Shrinking Budgets Tie Hands of Security Pros 63
An anonymous reader writes "RSA Conference released the results of a recent survey of security professionals regarding the critical security threats and infrastructure issues they currently face, including those exacerbated by the current economic climate. The study indicates that even though practitioners are most concerned about email phishing and securing mobile devices, technologies addressing these needs are at risk of being cut from IT budgets. The survey also asked what technology investments will likely be bypassed or curtailed due to spending freezes and budget cuts."
Budget has always been a problem (Score:5, Insightful)
The sad truth is, at most companies management sees security is an unnecessary cost that they reluctantly tolerate because of SOX and industry regulations like PCI-DSS. They are quick to point out that security does not earn profits (and forget that it actually protects the profits). So the CEO tells the CIO to trim his budget, and given the choice of keeping the servers functioning or users getting phished, the CIO opts for more pressing need. (at 99% of the places, the security function reports to the CIO or CTO but that is for another bitching session)
Then of course something goes wrong, and the security person gets yelled at because s/he did not do his job. So then the coffers open, and the company spends a ton of money that could have been fixed for less at the right time (TJX breach).
The solution lies with security pros: they need to frame their budget requests as business cases: if we do X, we will protect $Y of revenue (Point out that a data breach at company ABC cost them $ZZ). And if management does not fund the budget, have them formally, in writing, accept the risk.
And always keep your resume updated
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
First, you are assuming that the security pro actually gets an opportunity to explain the risks. You'd be surprised how rare that is.
Next: if you do a great job and nothing happens, management actually starts wondering why a security person or department is needed. Lastly, and most importantly as the grand-parent pointed out:
- the dollars are finite.
- if there is a
Re: (Score:3, Insightful)
Re: (Score:1)
That old adage is eternally true... "the squeaky wheel gets the grease". The Windows guy that fixes stuff is seen as more valuable than the guy who prevents those things from going wrong in the first place. It's simply a human weakness. Reaction is observable, prevention isn't.
You should be moded +20 insightful. I work for a living (well below my education) building pools (I love it, actually).
A friend and I run a server together part time. He is a good problem solver, while I am good at avoiding them. I do more work on the server because I read various security related websites and blogs (/. [LOL!!!] cDc, governmentsecurity.org et al... Sorry, my bookmarks are on my work PC). My work on the server is done through a "test box" and then applied after. All my friend's work i
Re: (Score:2)
Sometime they don't want to understand and they don't want to know. They are not negligent if they did not know, they have insurance against theft. Lots of business might be happier locking the door with a deficient (but not terribly so) and figure on filing an insurance claim if something even happens than with spending $$$ to build the uncrackable system.
When the insurance industry starts doing IT security audits and adjusting rates accordingly you will Management change their minds on security spending
Re: (Score:2)
You have a point about the resume.
When tensions get high, setting the IT guys up for a termination justifying failure goes a long way to keeping the budget trimmed of any severance obligations.
Re: (Score:3, Insightful)
And then there will be a price to pay. (Score:5, Interesting)
When the budget cut has gone far enough to strip down all security, certificates expires, competence leaves ship and nobody really knows how it works anymore. Then the cybercriminals enters the systems and use them for their purposes.
And management sits there looking completely confused because they have cut down on the people knowing how to do security.
Especially bad is it if it's about having a system that handles large amounts of economic transactions and are storing credit card and personal information about a lot of people.
Re:And then there will be a price to pay. (Score:5, Interesting)
And all of this is because IT never seems to be able to make management understand :
1) Security is not a cost but an insurance.
2) PHB's will never adhere to simple guidelines as to what is safe.
3) The bad guys are out there
Re: (Score:1)
And all of this is because IT never seems to be able to make management understand no matter how hard they try or what tactics they take:
There, fixed that for ya!
IT Budgets == Bloated (Score:2, Interesting)
People always seem to think Security is something you can BUY. You can't really 'purchase' security, all you can do is implement policies, and select tools to assist in creating and implementing those policies.
Most of these tools are free [is in beer AND speech].
One can create a secure organization with very little money.
There are a lot of unnecessary IT "expenses", like the latest BS convention ie: VoiceCon, InterOP, etc. Trim the fat from IT, and people will see what can be done for very little money.
Re: (Score:3, Interesting)
So you want to tell me that the security consultant/operator that tells how to implement witch security policies, configure firewalls/access control and the trains the staff - can be cut and you get the same for free out of thin air? How exactly do you want to accomplish that one, please share your wisdom!?
