Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/9/2008
08:29 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Security Recession Proof?

There have been numerous stories lately about whether or not IT security is recession proof. The answer is: no

There have been numerous stories lately about whether or not IT security is recession proof. The answer is: noThe latest IT security recession story came from SC Magazine in Is Security Recession Proof? The story offered no conclusion, and seemed to conclude a resounding "maybe" security is recession-proof. The bulk of the story focused on the demand side of the economic equation: attacks are increasing, regulatory compliance isn't going away, and companies will increasingly seek return-on-investment for their security spend.

I've no argument with any of that. Attacks will increase, regulatory compliance demands will no doubt escalate, and companies will seek justification for their security budget. But these conditions were true before December 2007, when the recession is now believed to have started. Consider the quote from Phil Neray, of Guardium:

Phil Neray, VP of strategy at Guardium, a Waltham, Mass.-based database security company, agrees that most companies, especially those in financial services, absolutely must safeguard the integrity of their data. But, he adds, when times are tough, companies look at how they can do more with less. "If you can replace manual processes with automated processes, you have a good shot of being approved by the CFO," he says.

While security personnel may not be accustomed to making an ROI argument to get budget approval, he says, outlining how an automated, centralized, appliance-based approach can replace licenses, mass storage of log files, third-party personnel digging through those logs, makes for a persuasive case.

He's right. But businesses and security professionals should always be looking for ways to improve their processes and ways to do more with less. And, security managers already should be making strong business cases for any acquisitions. When the business and security departments are run this way, things tend to go much more smoothly when tight times arrive. If you're rushing to increase automation now, and cut costs, you're already too late. And your only hope is that your direct competitors failed to streamline their business operations, just as you have. That's a bad position to be in, as you've handed part of your destiny into the hands of the competition.

The point I'm trying to make is that if you've been automating where possible, putting the right controls in place, and streamlining dead weight, then you're sitting just as well as you possibly can right now.

Now, as to whether IT security is recession proof. Of it's course not. If business initiatives get shelved, or cut down, so does the security associated with those initiatives. If new hiring is down, so is the need to manage the on-boarding of those identities. If new remote offices aren't being built, there's no need to secure and monitor those network segments. If new application development has been curtailed, so has the need for application security analysis. You get the picture.

Yet, all of these things will need to be maintained for the existing infrastructure. But the rate of IT security growth will slow with the rest of the businesses' IT initiatives. And opportunities always will exist for those vendors and employees who help businesses be more effective.

So, while IT security isn't recession proof, it is more recession resilient than other areas of the business.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5230
PUBLISHED: 2019-11-13
P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than Emily-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than NEO-AL00D NEO-AL00 9.1.0.321(C786E320R1P1T8) have an improper validation vulnerability. The system does not perform...
CVE-2019-5231
PUBLISHED: 2019-11-13
P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. The software incorrectly performs an authorization check when a user attempts to perform certain action. Successful exploit could allow the attacker to update a crafted package.
CVE-2019-5233
PUBLISHED: 2019-11-13
Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability. Successful exploitation may cause the attacker to access specific components.
CVE-2019-5246
PUBLISHED: 2019-11-13
Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1) have an insufficient verification vulnerability. The system does not verify certain par...
CVE-2010-4177
PUBLISHED: 2019-11-12
mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.