Retail giant Sears currently owns roughly 80 percent of OSH, but the hardware chain is also working toward a spin-off from its parent company. "We've been relying on Sears for a lot of things, so now we're putting in our own financials, payment, and human resources systems, among others, on this journey to become independent and expand across the country," Hodgett says. "Today this process is all about risk mitigation. We know we're never going to get to zero, and you can go crazy if you try to consider everything at once, but a key part of building this IT foundation is considering data security at every turn."

One of the tools Hodgett has already employed is data leakage prevention software made by Provilla, to help safeguard sensitive employee and customer data against potential breaches, both intentional and accidental.

"As we are moving up the technology curve and adding capabilities, we're trying to augment everything we do with additional mitigation techniques for risk," Hodgett says. "We're low-tech today, so the risk is low, but as we push the envelope and do things like introduce consumer credit cards, there will lots of demand to secure everything we have, as well as compliance demands."

Expert advice

With everyone from hardware makers to services providers trying to inset their wares into the enterprise security buying cycle, there is no shortage of strategic advice. For starters, Nick Mehta, senior director of product management at Symantec, suggests blending anti-malware applications with data discovery systems.

Mehta leads a team responsible for developing and marketing Symantec's Enterprise Vault technologies, a package of data archiving and security tools. "There will always be ways to circumvent protections, and companies will always have incidents, but you can get rid of a lot of the accidental issues such as missing encryption and broken business processes by employing technologies that identify and block those types of incidents," Mehta says.

On the hardware side, Intel has begun loading its products with additional security features, including the company's recently announced Active Management Technology, which is designed to help IT administrators remotely fix devices that have crashed due to malware or other attacks.

"From an IT operational level, I do think things are getting better, but there will always be a need for continued evolution in the nature that information is stored and protected," says Malcolm Harkins, an IT security director at Intel. "Protection starts with the classification of data and its criticality to a business. Once you do that you can specify controls based on tolerance for risk."

Executives at Imperva, a provider of security and compliance technologies used in corporate datacenters, say that past security investments make it tough to convince business leaders that new tools will actually solve the information protection problem.

"For the last 10 or 15 years, customers have been throwing technologies at these problems, and senior leadership often feels that these solutions haven't proven adequate, so every purchase needs to be defended over and over again," says Robin Matlock, general manager at Imperva. "IT departments need to show leaders where the problems exist and what new options are open to them to address the problems they have. And security vendors really do need to help customers continue to make their business case."