Forgot your password?
typodupeerror
Security IT

Shrinking Budgets Tie Hands of Security Pros 63

Posted by CmdrTaco
from the plastic-handcuffs-for-everyone dept.
An anonymous reader writes "RSA Conference released the results of a recent survey of security professionals regarding the critical security threats and infrastructure issues they currently face, including those exacerbated by the current economic climate. The study indicates that even though practitioners are most concerned about email phishing and securing mobile devices, technologies addressing these needs are at risk of being cut from IT budgets. The survey also asked what technology investments will likely be bypassed or curtailed due to spending freezes and budget cuts."
This discussion has been archived. No new comments can be posted.

Shrinking Budgets Tie Hands of Security Pros

Comments Filter:
  • by walmass (67905) on Monday July 27, 2009 @08:44AM (#28836311)
    The survey is reporting something that every single security professional that has managed a budged had known for a long time, even before the recession (except may be the preriod around Y2K)

    The sad truth is, at most companies management sees security is an unnecessary cost that they reluctantly tolerate because of SOX and industry regulations like PCI-DSS. They are quick to point out that security does not earn profits (and forget that it actually protects the profits). So the CEO tells the CIO to trim his budget, and given the choice of keeping the servers functioning or users getting phished, the CIO opts for more pressing need. (at 99% of the places, the security function reports to the CIO or CTO but that is for another bitching session)

    Then of course something goes wrong, and the security person gets yelled at because s/he did not do his job. So then the coffers open, and the company spends a ton of money that could have been fixed for less at the right time (TJX breach).

    The solution lies with security pros: they need to frame their budget requests as business cases: if we do X, we will protect $Y of revenue (Point out that a data breach at company ABC cost them $ZZ). And if management does not fund the budget, have them formally, in writing, accept the risk.

    And always keep your resume updated :-)
    • Re: (Score:2, Funny)

      by Kurusuki (1049294)
      This is probably the best bit of advice I've seen on ./ in a long while. This one is going is going in my jewels of advice binder. Now the real question, nano or vi.
    • by shentino (1139071)

      You have a point about the resume.

      When tensions get high, setting the IT guys up for a termination justifying failure goes a long way to keeping the budget trimmed of any severance obligations.

    • Re: (Score:3, Insightful)

      by SlashWombat (1227578)
      This is also known as "the true cost of using Microsoft Products".
  • by Z00L00K (682162) on Monday July 27, 2009 @08:50AM (#28836397) Homepage

    When the budget cut has gone far enough to strip down all security, certificates expires, competence leaves ship and nobody really knows how it works anymore. Then the cybercriminals enters the systems and use them for their purposes.

    And management sits there looking completely confused because they have cut down on the people knowing how to do security.

    Especially bad is it if it's about having a system that handles large amounts of economic transactions and are storing credit card and personal information about a lot of people.

  • by Anonymous Coward

    People always seem to think Security is something you can BUY. You can't really 'purchase' security, all you can do is implement policies, and select tools to assist in creating and implementing those policies.

    Most of these tools are free [is in beer AND speech].

    One can create a secure organization with very little money.

    There are a lot of unnecessary IT "expenses", like the latest BS convention ie: VoiceCon, InterOP, etc. Trim the fat from IT, and people will see what can be done for very little money.

    • Re: (Score:3, Interesting)

      So you want to tell me that the security consultant/operator that tells how to implement witch security policies, configure firewalls/access control and the trains the staff - can be cut and you get the same for free out of thin air? How exactly do you want to accomplish that one, please share your wisdom!?

      Sure, there are BS expenses, but that's a question of getting the right person to do the job.

    • EXACTLY. You captured this better than my post below. Thanks! Security isn't a bunch of products, but nobody gets that. In shops lucky enough to have skilled security folk, the security team still buys stuff, because it is mandated by management, not because it is a good solution. In places without the skills, well, you spend money because you are too stupid to know any better. Lose/lose situation.

      • Re: (Score:3, Insightful)

        by mlts (1038732) *

        The trick is finding a security professional who knows this, and is able find the security tools that turn the company's policy, their security needs, and budget into implementable technology. A company can buy every single product sold in SC Magazine and the CISSP magazines. It won't do them much good because even the best security product will not give much protection if not implemented right.

