The Science Behind Security Spending
You can’t get around certain laws of nature, not even in security. Take Newton’s Third Law, for example. For every action there’s an equal and opposite reaction. In physics, hammer meets nail in one direction and nail meets hammer in the opposite direction.
In security, the business adds budget in one area and the security department reduces risk for the business in that same area. Similarly, when the business reduces budget from another area, limited security resources add risk to business operations in that area.
The question is, is that risk acceptable to the business?
Unfortunately, most security departments don’t have the wherewithal or the means to figure out exactly what the equal and opposite reaction is for any given budgetary decision.
Get Rook Security’s stories in your inbox
Join Medium for free to get updates from this writer.
Risk assessments and audit findings feed into governance frameworks. Governance frameworks help set IT security strategy. And IT security strategy determines the available IT services catalogue and security operating standards. It sounds simple, but in addition to governance decrees, there’s also another critical source of direction feeding into IT strategy: ad hoc policy decisions.
These decisions include business guidance and, most importantly, spending decisions. The problem is that these judgment calls are frequently made on the fly with no context of risk findings or governance policies. What’s more, security provides no way for executives to understand how changes made by their directives create a delta between final operations and risk-based governance mandates.
I’ve been on a crusade for a long time to get my clients to make security spending decisions more scientific for both IT and line-of-business leaders. Businesses have to get better about putting discrete numbers to resource units and to related output metrics around specific security activities such as threat intelligence, incident response, vulnerability management, and so on. From there, they need to predict how adding to or taking away resource units could potentially impact those output metrics. And in the end, they need to bring these projections back to executives with simple “if this, then that” risk statements and let them decide if they want to stick with their resource allocation decisions.
At Rook it’s a process we’ve perfected called Security Resource ThrottlingTM, one that we’ve formalized and automated. I’ll probably harp on this in future blogs, but if you take one thing away about throttling it is this: in security spending, there’s always an equal and opposite risk reaction. As a technology executive, it is up to you to explain to the business executives and the board what exactly that reaction is.
The more CIOs and CISOs that work to do so, the more they’ll find they can justify spending requests. That’s because they’re explained in language business executives understand, with each inbound dollar of spend traceable to specific units of output that can be reallocated to other security services as risk changes in-between budget periods. Most importantly, though, they’re able to put the big risk decisions in the hands of those who are paid to make those calls.
