Enterprise information security is becoming more difficult to do.

This is due to a number of factors such as understaffed enterprise security, with the most impacted areas being network security (44 percent), endpoint security (44 percent), and messaging security (39 percent).

Another is enterprises are embarking on new initiatives that make providing security more difficult. Initiatives that Information Technology (IT) rated as most problematic from a security standpoint include infrastructure-as-a-service, platform-as-a service, server virtualization, endpoint virtualization, and software-as-a-service.

Finally, IT compliance is a huge undertaking. The typical enterprise is exploring 19 separate IT standards or frameworks and are currently employing eight of them. The top standards include ISO, HIPAA, Sarbanes-Oxley, CIS, PCI, and ITIL.

These are the findings of Symantec Corp. in its global 2010 State of Enterprise Security study. The study found that 42 percent of organizations rate security their top issue. “This isn’t a surprise, considering that 75 percent of organizations experienced cyber attacks in the past 12 months. These attacks cost enterprise businesses an average of $2 million per year,” it stated.

The study is based on surveys of 2,100 enterprise CIOs, CISOs and IT managers from 27 countries in January 2010.

“Protecting information today is more challenging than ever,” said Luichi Robles, country manager, Symantec Philippines. “By putting in place a security blueprint that protects their infrastructure and information, enforces IT policies, and manages systems more efficiently, businesses can increase their competitive edge in today’s information-driven world.”

Security is of great concern to global enterprises. More than two-fifth of enterprises rank cyber risk as their top concern, more than natural disasters, terrorism, and traditional crime combined. Reflecting that perception, IT is intently focused on enterprise security.

On average, IT assigns 120 staffers to security and IT compliance. Enterprises rated “better manage business risk of IT” as a top goal for 2010, and 84 percent rated it absolutely/somewhat important. Nearly all the enterprises surveyed (94 percent) forecasted changes to security in 2010, with almost half (48 percent) expecting major changes.

Enterprises are experiencing frequent attacks. In the past 12 months, 75 percent of enterprises experienced cyber attacks, and 36 percent rated the attacks somewhat/highly effective. Worse, 29 percent of enterprises reported attacks have increased in the last 12 months.

Every enterprise (100 percent) experienced cyber losses in 2009. The top three reported losses were theft of intellectual property, theft of customer credit card information or other financial information, and theft of customer personally identifiable information. These losses translated to monetary costs 92 percent of the time.

The top three costs were productivity, revenue, and loss of customer trust. Enterprises reported spending an average of $2 million annually to combat cyber attacks.