        For example, take a high grade HSM (hardware security module). If the admins of it allow everyone and their bro

    • The problem is that you need to keep spending in IT to have enough money to run IT. Generally they cut the budget on you when you don't spend much so IT people are forced to upgrade hardware when it really doesn't need upgraded to have enough cash to spend when you really need to upgrade (server breaks, get a new system that requires new hardware, etc) along with management's love for conferences thinking it will "inspire", leads to a bloated IT budget but with no real way to cut it without losing valuable
    • by kent_eh (543303)

      Trim the fat from IT, and people will see what can be done for very little money.

      Unless you trim so much that the people who know what they are doing also get trimmed.

  • by oahazmatt (868057) on Monday July 27, 2009 @08:54AM (#28836437) Journal
    We have a very paranoid security department where I work. On top of boot-level encryption, mandatory anti-virus software, various "agents" that try to predict whether or not you would in fact allow some strange program to do what it wants to do, system monitors that make sure everything is up to date and as it should be before you connect to the network, proxies that ban websites with harmful keywords and annoying pop-ups caused by blocking Active-X components, we still get several people throughout the week who report virus infections on their work PCs.

    We have people who install Firefox to get around the IE settings so they can visit sites that they know are not permitted. We have people who browse torrent sites and adult sites and are "shocked" when we show them the links in the history. We've had people who blatantly admit "Yeah, I let my kids play on my company issued PC and they find ways around that stuff."

    Maybe that's why the security budgets get cut. You can only secure so much until you secure it by locking out the user entirely.
    • Re: (Score:1, Informative)

      by Anonymous Coward

      This is retarded. Why don't they just whitelist the applications, ActiveX controls, etc. that you are allowed to run. Then they don't need to worry about users (or websites) installing random bits of software. Windows has supported this for a decade.

      • by Lord_Frederick (642312) on Monday July 27, 2009 @09:13AM (#28836681)

        If the grandparent's organization is anything like mine, the issue isn't the lack of technical solutions for locking down computers. It's the unwillingness of managers to put their neck on the line and sign off on suggestions like this.

        • Re: (Score:3, Insightful)

          by Rob Riggs (6418)
          No, it's because everyone else recognizes that the risk is that you end up using the same applications and web sites for a decade. People have to be able to try new stuff. It's a far greater risk to the organization to stagnate. You'll end up with people that are perfectly happy using decades-old software and visiting only internal web sites.

          Companies need their employees to take on the risk of trying new applications and web sites without constantly asking for permission. It's a big driver of growth

          • I don't think implementing a few basic security practices are going to cause idea stagnation, yet best practices are constantly shot down in favor of sexy monitoring software. I guess it makes sense for a manager. What you would rather put on your resume?

            "Implemented 2 million dollar intrusion detection and anti-malware enterprise software solution with staff of security engineers monitoring network traffic 24/7"
            OR
            "Took the damn users out of the local administrators group."
    • On top of boot-level encryption

      A requirement for laptops.

      mandatory anti-virus software,

      Why not? I wouldn't recommend running any Windows machine without anti-virus software.

      various "agents" that try to predict whether or not you would in fact allow some strange program to do what it wants to do

      Hmmmm? Like?

      we still get several people throughout the week who report virus infections on their work PCs.

      Are you surprised? Why?

    • Re: (Score:3, Informative)

      by MrLogic17 (233498)

      I have mod points, but had to chime in.

      This is VERY easy to solve. Don't let your users have admin level accounts. Done.
      You will never see virus/mailware installs - because even if users do open up that strangely named attachment, their account doesn't have permissions to install. Ditto for the manager's kids.

      Solves a lot of support headaches too. Thee only software they have is software that you've tested, approved, and installed yourself. (via the software deployment method of your choice)

      Again, this

      • Again, this is all dependedent on getting manager buy-in.

        And therein lies the rub. When the managers want the ability to install their own stuff and have the ability to override any policy I want...

