According to Mark Heathcote, practice director at IT services firm Xceed, there are three common causes for IT security budgets being spent on the wrong things:
1. The press. Technologies that are being talked up by the media can result in security budgets being redirected into technologies that address one issue, but do not cover other threats.
All information security budget spend should be driven by quantified risk mitigation.
2. Technologies that the information security team find interesting. Just because our trusted specialist staff says we should be doing something, doesn't necessarily mean budgets should be diverted from elsewhere.
3. Vendor-driven proposals. There are many examples of vendors presenting their solutions to CIOs and being greeted by the reaction, we really should have this'. But, stop and think why this threat was not a consideration before and do not be driven to a solution just because it looks like a good thing to do.
"All information security budget spend should be driven by quantified risk mitigation. Not by vendors, not by the press and not by technical staff," Heathcote concludes. "Follow these principles and you will not only reduce the impact of real world threats on the business, but may also reduce how much you spend on it."
-
Cyber resilience in the UK: learning to take the punchesColumn UK law now puts resilience at the centre of cybersecurity strategies – but is legislation simply catching up with enterprise understanding that resilience is more than just an IT issue?
-
CISPE claims European Commission gave Broadcom a ‘blank cheque to raise prices, lock-in, and squeeze customers’ with VMware dealNews Cloud providers have issued a formal response to the General Court of the European Union after the Commission defended its approval of the deal
-
Scania admits leak of data after extortion attemptNews Hacker stole 34,000 files from a third-party managed website, trucking company says
-
Capita tells pension provider to 'assume' nearly 500,000 customers' data stolenCapita told the pension provider to “work on the assumption” that data had been stolen
-
Gumtree site code made personal data of users and sellers publicly accessibleNews Anyone could scan the website's HTML code to reveal personal information belonging to users of the popular second-hand classified adverts website
-
Pizza chain exposed 100,000 employees' Social Security numbersNews Former and current staff at California Pizza Kitchen potentially burned by hackers
-
83% of critical infrastructure companies have experienced breaches in the last three yearsNews Survey finds security practices are weak if not non-existent in critical firms
-
Identity Automation launches credential breach monitoring serviceNews New monitoring solution adds to the firm’s flagship RapidIdentity platform
-
Neiman Marcus data breach hits 4.6 million customersNews The breach took place last year, but details have only now come to light
-
Indiana notifies 750,000 after COVID-19 tracing data accessedNews The state is following up to ensure no information was transferred to bad actors
