Bank Security Budgets Rising, Deloitte Survey Says

Identity and access management are high priorities for bank IT executives.

Senior security executives at large financial institutions are investing in tools that restrict user access to critical information and continually keep track of who has access to that information, according to a Deloitte survey released today.

Identity and access management was identified as the industry’s top security initiative for 2010. Among 19 different types of initiatives, 44 percent of survey respondents listed this as a top initiative; it is also is a significantly higher priority for larger organizations with more than 10,000 employees (63 percent).

Security budgets also appear to be bucking the current trend of cost-cutting. More than half of the survey’s respondents (56 percent) indicate that their information security budget has increased. Moreover, there is a significant drop, compared to 2008, in the number of respondents who state the “lack of sufficient budget” as one of the major barriers that their organization faces.

* Data loss prevention has taken on a greater urgency. Data loss is caused by inadvertent action on the part of an organization’s people. When asked to characterize their ability to thwart internal breaches, only 34 percent of respondents are “very confident,” but that response rises to 56 percent when respondents are asked about their ability to thwart external breaches. Respondents indicate that, after encryption, data loss prevention will be the most piloted technology in the next 12 months.

* Regulatory compliance is a key priority for financial institutions. Financial institutions are expecting more regulatory pressure. Respondents to the survey include regulatory and legislative compliance as one of their top five initiatives and are hiring more internal auditors to resolve internal and external audit findings.

* Insurers are ahead of banks in planning to tackle certain security initiatives. For the first time, Deloitte’s financial services survey breaks out sector-based comparisons. Of key 2010 priorities, insurers have a bigger appetite for identity and access management (a priority by 51 percent of insurance organizations and only 44 percent of banks) and data loss preventions technologies (32 percent versus 25 percent). Although banks appear to have a stronger security posture than other financial services institutions, insurers are catching up fast.

* For the first time, organizations appear eager to embrace emerging technologies to combat threats. Organizations are now proactively embracing new technologies as “early majority adopters”; previously organizations were content to be “late adopters.”