Home » Security Leadership » Metrics/Budgets

Recession Questions

Ask yourself these questions to help tune your security operation for maximum efficiency.

By Derek Slater

July 15, 2008 — Recessions stink. However, since we're in one, let's make the best of it.

What might it mean for a CSO to make the best of a recession? I'd suggest it means honing your focus on your company's operational efficiency.

First, that obviously means you should have a cost-efficient security operation.

Are you cross-training your staff? Have you renegotiated any contracts lately? Are new suppliers willing to negotiate a great rate in order to get their foot in your door?

Are you evaluating open-source and/or free software? There are tons of low-cost options available; you just have to make sure your functional needs continue to be met.

Can you automate any of the tasks your department now does manually? Video content analysis software is a great example of an area where technology is maturing to provide new capabilities. It's possible that security personnel now tied to monitoring video screens or network event logs could be repositioned to more high-value work.

Are your network and security operations centers ripe for consolidation?

Second, you should also be able to demonstrate that cost-effectiveness.

How mature is your use of metrics? Are you still relying on threadbare measurements like "We blocked 16 quadrillion infected e-mail attachments last month"? Catch up to the work of thought leaders like George Campbell and Andrew Jaquith on CSOonline, Securitymetrics.org or elsewhere on the Web.

Have you benchmarked your loss-prevention and investigation initiatives against those of your peers? Do you achieve comparable restitution rates?

Third, you should have an eye on any business opportunity where security can contribute to the company's overall efficiency.

Great access control projects can make businesses go faster, not slower.

Role-based identity management can help get new employees and new applications productive faster. And, oh, by the way, those same IDM systems can help quickly de-provision departing employees and contractors as well. Unfortunately, layoffs are the corporate world's knee-jerk reaction to a recession—so you may have to do more de-provisioning than normal over the next while. Handling those de-provisioning tasks efficiently may contribute to overall loss-prevention efforts.

Do you know how quickly new employees (or departing ones) receive (or lose) access cards, network privileges and so forth?

Do you work closely with business partners, such that a federated identity approach might take significant friction out of the value chain?

My colleague Bill Brenner has been exploring the topic of managing in a recession. See his articles for more ideas: Staying Secure when Staffing is Tight, Cost Savings Through Green IT?, and What People Steal.