Operations
2/27/2016
10:30 AM
Yoran Sirkis
Yoran Sirkis
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
50%
50%

The ROI Of Infosec: 11 Dos and Donts For Management Buy In

The case for a bigger bottom line depends on how well you argue that the business can't run without a specific level of security infrastructure.

Selling IT security up the ladder isn’t as hard as it used to be but it still isn’t the easiest thing to do. Budgets are always squeezed, and you’re constantly asked to do more with less. Security managers need to prove that the company is better off with a tight, streamline security infrastructure in place across all aspects of the organization -- a daunting challenge.

Your best strategy is to show that information security is a critical part of your company’s everyday business process. Demonstrating the return on your information security investment can go a long way towards helping your cause. Here are a 11 points to take to the C-suite and boardroom.

  1. Do make it personal. It’s critical that CEOs and board members grasp the fact that they can be held criminally liable when something goes wrong – and things always go wrong; myriad attacks on your system occur every hour, at minimum. Only the damages vary. Systems and forensics must be in place demonstrating that everyone did their utmost to secure the information.
  2. Do speak the same language. Listen and pay attention to how the CEO positions her priorities and requests. Mirror that language when you approach her.
  3. Do offer a comprehensive view of corporate vulnerability. Data today is everywhere – network, cloud, mobile devices, remote employees, third party partners and service providers, etc. Clearly explain that security resources must be decentralized and cover everything If you protect your information in one area only, the attacker will find the weakest link and use that to reach everything.
  4. Don’t portray IT security as a “complication.” Stress that while security is largely invisible, it is also a business enabler. Demonstrate how IT security facilitates operations, for example, policies within a classification system can ensure that everyone in the accounting department can access certain files and folders automatically without having to make change requests.
  5. Do tie data security classification to expenses. A company’s ability able to find and classify the data will determine how it should be stored and the level of protection it requires. You may end up with a list that shows that only 10% of corporate data needs to be protected at the highest level, immediately reducing operating expenses and longer-term capital expenses.
  6. Do more than simply present the CEO with a list of security vulnerabilities. Explain  the consequences of the vulns, in terms of legal issues, damage to reputation, fines, etc.
  7. Don’t ignore the bottom line. You can  demonstrate the actual cost of security breaches with a quick Google search for recent examples. Here’s one at our fingertips: Target settled for $39 million to pay financial institutions affected by its breach.
  8. Do remind upper management of your company’s legal obligations and how they are affected by security breaches. For example, your company probably agreed to multiple NDAs before business partners agreed to send you proprietary information. Should an outsider access that information from your internal systems, you’ve basically voided the NDA, opening you up to legal action.
  9. Do review the statutes. Most companies are either obligated to follow SOX, PCI-DSS, NASD, SEC or other regulatory bodies. Compliance audits are a regular occurrence, and it is cheaper and easier to be in continual compliance than have to make corrections to integral corporate systems once you’ve failed the audit and are liable for massive fines. (Another ROI feature.)
  10. Do create alliances within your organization to present “group” priorities. Pay particular attention to the corporate risk management team.
  11. Do explain how data security is a critical part of supporting the employee relationship. Employers have access to employees’ healthcare records and personal family information, etc. If they become part of the public record it is a significant breach of trust. Employees can also sue you for putting them at risk of identity theft.

At the end of the day, security needs to be a significant part of the IT budget. You’ve got your wish list, and you have your actual priorities. You need to determine where the dollars will be best spent – and then make your case. How much you get for your department’s bottom line depends on how well you demonstrate that the business cannot run without a specific level of security infrastructure.

Related Content:

 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Yoran Sirkis is a seasoned senior executive with deep domain expertise in information security and well-rounded experience in leadership, business development, professional services, consulting, customer management, and international management. Yoran served as a managing ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/29/2016 | 1:50:57 PM
Dont portray IT security as a complication.
It's important to understand that the business is the main reason as to why you need to successfully implement security. Without it, there would be none to implement. I always prefer to say that its not security vs functionality, its more like security to complement functionality.
ivadumont
50%
50%
ivadumont,
User Rank: Apprentice
2/28/2016 | 5:19:16 PM
Re: #8The ROI Of Infosec: 11 Dos and Donts For Management Buy In
I really think that everybody don't have the same view. But for this case most of us will convey that security is an important part.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/27/2016 | 5:28:58 PM
#8
I'd reword #8, though the point is well taken.  Executives hate to be "reminded of" legal details and compliance obligations.  Rather, they prefer to view legal and compliance issues as a matter of risk management.  Present things that way and you're much more likely to at least get informed action.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
The Dark Reading Security Spending Survey
The Dark Reading Security Spending Survey
Enterprises are spending an unprecedented amount of money on IT security where does it all go? In this survey, Dark Reading polled senior IT management on security budgets and spending plans, and their priorities for the coming year. Download the report and find out what they had to say.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.