        Well, let's just say I'm not surprised that their systems tend to be some of the ugliest ones I have to deal with.

    • Re: (Score:3, Insightful)

      by Hammer (14284)

      Parnoid and smart ?? Or Just Paranoid?.

      Many IT-departments implement mandatory password changes and antivirus
      Also common is various filter programs

      Automated PW changes are actually counterproductive according to several studies as it makes the selected passwords more predictable. Better to educate users as to what is a good PW

      Antivirus is a good thing and should be in place if you use windows

      Filters DOES NOT WORK. At least not as intended.

      The only thing that works in the long run is education. And harsh pun

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      I'm sorry but switching browsers does NOT suddenly allow you to circumvent your proxy server. So no, users are not using Firefox to "visit sites" that they couldn't using IE. That's not what browsers do. This is technology 101. This sounds like someone who doesn't know what they were talking about, posting something they 'heard' from another end user.

      • by jp10558 (748604)

        Well, not true. If you have a firewall rule blocking outgoing traffic except via the proxy server then sure, but if you just have IE via Group Policy using the proxy server, then any browser directly connecting to the internet will bypass that... And it IS what browsers do...

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      Boot level encryption, antivirus software, and "agents" are in themselves not bad. However, misconfigured they can become a nuisance to employees and kill productivity.

      Boot level encryption is a must for laptops these days. No company wants to have a front page headline of "unsecured laptop stolen, thieves grab $BIGNUM of users' personal data and put it for sale on the black market." Get a laptop with a TPM chip, and boot level encrypt doesn't even have to ask for a passphrase, as PGP, BitLocker, and a n

  • bullshit (Score:4, Insightful)

    by SCHecklerX (229973) <thecaptain@captaincodo.net> on Monday July 27, 2009 @09:01AM (#28836519) Homepage

    It's just that companies would rather buy something than use their highly-skilled security staff. Or maybe their security staff isn't so skilled, and that's why they require the expense of ridiculously expensive canned security software, vs. designing an infrastructure that makes sense and using the best of breed tools for the job mixing open source, in-house, and commercial stuff.

    • by mlts (1038732) *

      Part of the reason for this is that PHBs are more easily swayed by a smooth talking salesman selling a shiny new appliance that looks good in a rack, as opposed to a desperate IT manager who needs more headcount for admins.

      Another reason is that employers in general are averse to hiring people right now. If some security appliance costs $200,000, it is a lot more attractive to the people with the purse strings than a $50,000/year admin. Mainly because of the philosophy of "machines don't get disgruntled"

  • I have seen a lot of places that insist on buying a "solution" to the problem, when in fact the solution barely touches the problem. it works around a lot of things, but never really hits right on it. So you've spent a lot of money on something that doesn't really do the job of a person in that role.

    The funny part about security is that for all it's sex appeal, real security is actually pretty boring. Oh the hotness of configuration management using tools that are already available on the windows or linux b

    • by karnal (22275) on Monday July 27, 2009 @09:14AM (#28836693)

      We all love honeypots and whatnot, but those things need to come well after patching, configuration management, removing/pruning user administrative permissions, and controlling which software you allow, and strong authentication enforcement. This doesn't have to cost a lot of money.

      Actually, doing all of these things does cost money - you need to have someone hired on that can do all of these things, and you have to pay them a salary.

      In the long term, it's not a lot of money. But short term thinking appears to be taking over in this economy. Especially if there's no immediate threat deemed by Management in not having basic safeguards in place.

      • At least it has been for several decades. The current economy has just made that worse. People are worried that if you have a bad quarter your stock will go in the toilet and kill your company. However, the flip side is getting earnings as best as possible from quarter to quarter, without regard to the fact that if you invest a little more now, you might get a huge windfall 3 years from now.

        Security for companies is the same as security for that poor family in the inner city. It would be nice to have a

  • The study indicates that even though practitioners are most concerned about email phishing and securing mobile devices, technologies addressing these needs are at risk of being cut from IT budgets.

    A fat budget won't help you buy what you need to fix this problem: Smarter users.

