Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


08:29 PM
George V. Hulme
George V. Hulme

Security Recession Proof?

There have been numerous stories lately about whether or not IT security is recession proof. The answer is: no

There have been numerous stories lately about whether or not IT security is recession proof. The answer is: noThe latest IT security recession story came from SC Magazine in Is Security Recession Proof? The story offered no conclusion, and seemed to conclude a resounding "maybe" security is recession-proof. The bulk of the story focused on the demand side of the economic equation: attacks are increasing, regulatory compliance isn't going away, and companies will increasingly seek return-on-investment for their security spend.

I've no argument with any of that. Attacks will increase, regulatory compliance demands will no doubt escalate, and companies will seek justification for their security budget. But these conditions were true before December 2007, when the recession is now believed to have started. Consider the quote from Phil Neray, of Guardium:

Phil Neray, VP of strategy at Guardium, a Waltham, Mass.-based database security company, agrees that most companies, especially those in financial services, absolutely must safeguard the integrity of their data. But, he adds, when times are tough, companies look at how they can do more with less. "If you can replace manual processes with automated processes, you have a good shot of being approved by the CFO," he says.

While security personnel may not be accustomed to making an ROI argument to get budget approval, he says, outlining how an automated, centralized, appliance-based approach can replace licenses, mass storage of log files, third-party personnel digging through those logs, makes for a persuasive case.

He's right. But businesses and security professionals should always be looking for ways to improve their processes and ways to do more with less. And, security managers already should be making strong business cases for any acquisitions. When the business and security departments are run this way, things tend to go much more smoothly when tight times arrive. If you're rushing to increase automation now, and cut costs, you're already too late. And your only hope is that your direct competitors failed to streamline their business operations, just as you have. That's a bad position to be in, as you've handed part of your destiny into the hands of the competition.

The point I'm trying to make is that if you've been automating where possible, putting the right controls in place, and streamlining dead weight, then you're sitting just as well as you possibly can right now.

Now, as to whether IT security is recession proof. Of it's course not. If business initiatives get shelved, or cut down, so does the security associated with those initiatives. If new hiring is down, so is the need to manage the on-boarding of those identities. If new remote offices aren't being built, there's no need to secure and monitor those network segments. If new application development has been curtailed, so has the need for application security analysis. You get the picture.

Yet, all of these things will need to be maintained for the existing infrastructure. But the rate of IT security growth will slow with the rest of the businesses' IT initiatives. And opportunities always will exist for those vendors and employees who help businesses be more effective.

So, while IT security isn't recession proof, it is more recession resilient than other areas of the business.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-22
This affects all versions of package jquery-ui; all versions of package org.fujion.webjars:jquery-ui. When the "dialog" is injected into an HTML tag more than once, the browser and the application may crash.
PUBLISHED: 2021-01-22
Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege.
PUBLISHED: 2021-01-22
Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS (Stored Cross-site scripting) attack.
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that conta...