"Are IT technologies being used efficiently? No. Are they optimized? No," says Michael Rasmussen, director of research and information security at Giga Information Group. "Does it mean companies need to outsource it all? No...they can handle this."

Paul Robertson, director of risk assessment at Herndon, Va.-based TruSecure Corp., says IT and security administrators need to take the time to focus on what's already in their shops.

"If you have things that will provide you with protection, and you're not using them properly, it's a waste," says Robertson. "Obviously, they're not getting the best value for the dollar."

[ Read more ]