    • Re: (Score:2, Insightful)

      by brindleboar (1154019)
      I've been saying something like this for years -- if we could just get rid of those pesky humans, all of our systems would run flawlessly.
    • Re:budget? (Score:4, Insightful)

      by Seth Kriticos (1227934) on Monday July 27, 2009 @09:19AM (#28836759)

      Depends on how you see it. Users are dumb, so if you spend your money to train your staff and make them just a tiny bit smarter, then your investment is worth it.

      On the other hand, if you search for a purely technical solution, you are borne to fail, there I agree with you.

      Sadly management often does not have the foggiest idea on how to allocate resources in a smart way in this area, so I don't expect the situation to improve any-time soon.

  • This article isn't particularly informative, especially in regards to areas where spending will be reduced. This isn't a very effective way to assess the state of security -- to do that it must be within the context of the industry/business, and preferably to IT in general. If budgets are generally being cut by 20%, then the fact that security is doing that is nothing special. Further, budget is only part of the picture: institutional priorities are also very important. How is the allocation of staff time c
  • by grahamsaa (1287732) on Monday July 27, 2009 @09:13AM (#28836683)
    I'm fortunate to manage an IT department at a company that values security. We do routine audits and pen test our own systems -- occasionally we find a hole, and we fill it. I've never been pressured to skimp on security.

    Other commenters may argue that security is not something that companies can "buy," and they're right, to a point. Expensive proprietary firewalls are, in my experience, no better (and sometimes far worse) than a properly configured linux box. But companies do have to "buy" security in the sense that they need to budget time to ensure that systems are properly configured. I can set up a linux firewall in a matter of minutes, but to do it properly (especially when it must allow VPN, SSH, access to multiple databases, limited FTP, etc.) it takes much more time.

    If companies realize how much their data is (are?) worth, they should also consider what's at stake if it's stolen or misused. Security doesn't have to be the primary investment for most companies, but it must be a high priority. If it's not, eventually bad things will happen.
  • by X.25 (255792)

    I wanted to get back to contracting and do some more security work, because I miss it.

    I was stunned by the fact that so many companies are now not looking for professionals with low-level experience, like before, but rather for people who have experience in paperwork. ITIL, ISO xxxxx, bla, bla, bla.

    It's as if people are not actually DOING security anymore, but are just writing and debating about it.

    No wonder they have budget issues, when they don't know what they're doing, so they need to spend lots of mone

    • by mlts (1038732) *

      Thanks to Enron and other companies, and the knee-jerk regulations put into place after that like Sarbanes Oxley, a security person has to be familar with all these laws, like ISO 9000, ISO 10000, PCI-DSS.

      Yes, you will be doing tons of TPM reports to ensure that the company is compliant, but if a company doesn't have the CYA papers, and something happens, there is a chance of prople facing prison time, and shareholders suing.

      Its just how the game has changed. Locksmiths used to forge custom locks out of me

  • by Anonymous Coward on Monday July 27, 2009 @09:36AM (#28836983)
    In June of this year, my employers had a major business continuity scenario - an electrical fault with the UPS took out a lot of desktops, several servers and most of our network connectivity on one phase. This was at 6PM on a Friday. Not only is it incredibly hard to get your standard suppliers to ship any replacement gear for the following day on a weekend, its incredibly hard to actually get to talk to anyone! Now, I only recently took over the infrastructure management role, and one of my first goals was to put into place a proper Business Continuity plan. We have alternative premises with a major continuity provider on contract, but we have no plan and our actual capacity requirement now far exceeds what it was when the original alternative premises arrangement was put in place.

    When this event happened, we were in a very touch and go situation - we did not know if we could recover the business for opening on Monday. And we are extremely IT reliant!

    To cut a long story short - through putting in a lot of extra hours that weekend, and a lot of travelling to various IT shops within a 50 mile radius, we managed to get the business back to the point where we could open on the Monday without visible issue.

    When that event happened, my BCM plan had been on the desks of the company leadership for a month. After that event, it got bumped up to the next board meeting. And at that board meeting, the entire plan was indefinitely postponed due to funding. No intermediate plan was asked for, no alternative. The plan had several different levels of expenditure to choose from, and they ignored all of them.

