Deloitte: Tech, Media, And Telecom Industries Reduce Security Spending

Even among technology firms, security spending is dropping amid economic and budgetary pressures, according to a new report released today from Deloitte Touche Tohmatsu.

The Deloitte survey of technology, media, and telecommunications firms from around the world found these industries are spending less on security -- even as they voice concerns about social networking and other security risks. More than 30 percent have chopped their security budgets during the past 12 months, and more than half have allocated less than 6 percent of their overall IT budgets to security, according to the report.

What makes these vertical markets unique from others, such as financial services, is that they aren't as heavily regulated, and their security spending trends reflect that. "The drivers are a little different here," says Irfan Saif, a principal with Deloitte. "In other surveys [by Deloitte], financial services was increasing its security spending. I would attribute a lot of that to the regulatory landscape there."

About 60 percent of the technology, media, and telecom firms in the study said they are falling behind or still trying to catch up with the security threats they face. That's up from 49 percent last year, Saif notes.

And they're worried about Web 2.0-based security threats. "We asked them what they believed were the key threats to information security, and 83 percent said the exploit of vulnerabilities in Web 2.0 was a high risk to them," Saif says.

Those concerns correlate with their confidence about their risk to internal threats: Only 28 percent said they are "very" or "extremely" confident, down from 51 percent last year. More than 41 percent had experienced a security breach in the past 12 months.

Meanwhile, technology, media, and telecom firms are struggling to get upper management support for meeting security regulatory requirements. Nearly 60 percent said their senior executives either aren't effectively supporting their compliance efforts, or these efforts are not being sufficiently funded. And more than 67 percent said regulatory requirements are "somewhat effective" in securing their systems and data.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.