Why Security Outsourcing Won't Work

The number crunchers don't see security management the same way that CSOs do. That's why they're willing to turn it over to strangers.

By Anonymous

March 01, 2003 — CSO — We've decided to outsource security at my company.

We'll be doing so against my better judgment. Because, to me, when you give away the protection of the crown jewels, you're just asking for trouble. But beyond my concerns about what it all means for my company's security, it also means I'm going to have to let some of my best people go. Not because they're doing a bad job, mind you, but because some accountant in our finance department put forth a costing study that claims we can save money by outsourcing.

I wish that the accountants had to do my job at times like this. They don't get to see the business of security while tucked cozily away in their little offices. To them, security is just numbers, nothing more. All the breached machines. The scummy pornographic spam. The employee stalkers. It's just numbers to them. They think that the staff is too expensive and that they should go. They think we can do better with strangers who cost lessor so the analysis says.

I want to tell the finance guys, "Sure, you can outsource security. But where should we buy our loyalty?" They just stare back at me, confused.

I mean, how do you factor loyalty, dedication or willingness to go the extra mile into return-on-investment analyses? And make no mistake, employee loyalty and dedication are two of the most important things we'll lose. Immediately.

These great people on our security staff are the same people who worked and worried all weekend long when security problems arose. They're the same people who put their personal lives on hold to save the company's butt when someone broke into our systems and messed with our customer records. The same people who put their faith in the company. We were family.

Does ROI take any of that into account? Of course not. Oh, sure. We might be able to get some extra care from the outsourcer. But we'll only get it at an extra cost. Most of the soft stuff we won't see at all because the vendor's loyalties will never be the same as the employee's loyalty. And so the employees will lose, butlet's face itthe company will also lose because it won't be able to buy the same sort of dedication from an outsourcer that it can find in an employee.

Meanwhile, the finance twerps won't have to be the ones to look good people in the eye and tell them the past 10 years of hard work doesn't mean squat. Mostly they just run the numbers and call the shots after doing "the analysis."

• Print