Sure, there are BS expenses, but that's a question of getting the right person to do the job.
Re: (Score:2)
EXACTLY. You captured this better than my post below. Thanks! Security isn't a bunch of products, but nobody gets that. In shops lucky enough to have skilled security folk, the security team still buys stuff, because it is mandated by management, not because it is a good solution. In places without the skills, well, you spend money because you are too stupid to know any better. Lose/lose situation.
Re: (Score:3, Insightful)
The trick is finding a security professional who knows this, and is able find the security tools that turn the company's policy, their security needs, and budget into implementable technology. A company can buy every single product sold in SC Magazine and the CISSP magazines. It won't do them much good because even the best security product will not give much protection if not implemented right.
For example, take a high grade HSM (hardware security module). If the admins of it allow everyone and their bro
Re: (Score:2)
Re: (Score:2)
Trim the fat from IT, and people will see what can be done for very little money.
Unless you trim so much that the people who know what they are doing also get trimmed.
Can't budget for human stupidity (Score:5, Informative)
We have people who install Firefox to get around the IE settings so they can visit sites that they know are not permitted. We have people who browse torrent sites and adult sites and are "shocked" when we show them the links in the history. We've had people who blatantly admit "Yeah, I let my kids play on my company issued PC and they find ways around that stuff."
Maybe that's why the security budgets get cut. You can only secure so much until you secure it by locking out the user entirely.
Re: (Score:1, Informative)
This is retarded. Why don't they just whitelist the applications, ActiveX controls, etc. that you are allowed to run. Then they don't need to worry about users (or websites) installing random bits of software. Windows has supported this for a decade.
Re:Can't budget for human stupidity (Score:5, Insightful)
If the grandparent's organization is anything like mine, the issue isn't the lack of technical solutions for locking down computers. It's the unwillingness of managers to put their neck on the line and sign off on suggestions like this.
Re: (Score:3, Insightful)
Companies need their employees to take on the risk of trying new applications and web sites without constantly asking for permission. It's a big driver of growth
Re: (Score:2)
"Implemented 2 million dollar intrusion detection and anti-malware enterprise software solution with staff of security engineers monitoring network traffic 24/7"
OR
"Took the damn users out of the local administrators group."
Re: (Score:1)
On top of boot-level encryption
A requirement for laptops.
mandatory anti-virus software,
Why not? I wouldn't recommend running any Windows machine without anti-virus software.
various "agents" that try to predict whether or not you would in fact allow some strange program to do what it wants to do
Hmmmm? Like?
we still get several people throughout the week who report virus infections on their work PCs.
Are you surprised? Why?
Re: (Score:3, Informative)
I have mod points, but had to chime in.
This is VERY easy to solve. Don't let your users have admin level accounts. Done.
You will never see virus/mailware installs - because even if users do open up that strangely named attachment, their account doesn't have permissions to install. Ditto for the manager's kids.
Solves a lot of support headaches too. Thee only software they have is software that you've tested, approved, and installed yourself. (via the software deployment method of your choice)
Again, this
Re: (Score:1)
Again, this is all dependedent on getting manager buy-in.
And therein lies the rub. When the managers want the ability to install their own stuff and have the ability to override any policy I want...
Well, let's just say I'm not surprised that their systems tend to be some of the ugliest ones I have to deal with.
Re: (Score:3, Insightful)
Parnoid and smart ?? Or Just Paranoid?.
Many IT-departments implement mandatory password changes and antivirus
Also common is various filter programs
Automated PW changes are actually counterproductive according to several studies as it makes the selected passwords more predictable. Better to educate users as to what is a good PW
Antivirus is a good thing and should be in place if you use windows
Filters DOES NOT WORK. At least not as intended.
The only thing that works in the long run is education. And harsh pun
Re: (Score:1, Insightful)
I'm sorry but switching browsers does NOT suddenly allow you to circumvent your proxy server. So no, users are not using Firefox to "visit sites" that they couldn't using IE. That's not what browsers do. This is technology 101. This sounds like someone who doesn't know what they were talking about, posting something they 'heard' from another end user.
Re: (Score:2)
Well, not true. If you have a firewall rule blocking outgoing traffic except via the proxy server then sure, but if you just have IE via Group Policy using the proxy server, then any browser directly connecting to the internet will bypass that... And it IS what browsers do...
Re: (Score:1, Insightful)
Boot level encryption, antivirus software, and "agents" are in themselves not bad. However, misconfigured they can become a nuisance to employees and kill productivity.
