Can you cut information security in hard times and survive

Although some analysts actually expect security spending to rise this year -- at least as a percentage of total IT spending -- some CIOs are giving serious thought to the once-unthinkable idea of trimming security budgets as businesses look to cut costs during this global recession.

"Almost certainly people are experiencing cuts," says Pete Lindstrom, an analyst with the research firm Spire Security. "If you think of security as a cost center within a cost center [IT], ... then security is a great place to start," he adds. "There are companies that are discounting their security in order to drive bottom line," says Charlie Meister, executive director of the University of Southern California's Institute for Critical Information Infrastructure Protection. "I've seen a pretty significant cutback over the past six months," says Rich Cummings, CTO at HBGary, a security company that has clients in the financial services industry.

The risk of cutting security is that a security breach can be disastrous. The Ponemon Institute pegs the average cost of a data breach at US$6.7 million.

But you may have no choice if the money is not there. Experts say companies that have done the hard work of really understanding their risk posture can trim spending without increasing risk. And companies that have taken security seriously can be equally smart about how they reduce their security costs, says USC's Meister. Sadly, he notes, the companies that are in this position are exceptional: "I don't think enough companies have done a great job of managing their risk profile. And it doesn't really occur [to them] until somebody loses a laptop."

So how do you cut security safely?

One method is to get your security intelligence from free projects, such as the Shadowserver project, rather than paying for the information, Cummings says.

Open-source tools preserve security, trim costs

The use of open-source software can also be a great place to cut security costs -- especially for small and medium-size businesses, says Spire's Lindstrom. They let businesses get equivalent security tools for less money. "If the product is commoditized enough and your people are skilled enough, it's not unreasonable at this stage of the game to consider open-source applications," he says.

For example, the ClamAV antivirus software and Snort intrusion-detection system are two widely used open-source antivirus products, as is the Open Source Security Information Management security event management software.

Companies that don't have the money to pay for full disk encryption might want to look at TrueCrypt, another open-source project. Because it lacks centralized management capabilities, TrueCrypt is "not going to be appropriate for every environment," says Morey Straus, an information security officer with the New Hampshire Higher Education Assistance Foundation, but it does work for some.

Outsourcing security to the cloud

For cash-strapped organizations, moving security processes out of the house can be a money-saver. "Look to the cloud computing services to replace some [security products]," Straus recommends.

Forrester Research reports that 28 percent of companies that move to in-the-cloud managed security services do so to cut costs. Although e-mail and Web filtering are the most popular managed security services today, Forrester projects that more businesses will move to the cloud for vulnerability assessment and event monitoring as well.

Using brainpower instead of buying tools

But for companies that want to improve their security posture without spending money, taking the time to promote an information security awareness program can pay off big-time, according to Straus. "That's just one of the easiest, most effective things you can do and it costs very little."

Straus says he did this in two phases at his organization, a student loan provider. First, he started with a mass presentation outlining good security practices for his users. He then followed up with departmental meetings, which he described as more of a two-way discussion. "I'm able to get the employees to share with me some of the risks and possible pitfalls," he said. "Those meetings are very beneficial."

Analysts say that cutting down on manual processes is one way that smart companies can reduce costs and refocus staff resources.

It wasn't budget constraints that pushed the U.S. Navy to do something in this area, but the sheer volume of data that caused the Navy to move from manually handling intrusion-detection system alerts to a more automated system, called Prometheus.

As the Navy expanded sensor coverage and the amount of activity on the network spiked in recent years, manual monitoring became impossible, said Jim Granger, director of capabilities of readiness with the Navy Cyber Defense operation command in Norfolk, Virginia. "All of that just contributed to more information, and that contributed to sensor overload," he said. "We figured that if our watch team did nothing but clear alarms ... these guys would be able to spend an average of about 4.5 seconds per alarm."

Based on Novell's Sentinel event management software, Prometheus keeps watch on the Navy's global network, used by more than 700,000 sailors and support staff. On a typical day, it handles anywhere between a few hundred thousand to several million alerts, leaving the 180 staff members charged with monitoring the network to deal with the real problems.

Granger isn't expecting to make any cuts on security spending, but he agreed with Straus that focusing on users was worthwhile. "The best tool in the world is no substitute for a smart operator," he said.

Sometimes, though, other factors can make security spending choices obvious. Last October, Gibson General Hospital, located in Princeton, Indiana, was looking at rolling out an e-mail encryption product. That's when Director of Information Services Steve Rausch just happened to run a demonstration test of Palisade Systems' PacketSure data-loss-prevention appliance.

Within a day, PacketSure reported an ICQ message leaving from the company's e-mail server. It turned out that the hospital's e-mail server had just been hacked, and criminals were trying to install malicious software on the server. Rausch immediately took the server offline, before the bad guys could breach any confidential data. "If there had been a data breach, the PR on that alone would have been humongously detrimental," he said. "I don't know how you can put a price tag on that."

That lucky turn of events pushed data loss prevention (DLP) to the forefront, but it also put the e-mail encryption system on the back burner. "At the time of the demo, yes we were interested in it, but there were no immediate plans to get [a DLP system] installed," he said. "The hack said, 'we have to make this immediate.'"

Luckily, many IT shops are not being forced to make the hard decisions just yet about where to cut security spending. Forrester Research says that security will get a slightly larger percentage of IT budget dollars this year -- on average, 12.6 percent of total IT spending, compared to 11.7 percent in 2008. But because IT budgets are expected to drop 3.1 percent in 2009, that's a big jump in relative terms.