in information security and more organizations are adopting international security standards. More than two thirds (67%) of respondents interviewed say they have now implemented controls to protect personal information.

Kostiantyn Neviadomskyi, Partner, Technology Security & Risk Services Leader, Ernst & Young Ukraine, commented: “Just a few years ago, Ukrainian companies employed two contrary approaches: some used extra measures to protect information with no regard to the amount of resources needed, while others thought it was not worth funding information security at all, because "those who needed certain information would always find it anyway." Today, we see more companies in Ukraine beginning to understand the importance of information security issues and also realize how wasteful the maximalist approach is. In the current economic situation, it is crucial to maintain a balanced, pragmatic and efficient attitude to information resource protection. International standards and techniques make it possible to build models for information protection; however, it is important to remember that they have to be adapted to the business specifics. Only then is it possible to create an optimal model for information protection with regard to investment and operational matters.”

Van Kessel continues: “Overall, the results of this year’s survey are encouraging; however, there are some key areas—such as insider threats, privacy and third-party relationships—that need more focus and investment.”

Spending set to increase

Despite an economic downturn faced by some of the world’s largest economies, 50% of respondents are set to increase their budgets for security; in fact, only 5% plan to decrease their current budgets.

Van Kessel comments, “We believe that organizations recognize that security cutbacks would have an adverse effect on stakeholder perceptions. Most also believe that security threats and attacks increase during an economic downturn.

“However, where the money is spent will be critical. It is not enough to simply fund further technical solutions, such as encryption. It is the people who are often the "weakest link", with 50% of respondents citing awareness within their organization as the most significant challenge to information security. Businesses must work with information security to develop training and awareness programs and to adopt more sophisticated testing techniques.”

About the survey

The Ernst & Young 2008 Information Security Survey was developed with help from Ernst & Young’s assurance and advisory clients in more than 50 countries. The fieldwork was conducted between May and August 2008. The results were primarily collected through interviews held with executives from approximately 1,400 organizations across all major industries.

About Ernst & Young

Ernst & Young is a global leader in assurance, tax, transaction and advisory services. Worldwide, our 130,000 people are united by our shared values and an unwavering commitment to quality. We make a difference by helping our people, our clients and our wider communities achieve potential.

In Ukraine Ernst & Young established its practice in 1991. Ernst & Young Ukraine now employs more than 570 professionals providing a full range of services to a number of multinational corporations and Ukrainian enterprises. For more information, please visit ey.com/ukraine.

Natalia Partach 
Ernst & Young PR Specialist 
(044) 490 3000 
Natalia.Partach@ua.ey.com