TheInfoPro, an independent research company for the IT industry, announced today new findings from its Information Security Study that point to application security as a key concern and priority for budgets moving forward into 2010.

TheInfoPro’s Information Security Study (Q2 2009) is based on interviews with 246 security pros at Fortune 1000 (F1000) organizations and midsize enterprises (MSEs) in North America and Europe that were completed between February and May 2009. The study also showed that 82 percent of respondents said that applications available outside the corporate firewall infrastructure remain the top concern.

Application Security For The Future
TheInfoPro’s study illustrated that just over half of applications cited among F1000 participants are procured from outside their organizations. Unauthorized use of applications ranked as the second most frequently cited area of application security concern, followed by third-party application vulnerability and malware injection into applications.

Thirty-eight percent (38 percent) of F1000 respondents report using static application code analysis tools in their organizations, with an additional 17 percent reporting plans or initiatives under way to do so in the future. Results from MSE organizations vary only slightly from those of F1000-sized enterprises, with the exception that tool adoption rates are lower, consistent with adoption data of a number of other security technologies that follow 18 to 24 months behind the F1000.

Key Trends in Information Security
The study takes an in-depth look into the key trends occurring across all areas of the information security landscape, within disciplines such as network security, security management and infrastructure security, outlining where security departments stand in terms of budgets, technology roadmaps and technology provider choices and ratings.

Information security organizations overall noted a large decline in spending for 2009. Of the study participants, 42 percent cited they would spend less in 2009 than they did in 2008.

Almost all interview participants rated identity management as their key spending increase for 2010. In network security, the study showed an increase in application firewall and network access control, at 29 percent and 26 percent, respectively. The same was seen in infrastructure security, with 41 percent indicating they will spend more money on data loss prevention.

“Like everywhere in IT spending, belts tighten quickly among security organizations. With strong spending in 2008 dramatically decreasing in 2009, outlook for 2010 is only marginally positive,” said Bill Trussell, TheInfoPro’s Managing Director of Security Research. “However, in emerging trends, virtualization does not appear to be a driver for security spending, and the adoption of external cloud computing services might be delayed due to increased concern overall on implementing such a strategy.”