Survey: companies are poorly prepared for security.

As privacy issues become more closely regulated on both a state and a federal level, a new industry survey shows insurance executives believe more needs to be done to meet the priorities of the new business climate.

According to a survey by Ernst & Young, there still seems to be a fair number of organizations that have less-than-adequate security processes in place, William Barrett, leader of Ernst & Young's technology and security risk-services practice in the firm's New York financial-services office, said.

In the survey, 31% of companies rated themselves as less than adequate in having effective ways of evaluating vulnerabilities in their systems, Barrett said In addition, 28% of the organizations were less than adequate in being able to detect if the systems were under attack, he said.

Only 64% of the organizations feel they are compliant with security-driven regulations, which means about 36% are compliant or partially compliant with regulations, Barrett said Most companies, based on their own self-assessment, don't feel they are in conformity with such regulations as the Health Insurance Portability and Accountability Act of 1996 and the Sarbanes-Oxley Act.

Companies need a fresh approach in looking at information security, Barrett said Budgetary restrictions were cited more often than any other reason as to why security systems weren't up to par, he said Budgetary constraints always will exist, so companies need to find a way to make the system work within those budget limits, he said. There's a need for organizations to prioritize the risk and take measures that address the most significant risks, he said.

The survey highlighted a significant difference between types of financial-services industry spending on information security, with 79% of banks and insurance companies surveyed citing technology spending as the largest component of their information-security budgets, but only 18% stating the majority of their budget was spent on employee awareness and training.

More security issues relate to the fact that networks are more open, with connectivity to the outside, with third-party business partners, and with Internet accessibility and increased vulnerability through more extensive networking, Barrett said.

"If you look at security in the past few years, the No 1 concern was concern about access within the organization, from employees or contractors given access," Barrett said "Outside hacking access was limited Now there is certainly more likelihood that a hacker incident will come from outside, and the hackers pose a threat to the organization for access to information of denial-of-service issues It is no longer just an internal problem."

Organizations need to make sure they have a program for identifying and addressing vulnerabilities, Barrett said With the number of hacker and virus attacks, being able to identify vulnerabilities and addressing them ahead of time can limit their damage, he said Identifying the gaps in information security and developing programs and processes to address them will vary from organization to organization, but it needs to be done, he said.

A number of organizations provide services for attack-penetration evaluations, so the companies can prepare and correct problems, Barrett said.