IT Security Managers Unaware of Security Issues, says McAfee Survey

Managers in charge of IT security for large enterprises are often in the dark when it comes to the security issues faced by their own companies, according to a new study released by McAfee (News - Alert).

Conducted by Gabriel Consulting Group, the “2011 Data Center Security Survey” polled 147 enterprise data center managers to get their take on how security issues are perceived among upper IT management.

In response, a majority 60 percent said that their own management is “in the dark” when it comes to their organization’s security status, believing that internal security is stronger than it actually is. Only 22 percent noted that management is aware of their company’s actual state of preparedness against security threats.

Further, around half of those surveyed feel that virtualization and private clouds pose unique challenges in the area of security, but most IT admins are using the same tools to protect both their physical systems and their virtual ones. That can be an issue, says McAfee, since such an approach can lead to “inconsistent network policies and security loopholes.”

The survey also uncovered a number of other findings. Around half of those polled said they’re always finding new security holes. More than 40 percent believe their own organization’s security measures aren’t keeping up with the number of new threats. And 40 percent also revealed that their daily security practices aren’t in line with their official corporate policies.

A McAfee blog shed further light on the survey and its findings, courtesy of Gabriel Consulting’s principal analyst Dan Olds.

Reflecting on the results, Olds says that “this is something that should cause a lot of thought both in the executive suite and in the data center. Management needs to seek out the truth when it comes to IT security, and data center management needs to be frank and honest when discussing the strengths and weaknesses of their security mechanisms. Obviously, it’s far better to discuss potential security issues before they’re exposed by a breach.”