Slashdot Mirror
Businesses Spend 20% of IT Budgets on Security
Stony Stevenson writes "Security accounted for 20 percent of technology spending last year and it's expected to rise, according to a report released Tuesday. The Computing Technology Industry Association (CompTIA) surveyed 1,070 organisations and found that on average, they spent one-fifth of their technology budgets on security-related spending in 2006. That's up from the 15 percent of IT budgets spent on security in 2005, and the 12 percent spent in 2004."
Security accounted for 20 percent of technology spending last year and it's expected to rise, according to a report released Tuesday ... That's up from the 15 percent of IT budgets spent on security in 2005, and the 12 percent spent in 2004.
That makes sense. I mean, nerf weapons count as a security expense, right?
The theory of relativity doesn't work right in Arkansas.
I have waisted more time making workarounds these "security fixes" then ever just because they
.NET on a Windows Server, which you can run the Apps on any other browser, and OS.
want to think they are safe but they never really consider the underlining problems with security.
90% of the Market is using the SAME FREAKING OS! So they work on blocking legit Web Mail so
Windows Viruses cant get in. Scanning all attachments to make sure there is no VBScript in Office
For Windows Documents. Trying to block sites that could possible be considered to have Windows Spyware.
Stop using freaking Windows all the time. Linux/Mac Workstations with VMWare to load Windows for those
Windows only apps, Stop wasting time with making Windows Console application and focus on Web Based Apps
Even if it is with
Of course gust going to a different OS isn't the only solution you need good firewalls and such. But...
The core of the problem is Windows. Get Rid of Windows or reduce it to more bit parts then your companies
security is so much better.
Yes PHB MBA wont get it, they are afraid of doing anything differently then the rest. IT people will resist
too because they don't know Linux or Macs as well as windows and are not willing to learn. But if you need
to focus on security you need be different then the rest.
You need to be flexible so If Macs or Linux becomes insecure (One to many features can cause that problem) then
your custom apps need to be multi-platform or at least cross compilable to move from one system to an other.
That is the correct direction for security. Not this Block you from getting you work done stuff.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Unless they count a UPS, RAID and tape drives as security, there is no way that security can eat up that much of the budget, except maybe if the surveyed all use Windoze...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
I wonder how much of that spending went to training their employees that "password", "letmein" and lastly "123" are *NOT* the best passwords.
Sigs are too short to say anything truly profound so read the above post instead.
Since we now have a way to track security expenditures, we should have some way to track money spent on anti-spam measures. Considering how well the anti-spam hardware and software sells, I'll venture its a nontrivial expense, as well.
Even if you're just running some spiffy implementation of spam assasin, it still gets your time at some frequency to update the rules, amongst other things.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
At some of my consulting client sites, I've been underwhelmed by the quality of their "security analyst" staff. I've found that staff seemed to be more interested in putting their name on boilerplate "best practices" to pass off to others, rather than taking a hands-on, collaborative approach in working with sysadmins to really verify that their systems are secure.
Don't even get me started on social engineering and how circumventable many secured entry systems are. It's a sad thought that someone posing as a lowly janitor could have free rein in most data centers.
P.S. Security policy writers: why not start by giving your employees with access to high-security areas a way to disable their keycards 24 hours a day by phone (including some sort of challenge/response question for them to answer)? Simple, inexpensive and effective compared to a lost or stolen keycard falling into the wrong hands.
It's the same thing people always do when they screw something up and don't know how to fix it - throw money at it. I love it when IT companies get paid to implement "security" features (speed bumps) then "service" (disable) them. It would be like funding an invasion of a country then paying for the reconstruction of all the shit you just blew up~
Haiku for you!
hahahahahaha!
Twenty percent...
Oh, that's rich. Oh my. Oh. Hoo!
Flying Spaghetti Monster, I love surveys and statistics. I've worked in internal security for the past couple years at a big accounting firm and as a security consultant for many years before this.
Everyone knows they should be doing more to stay secure, but that fact is security doesn't do anything obviously positive for the bottom line. It's like flossing: most people floss when they have some chicken stuck between their molars but they don't do it every night. (Little tip for everyone trying to get money for security: give up on ROI; sell it like you're selling an insurance policy.)
When CIOs or CISOs get these surveys they fluff the numbers because they know they are supposed to be secure even if they have a hard time justifying security spending to the Board. "Oh yeah, we spent $X on Security. That's about 15-25% of our IT budget." What they don't say is that number includes the payroll (including salary, benefits, and payroll taxes) of all IT staff that have anything to do with security, audit, or regulatory compliance.
Contrast that with asking them what they spent on email they'd probably tell you about their Exchange license fees and maybe some server hardware. They'll leave out staffing costs, retention software and SAN, etc.
My guess is that the average IT budget is spending maybe -- MAYBE -- 10% on security, audit, and compliance related expenses.
I will admit here that I didn't RTFA. If the survey population was mostly US-based publicly traded companies that fall under SOX regulations the 20% number is a tiny bit more believable because CFOs and CEOs don't want to go to jail based on a fuckup by a minimum wage (in their frame of reference) IT staffer.
obviously no deficiencies vs. no obvious deficiencies
The trickiest thing about security is that there's no reliable way to tell for sure whether it's worked or not. Any security system can be defeated by a properly designed attack, although for a given system this may never happen if there's no one who has both the resources and desire to defeat it.
But the trick is, a sufficiently well-planned attack can defeat security without anyone knowing it happened. So you can't really rely on a count like the number of detected intrusions (whether they were thwarted or not). The result of this fact is that there's a huge amount of crosstalk about "best practices" and what's Good Security and what's not. You could have a system that tracks N intrusions per year, and thwarts them all, but if there were 2N intrusions that were not detected (let alone thwarted)... you go around claiming you've got great security, but do you really?
