Here Are a Few Tips

The collapse of the dotcoms and the slowing of the economy have renewed interest in justification of IT spending. A year ago, money flowed freely for most projects under the e-business mantle. But today, approval is most swiftly granted only to those projects with the most demonstrable return on investment.

While the CFO may prefer this, CIOs and IT managers responsible for data and computer security face a conundrum. It's exceedingly difficult to perform any kind of ROI analysis on security projects. That's because the ROI on most of them is tied up in what the organisation won't pay as a result of having implemented strong, cogent security measures. Even then, some of what is saved is intangible, like customer confidence and goodwill. It's important, but still intangible. It's no surprise that as enterprise systems become increasingly network-centric and as more knowledge employees work away from the cosy, safe confines of a central office, security threats ominously mount.

There's also a peculiar aspect of security provisioning that further complicates life for IT managers. It's very difficult for anyone to know, let alone prove to senior management, how much security is enough. No system can be rendered totally secure. So how secure do you want or need to be and at what cost?

Securing networks, remote and mobile workers and budding e-business operations is very expensive in terms of equipment and staff, and security applications are often highly complex. And these expenditures don't directly add to the bottom line.

Also, many CIOs are concerned about sounding too much like alarmists when it comes to data security, especially to senior executives looking to shoot down projects with thin ROI justifications. You have to speak their language about security, putting matters in terms to which they'll readily relate. Here are some suggestions:

* Put the fear of lawyers in them. Computerworld (US) reported on May 21 that it's a matter of mere months before some victims of cyberattacks file big, honking negligence lawsuits against companies that weren't aggressive about securing sensitive data. While no one can yet say what the proper or legal level of protection might be, that won't make a difference to litigators should the right opportunity present itself after an attack.

* Give them the cold, hard facts they love. Gathering data and statistics on the costs of cybercrime and hacker attacks has become a sub-industry, and you should share this data with your bosses. The Computer Security Institute teams up with the FBI annually to produce a highly regarded computer crime survey, complete with cost figures. Last month, the University of California at San Diego released a study showing that some 4000 denial-of-service attacks occur weekly. In a supreme irony, hackers recently successfully whacked the Web site belonging to the CERT Coordination Centre at Carnegie Mellon University in Pittsburgh, which is responsible for tracking hacker attacks.

* Plug them in. Forward-thinking companies regularly review security policies and procedures and update them accordingly. The really progressive firms directly involve senior executives in review meetings, aligning policies with strategic business issues from the start.

These are small, doable steps to getting the support you need for the security you want.