Boot level encryption is a must for laptops these days. No company wants to have a front page headline of "unsecured laptop stolen, thieves grab $BIGNUM of users' personal data and put it for sale on the black market." Get a laptop with a TPM chip, and boot level encrypt doesn't even have to ask for a passphrase, as PGP, BitLocker, and a n
bullshit (Score:4, Insightful)
It's just that companies would rather buy something than use their highly-skilled security staff. Or maybe their security staff isn't so skilled, and that's why they require the expense of ridiculously expensive canned security software, vs. designing an infrastructure that makes sense and using the best of breed tools for the job mixing open source, in-house, and commercial stuff.
Re: (Score:2)
Part of the reason for this is that PHBs are more easily swayed by a smooth talking salesman selling a shiny new appliance that looks good in a rack, as opposed to a desperate IT manager who needs more headcount for admins.
Another reason is that employers in general are averse to hiring people right now. If some security appliance costs $200,000, it is a lot more attractive to the people with the purse strings than a $50,000/year admin. Mainly because of the philosophy of "machines don't get disgruntled"
simple things can be done... (Score:2, Informative)
I have seen a lot of places that insist on buying a "solution" to the problem, when in fact the solution barely touches the problem. it works around a lot of things, but never really hits right on it. So you've spent a lot of money on something that doesn't really do the job of a person in that role.
The funny part about security is that for all it's sex appeal, real security is actually pretty boring. Oh the hotness of configuration management using tools that are already available on the windows or linux b
Re:simple things can be done... (Score:5, Insightful)
We all love honeypots and whatnot, but those things need to come well after patching, configuration management, removing/pruning user administrative permissions, and controlling which software you allow, and strong authentication enforcement. This doesn't have to cost a lot of money.
Actually, doing all of these things does cost money - you need to have someone hired on that can do all of these things, and you have to pay them a salary.
In the long term, it's not a lot of money. But short term thinking appears to be taking over in this economy. Especially if there's no immediate threat deemed by Management in not having basic safeguards in place.
It's always been about short term thinking (Score:2)
At least it has been for several decades. The current economy has just made that worse. People are worried that if you have a bad quarter your stock will go in the toilet and kill your company. However, the flip side is getting earnings as best as possible from quarter to quarter, without regard to the fact that if you invest a little more now, you might get a huge windfall 3 years from now.
Security for companies is the same as security for that poor family in the inner city. It would be nice to have a
budget? (Score:2)
The study indicates that even though practitioners are most concerned about email phishing and securing mobile devices, technologies addressing these needs are at risk of being cut from IT budgets.
A fat budget won't help you buy what you need to fix this problem: Smarter users.
Re: (Score:2, Insightful)
Re:budget? (Score:4, Insightful)
Depends on how you see it. Users are dumb, so if you spend your money to train your staff and make them just a tiny bit smarter, then your investment is worth it.
On the other hand, if you search for a purely technical solution, you are borne to fail, there I agree with you.
Sadly management often does not have the foggiest idea on how to allocate resources in a smart way in this area, so I don't expect the situation to improve any-time soon.
Not much insight (Score:2)
Cheaper than the alternative . . . (Score:5, Insightful)
Other commenters may argue that security is not something that companies can "buy," and they're right, to a point. Expensive proprietary firewalls are, in my experience, no better (and sometimes far worse) than a properly configured linux box. But companies do have to "buy" security in the sense that they need to budget time to ensure that systems are properly configured. I can set up a linux firewall in a matter of minutes, but to do it properly (especially when it must allow VPN, SSH, access to multiple databases, limited FTP, etc.) it takes much more time.
If companies realize how much their data is (are?) worth, they should also consider what's at stake if it's stolen or misused. Security doesn't have to be the primary investment for most companies, but it must be a high priority. If it's not, eventually bad things will happen.
Heh (Score:2)
I wanted to get back to contracting and do some more security work, because I miss it.
I was stunned by the fact that so many companies are now not looking for professionals with low-level experience, like before, but rather for people who have experience in paperwork. ITIL, ISO xxxxx, bla, bla, bla.
It's as if people are not actually DOING security anymore, but are just writing and debating about it.
No wonder they have budget issues, when they don't know what they're doing, so they need to spend lots of mone
Re: (Score:2)
Thanks to Enron and other companies, and the knee-jerk regulations put into place after that like Sarbanes Oxley, a security person has to be familar with all these laws, like ISO 9000, ISO 10000, PCI-DSS.