This doesn't mean we shouldn't try to have security, obviously, but it does mean that security is a giant, tricky grey area.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
... Business spend 20% of their IT budgets - but only after spending 80% of the budget on MS software.
I can't believe business (we currently do) have "hiring/bonus/travel" freeze but don't think twice about spending money on MS Software specifically. I guess better to pay MS employees than your own.
"If you spend more on coffee than on IT security, then you will be hacked," [Richard] Clarke said during his keynote address. "What's more, you deserve to be hacked."
"It doesn't cost enough, and it makes too much sense."
You are taking a very shallow view of security here. Sure, controlling what services are listening is a good first step. But your biggest threat isn't the outside hacker. It's the inside guy. It's being able to -prove- who did what, when.
But once you move beyond that default install, and beyond shutting down unnecessary services, Linux isn't necessarily that "secure". The default install of Linux still has many problems that have to be addressed in order to have a secure system. Of course, so does Windows, but my point is that you cannot just load Linux, turn off services, and think you have anything like a secure system. In fact there are some advisable security requirements that are harder to implement on Linux than on Windows.
I have secured both to NSA recommended standards, and yes, in general I prefer Linux, but don't fool yourself that any like a default Linux install is inherently secure, especially when it comes to auditing and attribution.
A house divided against itself cannot stand.
Insightful question.
Managers and the clueless (obviously not mutually exclusive sets!) are always looking for a "security product", the silver bullet.
The reality is that security is a process, not a product. You have to incorporate it into your policies, plans and products from the ground up.
Security "products" (firewalls, IDS, NMS, etc.) are the icing on the cake, but are pretty much meaningless on their own. This is clearly not what most managers want to hear, they want to spend some money and be done. That's why there is so much money to be made in security snake oil, because the reality of information security is that it is expensive, not in terms of buying stuff, but in terms of an ongoing commitment to incorporating the principles into everything you do.
Many times this translates into the fact that the easiest path to getting something done is not the best path. That is a difficult reality for management to relate to.
A house divided against itself cannot stand.
Crazy question...since nobody else has bothered to ask it...is it possible that the average company feels they will appear more "privacy responsible" by claiming to spend a huge portion on security?
Somehow I'm picturing companies answering surveys with 20%, stock investors are probably hearing 2%-5%, and the people who actually make decisions are really putting in about 7%-12%.
- Nobody would know what RTFA meant if it didn't need to be said all the time
Seems to me that we're seeing another Y2k scenario - there is a real issue, and let's all overreact. Y2K was a profitable business for many consulting firms, contractors, and software vendors. The Y2K situation was something that needed to be addressed but by scaring C-level executives there's great profit to be made!
Read one of the security journals, look at the marketing hype coming out of Symantec, McAfee, and any number of security consulting firms - the primary message is fear. Fear of some unquantifiable buggiman come to get your precious data. Precious little data on how many monsters are out to get your data, but you best be afraid. And I agree - there is reason to be concerned, but no reason to be hysterical and dedicate one fifth of your IT budget to the nebulous Security functions.
How many of these security consultants are brand new? How many are receiving certifications from the very same groups that are attempting to promote the opinion that there's a security crisis? Can you fix security problems yourself, within your own firm? Damn likely. Many IT groups underestimate their abilities (or their senior managers do), and outsource a job that could, perhaps, be done better in house.
I realize that we can't ignore the security issue, just as we couldn't ignore Y2K. But hysterically throwing money onto the problem won't solve the problem either. Don't waste your money if you can avoid it. Don't just fall for the drama of the moment if at all possible
/* Dang, I can't type that well. */
A common misconception but easily corrected by paying attention.
Anyone who doesn't think market share is a significant contributor to a product's "security record", is a fool blinded by zealotry. There are so many critical aspects of "security" that are related to market share, it's simply an inescapable factor.
The Apache vs Microsoft ISS example where market share is skewed in the opposite direction shows the market share thing is either a feeble excuse or complete and utter marketing bullshit.
Those "paying attention" will notice that a) IIS has had better "security" for some time now and b) IIS and Apache have similar levels of marketshare. Even before then, cherrypicking an atypical example from a tiny subset of the market, does not make for a compelling argument (neither for nor against) in the general case. The plural of anecdote is not data.
Furthurmore you HAVE to bring technical aspects into the discussion for it to be anything other than worthless fortunetelling.
From a technical perspective, all the major platforms have been basically equivalent for over half a decade now (and before that, Windows NT was - "technically speaking" - streets ahead of unix variants, ironically refuting the whole "bad design" argument in one fell swoop). Further, the single biggest influence on security - users - is "non-technical".
Finally, your "marketshare is irrelevant" argument completely misses the point I was making - that even if all else was equal (ie: in any given situation, a Linux machine and a Windows machine had exactly the same probability of being compromised) you still expect to have "dozens" more Windows machines compromised than Linux machines, because they outnumber them ca. 40 to 1. Here, I'll even make a car analogy to emphasise the point; There are 100 identical cars in a garage. Ninety of them are owned by Caucasians, six by Asians, three by Negros and one by an Indian. Which ethnicity do you expect have the largest number of cars stolen from them ? Do you believe this is due to racism or statistics ?
Or, to put it another way, if you believe Windows - today - should have anything close to as "good" a "security record" as Linux, you fail at basic logic, reasoning and maths.
It's more because infrastructure 'security' has been commoditized. You now by a product to do this, another to do that, etc. What management doesn't get is that security is a process, and good security does not equal buying a bunch of commodity products. We can do without them, but most companies would rather pay consultants and vendors than listen to their own security analyst staff who have likely already given the managment 10 different ways to mitigate vulnerability to specific threats, but it only became 'real' when there was something to buy to deal with it.