The Ernst & Young Global Information Survey found that the majority of 66 Australian companies among 1233 leading companies in 51 countries were not interested in raising employee awareness about security issues
Only 41% of Australian organisations conduct regular assessments of their IT providers to monitor compliance with information security policies.
Only 44% of Australian organisations indicated that they would contact their business partners/suppliers if they experienced an information security incident, this re-inforces the need for organisations to evaluate the security initiatives independently.
A further observation from the survey results indicate that greater attention remains focused upon the external threats, rather than internal threats.
The survey indicates that organisations remain focused on external threats such as viruses, while internal threats are consistently under-emphasised. Companies will readily commit to technology purchases such as firewalls and virus protection, but are hesitant to assign priority to human capital.
The more likely and most dangerous threats are those originating from within the organisation. The reason that internal incidents do not appear in the media in the same manner that external incidents do, is certainly not because they did not happen, but rather that they are identified but not made public, or worse still, they are concealed and not detected by the organization.
Australian respondents appeared more concerned about unsolicited commercial bulk mail, over employee misconduct involving information systems. Many organisations feel that information security has no value when there is no visible attack. This is a perception that has remained unchanged over the decade that Ernst & Young has been conducting this survey.
70% of the board of directors of Australian respondents fail to receive a montly report about the organisation's security status, and only 17% rate the perception of information security within their organisation by the CEO as very important.
