In Depth

Security Budget Benchmarks: Inside the Sausage Factory

You wanted numbers. You got numbers. But ingest security budget survey benchmarks at your own peril.

By Derek Slater

Akridge's process starts with high-level questions about what data is most important to your company, what regulations affect your company's security policies, which architecture will provide the right level of security for the right data and so forth. Some organizations may be throwing a fair amount of money at shoring up their defensive perimeter, but technology decisions like that "should be way downstream," Akridge says. If the company hasn't answered the high-level questions, "it's wasted money." Case in point: A report by the White House Office of Management and Budget found no correlation between the amount of money a federal agency spent on security and its effectiveness.

So what's the value of knowing "average" infosecurity spending? It may help a CSO defend his budget in a PowerPoint presentation, but for the purpose of figuring out whether security is appropriate, "I don't think it's of any value at all," Akridge says. To set correct spending levels, CSOs must dig deeper and look harder at cost-justification techniques.

Other stories by Derek Slater

• Email
• Print
• Comments
• Digg This
• SlashDot

• Calculated Risk: Return on Security Investment
• Value Made Visible
• Analysis: 2007 Global State of Information Survey