Home » Security Leadership » Metrics/Budgets

What Would You Do With an Extra 10 Percent in Your Budget?

The Bush administration has proposed increasing the federal government’s information-security budget by almost 10 percent. Three government CISOs weigh in on what they’d do with that kind of money.

February 28, 2008 — CSO — Earlier this month, the Bush administration proposed to increase 2009 spending on information-technology security to $7.3 billion from the current level of $6.6 billion--an increase of almost 10 percent. (See story from FCW.com). This could be big news for an information-security program that is notoriously under-funded.

So start dreaming--what would you do if your budget were suddenly increased 10 percent? We asked three CISOs in various areas of state and federal government how they’d want to spend the money.

Lou Magnotti, CISO, U.S. House of Representatives: "I would use the money to fund an enterprise encryption program to protect all U.S. House of Representatives information. Encryption is an important mitigation strategy for safeguarding information, whether it’s corporate or privacy data."

Patrick Howard, CISO, Department of Housing and Urban Development: "An additional 10 percent in security funding here at HUD would amount to around $2 million. With that amount, HUD would be able to comply with OMB’s data privacy protection mandate, for which we currently do not have funding available. This means that we could implement two-factor authentication for remote access to our network, and could encrypt the hard drives of all laptop computers."

Mark Weatherford, CISO, State of Colorado: “A 10 percent increase in my budget would allow me to do a couple of things that are above and beyond my current state legislative funding. The first thing would be to create a data governance structure. Data is ubiquitous in many state governments, and we don’t necessarily have a good handle on where it is, who owns it, and how it’s protected. Extra funding would allow me to develop a framework for data governance and then introduce that framework to state agencies and implement it in the enterprise. A budget increase would also help me to expedite the acquisition and implementation of an Enterprise Security Event Management system.”

What would you do? E-mail Staff Writer Katherine Walsh at kwalsh@cxo.com.