When it comes to implementing a security policy, Ricky Mehra, director of IT security and internal controls at Indigo, said businesses have to align IT with corporate objectives.

“Don’t evangelize security as insurance,” said Mehra, who was one of five panelists at a Microsoft-sponsored roundtable Thursday. “Try to show an environment in security as a strategic enabler.”

Likewise, Pat Kewin, director of Trend Micro, said businesses need to think about aligning security requirements with business goals.

“Until that happens, organizations will have trouble getting funding,” said Kewin.

Steve Lloyd, chief security advisor at Microsoft Canada, said security needs to be thought of as part of doing your day to day business.

“Stop looking for ROI,” said Lloyd. “Security should be a part of your business plan . . . As soon as you start losing account numbers and passwords, you lose your customer’s trust.”