Business of IT: Building a business case for security

Security can be both the unseen hero and the weakest link in an organisation, so how do you make the case to spend enough to protect your organisation's most vital assets? Stephen Pritchard investigates...

"We're still seeing reactive spending to an extent, driven by the fear factor, or because the Information Commissioner or regulatory requirements demand it," says Richard Harrison, an IT security expert at PA Consulting. "Or a company might act, to protect its reputation or to protect itself from damage."

The first step is educate the CEO or MD on the importance of security. To be successful security has to be visible.

And businesses have been building what many industry insiders describe as "ever higher walls" around their IT infrastructure, not least because the board demands that IT does all it can to protect assets.

As Jay Huff, general manager for Europe, the Middle East and Africa (EMEA) of HP's ArcSight security division points out, that is not always the most effective approach. "The issue is that after decades of investment, organisations are still finding themselves pretty insecure. So senior management are asking for more formal business cases."

A business case, or a return on investment?

Security spending was one of the few parts of IT budgets that continued to grow during the recession. But both boards and IT directors are starting to scrutinise security spending more closely, to determine whether an increase in security spending brings with it, a proportional increase in safety.

"There's a gap between what needs to be done and what the C-level thinks needs to be done. C-level executives may not be aware of all the issues," warns Larry Ponemon, chairman of the Ponemon Institute. "The first step is educate the CEO or MD on the importance of security. To be successful security has to be visible."

Security awareness also needs to be combined with an understanding of the business' attitude to risk. As Dimension Data's Campbell points out, few businesses can now afford to protect every information asset with the same levels of security. In areas where the risks of attack are relatively low or the losses from an attack or data breach will be limited a lighter-weight, lower-cost security approach may drive a more robust business case.

"Security is, in some ways, like business continuity," says PA Consulting's Harrison. "The degree to which you want to invest in it depends on how much risk you want to take."

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

Ubiquiti Networks UniFi Dream Machine Pro review: All the security you need in one handy box
Security

Ubiquiti Networks UniFi Dream Machine Pro review: All the security you need in one handy box

18 Nov 2021
Big zero-day flaw found in Palo Alto security appliance
internet security

Big zero-day flaw found in Palo Alto security appliance

11 Nov 2021
Hackers could use new Wslink malware in highly targeted cyber attacks
malware

Hackers could use new Wslink malware in highly targeted cyber attacks

1 Nov 2021
FBI raids Chinese POS business following cyber attack claims
malware

FBI raids Chinese POS business following cyber attack claims

27 Oct 2021

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
Access brokers are making it easier for ransomware operators to attack businesses
cyber security

Access brokers are making it easier for ransomware operators to attack businesses

1 Dec 2021