IDC predicts that the increased focus on security since 9/11 will translate into an $80 billion market for IT security and business continuity in 2002, growing to $155 billion by 2006. The biggest security challenge for companies is not in knowing that they need to spend more, IDC found, but in deciding how best to spend their security dollars.

“The current market is a confusing mosaic of undifferentiated products, services and companies offering solutions,” John F. Gantz, Chief Research Officer and Senior Vice President at IDC, said in the company’s press release on its findings. “This confusion remains an inhibitor to corporate spending. The companies that will come out ahead in this environment are those that work closely with their clients to develop realistic risk assessments and plans that provide the most protection within the budget available.”

His advice mirrors that of the panelists in the recent Ernst & Young webcast on corporate security covered in the accompanying article in today’s issue of the newsletter. The three IT security experts who staffed the panel said that, without a plan that carefully aligns security needs with business priorities, a company won’t know where to start or where to focus its security efforts.

How does a company go about aligning its IT security and business priorities? The answer will vary by company, which is why companies should not just copy the IT solutions adopted by companies they admire or those touted by IT experts, the panelists said. Instead, companies should look at how their business would be impacted by the most likely forms of security breach, and set priorities from there.

For example, a company that is getting a large percentage of its revenues from online ordering could be severely damaged if a denial-of-service attack blocked its customers’ access to that site. A company whose production facilities are heavily computerized might want to focus on protecting those operations from malicious online tampering designed either to interfere with manufacturing or to release chemicals into the environment. A company that stores highly confidential client information – anything from bank account numbers to product recipes to protected legal information – will want to guard those records from hackers who might seek to steal or release the information.

These are just a few examples of the types of situations companies could be faced with in the event of an IT security breach. Detailed scenario planning will help companies to determine those risks that are both most costly and most possible. Only armed with this information will companies be equipped to decide what types of security will serve them best.

The lack of this type of information helps to explain why IDC found that interest in buying security solutions peaked soon after the terrorist attacks on New York and Washington on Sept. 11, 2001, but failed to result in actual purchases. “Corporate buyers were confronted with a difficult situation – their understanding of the security need was high, but their ability to quantify the risk of a security threat was low,” IDC’s Gantz said. “This uncertainty about the risk caused many companies to delay their purchase decisions. The result was a gap between the need for security and corporate investments in security solutions.”

We can only hope that corporations have used the intervening months to do their homework and lay out a workable approach to improving their security. If IDC is correct in projecting that a big increase in IT security spending is on the way, it would be nice to know that the spending is going to technology that will really make a positive difference.