Global State Of Energy Industry Information Security

With oil prices hovering near $40 a barrel in January 2009, the temptation will exist for energy companies to cut spending. One of the first areas that is likely to be impacted by spending cuts is technology, and, by extension, efforts to bolster information security are at risk. Security issues continue to be of prime importance and should not be sacrificed in light of lower oil prices.

As a matter of fact, security and privacy issues are becoming ever more critical and important in the business world as the Internet continues to emerge as the primary tool for sharing information – both within an organization and to the public at large. Moreover, the prevalence of laptops and other mobile devices in the business world guarantees that critical data is likely distributed across many locations and accessed by many people, making the need for a robust security and privacy strategy a number one priority for companies today. The energy sector is not immune to this need.

Recently, PricewaterhouseCoopers in partnership with CIO Magazine, surveyed a number of CIOs and other executives across a variety of industries, including the energy sector, to determine their approach to privacy and security issues.

In addition to collecting data from energy industry executives about their approach to privacy and security, PricewaterhouseCoopers and CIO Magazine offer recommendations to companies to help improve and address security and privacy needs in 2009 and beyond.

The energy respondents represent a broad geographical spectrum, with participants from North America, South America, Asia, Europe, Africa and the Middle East. Forty percent reported revenues of greater than US$1B.

High-Level Findings

Buoyed by high prices prior to the recent fall of oil prices, and the unprecedented levels of demand and new supplies coming on stream for many commodities, energy executives enjoy improved results across a range of key performance indicators for the industry. While improvements in profitability mask substantial increases in operating costs, it’s clear that one crucial cost center - advancing security and privacy capabilities - has been a strong sector priority for the last couple of years.

Last year, the survey noted progress was made in creating and filling the security chief’s position. This year’s results reflect the kinds of strategic advances that companies make when knowledgeable security leadership is firmly in place. Energy respondents report major gains, for example, in implementing an overall security strategy (67% vs. 59% in 2007), actively monitoring information security intelligence (59% vs. 46%), and investing in the capabilities that build employee security awareness - such as training programs (58% vs. 41%) and people dedicated to running them (58% vs. 45%).

The survey also notes two other key observations from this year’s results. The first is that when security breaches occur, they hurt. Asked about the business impacts of security incidents, many sector respondents cite financial losses (38%), lawsuits or an increase in legal exposure (33%) and intellectual property theft (29%). We note, however, that these represent only the impacts respondents know about. Our second key observation is that, despite strategic advances in security and privacy, about four in every 10 respondents cannot answer basic questions about the risks to their information.