Many organizations are evaluating a new security model based upon IT risk management best practices. This is a good idea, but not enough for today's dynamic and malevolent threat landscape. To keep up with IT changes and external threats, large organizations need to embrace two new security practices: Real-time Risk Management for day-to-day security adjustments and Real-time Threat Management to detect and remediate sophisticated, stealthy, and damaging security breaches (i.e., Advanced Persistent Threats or APTs).
ESG surveyed security professionals working in the 18 public and private industry sectors designated as “critical infrastructure” by the U.S. Department of Homeland Security. This brief looks at how these organizations are auditing the security processes and procedures of their IT vendors and the extent to which vendor audit results factor in actual procurement decisions. Alarmingly, IT vendor audits frequently remain random, informal, “check-box” activities.
More Results: