Santa Clara, Calif. — August 26, 2002 - 9-18 had a stronger impact on IT security spending than 9-11, according to a qualitative study released today by Sanctum, Inc., the established leader in Web application security software. The study found that while 70 per cent of the companies interviewed had increased security spending since 9-11, the spending increase was primarily driven by the surge of "hybrid worms" such as Nimda, which broke on September 18, 2001, and the requirements of government legislation. The four most frequently implemented IT security solutions since 9-11 were disaster recovery (50 per cent); intrusion detection systems (50 per cent); application-level security (40 per cent); and network firewalls (20 per cent).

This comprehensive survey was based on in-depth interviews with high-level security officers at some of the nation's largest corporations in financial services, insurance, manufacturing, utilities and government industries.

"CEOs need to be taking a proactive, aggressive position to ensure their companies have the right skills, technology and risk assessment practices in place to be properly protected," said Peggy Weigle, chief executive officer of Sanctum. "In every instance where we have seen CEOs provide a corporate mandate to drive security across their Internet infrastructure, something gets done quickly and effectively. This survey indicates that not enough CEOs are getting involved in making these important decisions. In the long run, I believe this is going to have a serious effect on a company's commitment to all their stakeholders."

Key findings of the study include:

• 70 per cent of the respondents said 9-11 had minimal impact on IT security strategy and spending

  "What's different from pre and post 9-11 is the hybrid worms Code Red and Nimda that emerged near the 9-11 physical attacks. I believe they were spawned by the same folks that drove jetliners into the buildings. The timing was just too close."
      Chief information security officer at a Fortune 500 financial services company

  "The Internet is like an ATM in that customers expect it to be up 24/7. We are still rolling out new Internet projects to grow the medium as an effective sales and information channel. Our IT security spending plan did not change after 9-11 because 9-11 didn't bring about Internet frauds. Internet security has always been a serious threat."
      Senior vice president of Internet services group at a top 10 retail bank

  "Utility companies never worried about security before. Now the regulatory standards required by FERC (Federal Energy Regulatory Commission) and NERC (North American Electric Reliability Council) are wide sweeping. A lot of utility companies will start centralizing and building security departments from scratch."
      Director of security at an electricity utility company in California
  
  

• 70 per cent of the respondents have increased IT security spending since 9-11, but the tragedy of that day was not the main cause of the increases.

  "Although we increased the security spending post 9-11, the security product purchases were not due to 9-11. For security product purchases, timing and priority are bigger factors than the renewed focus on security caused by 9-11."
      Technology security manager at a major financial services company

  "We quadrupled our security spending post 9-11 but most implementations weren't related to 9-11. We always had a very strong focus on IT security. However, 9-11 did expedite our disaster recovery planning and asset management system implementation."
      Director of global security architecture at a Fortune 500 insurance company
  
  

• 70 per cent of the respondents see external Internet security threats as their primary concern.

  "Application security is another huge problem for most financial institutions. Due to GLBA (the Gramm-Leach-Bliley Act), banks have to improve their data security� I think terrorists will take advantage of the vulnerabilities in financial systems and social engineering to transfer money when other roads are blocked."
      Security manager of a bank in California

  "We're taking a good look into cyber security threats at every possible place, from physical to desktops to routers� If anything were to happen to the Web site, we have procedures in place to isolate and replace the site in under 20 minutes. We are ahead of the game with intrusion protection measures because we have already implemented an application firewall."
      Security manager at a telecommunications components manufacturing company

  "I do think that 9-11, combined with Nimda, raised the issue that terrorists could combine physical attacks with cyber attacks at the same time."
      Director of global security architecture at a Fortune 500 insurance company
  
  

• None of the respondents have instituted a corporate security mandate driven by senior management officers.

  "I believe establishing a security committee composed of senior-level executives, including CEO, CIO, corporate security officers, auditors and a risk management team is the key to making security a corporate issue, not just an IT issue."
      Security manager of a bank in California

  "There have been some senior management level directives regarding security, but I wouldn't call them a true mandate. People are paying more attention to security at the higher level but no specific initiatives are taking place as a direct result of that trend."
      Data security team leader at a paper products manufacturing company

About Sanctum, Inc. (www.SanctumInc.com)
Founded in 1997 and headquartered in Santa Clara, Calif., Sanctum, Inc. is the recognized leader for Web application security solutions. Sanctum software solutions provide automatic enforcement of intended business processes, ensuring the protection of core information and data. By detecting and defending against any unauthorized behavior, Sanctum protects customers against malicious cybercriminal activity—from theft of intellectual property and customer data, to e-commerce fraud and Web site defacement—even if a site has unknown security holes or flaws. Sanctum's solutions complete a company's security infrastructure, assure regulatory compliance and create sustainable ROI. Sanctum's customers include industry leaders in finance, retailing, healthcare, government and telecommunications. Privately held, Sanctum is funded by blue-chip venture capital firms and industry leaders including Sprout Group, Dell, Gemini Israel Funds, Fidelity Ventures, Wachovia Strategic Ventures Group, Mofet Israel Technology Fund and Walden Israel. For more information, visit www.SanctumInc.com or contact the Company directly at (408) 352-2000.

For Immediate Release
Contact:

Tara Dugan or Annie Kim
Schwartz Communications, Inc.
(415) 512-0770
[email protected]