Yes, you will be doing tons of TPM reports to ensure that the company is compliant, but if a company doesn't have the CYA papers, and something happens, there is a chance of prople facing prison time, and shareholders suing.
Its just how the game has changed. Locksmiths used to forge custom locks out of me
Not just security pros... (Score:4, Interesting)
When this event happened, we were in a very touch and go situation - we did not know if we could recover the business for opening on Monday. And we are extremely IT reliant!
To cut a long story short - through putting in a lot of extra hours that weekend, and a lot of travelling to various IT shops within a 50 mile radius, we managed to get the business back to the point where we could open on the Monday without visible issue.
When that event happened, my BCM plan had been on the desks of the company leadership for a month. After that event, it got bumped up to the next board meeting. And at that board meeting, the entire plan was indefinitely postponed due to funding. No intermediate plan was asked for, no alternative. The plan had several different levels of expenditure to choose from, and they ignored all of them.
Barely one month after a 'can we continue to run the business' situation, the board rejected the plan which would have made that situation a non-issue, even at the cheapest option.
I now have several interviews elsewhere. The sooner I can get out of here, the better.
Posted anonymously for obvious reasons.
Re: (Score:2, Interesting)
I, too, feel your pain.
I used to work at a healthcare IT company. They had a legal requirement to have a Disaster Recovery Plan and a Business Continuity Plan, because if they were unavailable, it could impact the safety of tens of thousands of people. You know, life or death stuff.
They were also contractually obligated to to have a few other odds and ends, such as security and privacy staff, centrally managed anti-virus, configuration control, change management, security training, incident response, etc, e
Re: (Score:2)
through putting in a lot of extra hours that weekend, and a lot of travelling to various IT shops within a 50 mile radius, we managed to get the business back to the point where we could open on the Monday without visible issue. ...
the board rejected the plan which would have made that situation a non-issue, even at the cheapest option.
(emphasis mine)
Did you realize you have just shown to your board that, through your own heroic efforts, that they don't need your plan and can still recover from such failures!
Now, can you tell me why a sensible business person would want to spend more money to on a contingency plan where they know they can already recover from without spending a dime?
I've seen this cycle before (Score:2, Interesting)
No one has enough money in the budget for security, until a break-in nearly disables them. What are the chances? (Fire your security staff, and find out!)
Similarly, making copies of Windows to deploy on your business floor and ask "what are the chances?" and you'll find out. *I*didn't*call*, but a year or so after I left, I was told the company trying to get ME to pirate Microsoft Windows 98 got a visit from the BSA. And as you all know, they don't leave without a fire alarm being pulled or a $100,000 chec
Re:I've seen this cycle before (Score:4, Insightful)
In a recession, security is the last thing a business should cut.
The unemployment rate is high. This means that people who wouldn't think of things in normal times would turn to other means to supplement their income to keep a roof over their family's heads. So, someone who would normally give the finger to someone overseas asking for brief use of a username/password for $500 would happily give it in these times in order to keep the repo man away for another month.
More criminal organizations (domestic and overseas) realize there are profits to be made in capturing data stolen laptops for not just hardware, but the data on the machine. The data can be sold, or used to blackmail or extortion.
Employees are more likely to be disgruntled due to layoffs and cutbacks. So, vandalism and outright internal theft is on the rise.
There are a lot more regulations than before that make companies face shareholder lawsuits and corporate officers face prison time should a major breach occurs and a breach in process found.
Software CD keys are worth money, and a divulged volume CD key can force a company to re-buy every single license of a product as per EULA stipulations.
Outside attacks are more and more sophisticated as time goes on. To use an auto analogy, car companies are not using the same disc cylinder used on autos in the 1950s; they have moved to sidewinder cuts and "laser cut" keys. Same with security. A company has to keep abreast of new threats as a matter of life, just as CCTV cameras and bump-resistant locks on the doors are now the standard.
Stupid Article (Score:2)
Everyone knows that computer security is provided by AntiBaddness software that magically cleans all badness from your computers. Money is much better spent on applications that look pretty.
Maybe ... (Score:2)
- There are too many nitwits in the community. So much money has been wasted on the posers.
- Premium capital for "the best protection" (which is still vulnerable) vs. moderate capitol and common sense (which is still vulnerable). The latter wins in this economy.
- Don't play the TJX card, either... their stock went up, their customers numbers have risen; no one cares about that breach (or no one cares thats been LOUD enough). If the bottom line wasn't really affected that muc
'Bout damn time (Score:1)