There have been numerous stories lately about whether or not IT security is recession proof. The answer is: no
December 9, 2008
There have been numerous stories lately about whether or not IT security is recession proof. The answer is: noThe latest IT security recession story came from SC Magazine in Is Security Recession Proof? The story offered no conclusion, and seemed to conclude a resounding "maybe" security is recession-proof. The bulk of the story focused on the demand side of the economic equation: attacks are increasing, regulatory compliance isn't going away, and companies will increasingly seek return-on-investment for their security spend.
I've no argument with any of that. Attacks will increase, regulatory compliance demands will no doubt escalate, and companies will seek justification for their security budget. But these conditions were true before December 2007, when the recession is now believed to have started. Consider the quote from Phil Neray, of Guardium:
"Phil Neray, VP of strategy at Guardium, a Waltham, Mass.-based database security company, agrees that most companies, especially those in financial services, absolutely must safeguard the integrity of their data. But, he adds, when times are tough, companies look at how they can do more with less. "If you can replace manual processes with automated processes, you have a good shot of being approved by the CFO," he says.
While security personnel may not be accustomed to making an ROI argument to get budget approval, he says, outlining how an automated, centralized, appliance-based approach can replace licenses, mass storage of log files, third-party personnel digging through those logs, makes for a persuasive case.
"
He's right. But businesses and security professionals should always be looking for ways to improve their processes and ways to do more with less. And, security managers already should be making strong business cases for any acquisitions. When the business and security departments are run this way, things tend to go much more smoothly when tight times arrive. If you're rushing to increase automation now, and cut costs, you're already too late. And your only hope is that your direct competitors failed to streamline their business operations, just as you have. That's a bad position to be in, as you've handed part of your destiny into the hands of the competition.
The point I'm trying to make is that if you've been automating where possible, putting the right controls in place, and streamlining dead weight, then you're sitting just as well as you possibly can right now.
Now, as to whether IT security is recession proof. Of it's course not. If business initiatives get shelved, or cut down, so does the security associated with those initiatives. If new hiring is down, so is the need to manage the on-boarding of those identities. If new remote offices aren't being built, there's no need to secure and monitor those network segments. If new application development has been curtailed, so has the need for application security analysis. You get the picture.
Yet, all of these things will need to be maintained for the existing infrastructure. But the rate of IT security growth will slow with the rest of the businesses' IT initiatives. And opportunities always will exist for those vendors and employees who help businesses be more effective.
So, while IT security isn't recession proof, it is more recession resilient than other areas of the business.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024