    Barely one month after a 'can we continue to run the business' situation, the board rejected the plan which would have made that situation a non-issue, even at the cheapest option.

    I now have several interviews elsewhere. The sooner I can get out of here, the better.

    Posted anonymously for obvious reasons.
    • Re: (Score:2, Interesting)

      by Anonymous Coward

      I, too, feel your pain.

      I used to work at a healthcare IT company. They had a legal requirement to have a Disaster Recovery Plan and a Business Continuity Plan, because if they were unavailable, it could impact the safety of tens of thousands of people. You know, life or death stuff.

      They were also contractually obligated to to have a few other odds and ends, such as security and privacy staff, centrally managed anti-virus, configuration control, change management, security training, incident response, etc, e

    • by khchung (462899)

      through putting in a lot of extra hours that weekend, and a lot of travelling to various IT shops within a 50 mile radius, we managed to get the business back to the point where we could open on the Monday without visible issue. ...

      the board rejected the plan which would have made that situation a non-issue, even at the cheapest option.

      (emphasis mine)

      Did you realize you have just shown to your board that, through your own heroic efforts, that they don't need your plan and can still recover from such failures!

      Now, can you tell me why a sensible business person would want to spend more money to on a contingency plan where they know they can already recover from without spending a dime?

  • No one has enough money in the budget for security, until a break-in nearly disables them. What are the chances? (Fire your security staff, and find out!)

    Similarly, making copies of Windows to deploy on your business floor and ask "what are the chances?" and you'll find out. *I*didn't*call*, but a year or so after I left, I was told the company trying to get ME to pirate Microsoft Windows 98 got a visit from the BSA. And as you all know, they don't leave without a fire alarm being pulled or a $100,000 chec

    • by mlts (1038732) * on Monday July 27, 2009 @12:45PM (#28840491)

      In a recession, security is the last thing a business should cut.

      The unemployment rate is high. This means that people who wouldn't think of things in normal times would turn to other means to supplement their income to keep a roof over their family's heads. So, someone who would normally give the finger to someone overseas asking for brief use of a username/password for $500 would happily give it in these times in order to keep the repo man away for another month.

      More criminal organizations (domestic and overseas) realize there are profits to be made in capturing data stolen laptops for not just hardware, but the data on the machine. The data can be sold, or used to blackmail or extortion.

      Employees are more likely to be disgruntled due to layoffs and cutbacks. So, vandalism and outright internal theft is on the rise.

      There are a lot more regulations than before that make companies face shareholder lawsuits and corporate officers face prison time should a major breach occurs and a breach in process found.

      Software CD keys are worth money, and a divulged volume CD key can force a company to re-buy every single license of a product as per EULA stipulations.

      Outside attacks are more and more sophisticated as time goes on. To use an auto analogy, car companies are not using the same disc cylinder used on autos in the 1950s; they have moved to sidewinder cuts and "laser cut" keys. Same with security. A company has to keep abreast of new threats as a matter of life, just as CCTV cameras and bump-resistant locks on the doors are now the standard.

  • Everyone knows that computer security is provided by AntiBaddness software that magically cleans all badness from your computers. Money is much better spent on applications that look pretty.

  • Infosec has jumped the shark.

    - There are too many nitwits in the community. So much money has been wasted on the posers.
    - Premium capital for "the best protection" (which is still vulnerable) vs. moderate capitol and common sense (which is still vulnerable). The latter wins in this economy.
    - Don't play the TJX card, either... their stock went up, their customers numbers have risen; no one cares about that breach (or no one cares thats been LOUD enough). If the bottom line wasn't really affected that muc
  • Sorry... but it is about damn time. Security has gotten this halo around it, where those of lackluster abilities are setting the directions of company business based on the model of "OMG, a Bear!", while those of us analysts that actually produce information and analytics crucial to the company's success are sitting in the unemployment line. Too often have I seen developmental work that would introduce efficiencies into the organization blocked a security analyst who hasn't the first clue about the work I

For every bloke who makes his mark, there's half a dozen waiting to rub it out. -- Andy Capp

Working...