There are many people who dont worry about reputations or bad publicity as long as their name is spelled correctlybut those people certainly dont work in the financial services industry. Reputation is a key component to a successful financial services business, so companies arent likely to issue a press release when someone successfully attacks their network or Web site.

Several factors explain why companies fail to report such attacks, says Bill Barrett, partner and leader of the technology and security risk services practice for the New York financial services office of Ernst & Young. In the Global Information Security 2003 report conducted by E&Y, respondents assert negative publicity and damage to brand or reputation are the biggest reasons causing financial services companies to keep their mouths shut. One of the biggest factors is concern over reputation and the impact to the trust that financial services and insurance companies deal with, says Barrett. As a result, they are reluctant to let the public know about instances.

One day, he believes, companies will be forced to report such attacks. A California law states if there is a breach of confidentiality, the companies have to report that breach to the individual. Organizations would like to keep much of this quiet, but I think theres going to be increased pressure certainly to notify customers or clients in the event something were to happen that would breach peoples accounts, says Barrett.Respondents to the survey are overwhelmingly in favor of separating security-assessment firms from vendors. Eighty-eight percent believe this is a best practice. Its important to separate these and have some independence, says Barrett. If you are using a product and a specific vendor to do your assessment work, the chances are you are going to get recommendations as to their product suite, as opposed to having a more independent assessment of what are truly the best products in the marketplace.