It never ceases to amaze me how security budgets usually get cut in proportion to other organizational budget cuts at a time when more money should be put towards protecting a company's assets and resources. Let's follow the logic:
A down economy usually forces Company A to buy less; less spending by Company A means lower revenues for Company B; lower revenues cause Company B to cut expenses to maintain fiscal objectives; Company B typically cuts costs by a given percentage across the board, including security. As a result, Company B at best maintains their security defenses and more often than not, that security erodes over time. Because of this, attacks that would normally be defended against start to penetrate company B's defenses, and eventually the attacker gains access to Company B's assets and either steals data critical to Company B's business or causes disruption to their day-to-day operations. Company B now has to spend additional money to repair the damage, repair customer confidence, pay fines, settle lawsuits, and implement better security controls to prevent those types of attacks from happening in the future. Add to this scenario that often in a down economy the number of attacks increase as people turn to illegal activities to survive and there you have the paradox.
At a time when organizations should be investing in improved security because of the increase and sophistication of threats, they lower security spend. What companies need to do and manage to risk and not simply to budgets. Of course budgets drive most aspects of business life, but making decisions about spend without taking into consideration the risk associated with budget reductions can result in devastating consequences. And, in the long run, cost the organization much, much more.
Leave a comment