Is information security compliance really a cost center?

Would you buy a car, pickup truck or BMW without seat belts, Air bags, or windshields…Things to secure your investment. A cost derivative for securiing IT applications can be determined based on the type of security required/capability by the IT organization. Example:(I wouldn’t use pinto seat belts for my 745i BMW.) All IT components, systems, security, Storage, Networking, tools can be calculated as a derivative of IT investments for revenue applications. The trick is how and does it make since….?

Some people make lots of money showing IT organization how to determine budgets based on Risk, AND business impacts. Risk alone is not enough. Quantifying the business impact in terms of dollars is the key.

No tool can do this because have the battle is political, Belief, Facts, and Good technical analysis.

Most technical staff mis the Political, and belief methods/tools and CFO’s laugh without the business objects and company vision linked to the technology risk…..Example.

A previous client had a customer billing application generating $260 million per month. They were losing $14 Million per quarter because Security and performance caused a minor problem which tracked back to the business application not processing $14 million per month of new customer data appropriately.

When IT asked for 7 Million to fix this problem the CFO laughed, Out loud. IT budget at that time was 4 Million per year. Once we explained that he was already loosing $ 14 Million dollars per month in unprocessd bills from new customers, he gladly wrote a $7 million dollar check to fix the problem. Being able to explian the Highlevel and the low level analysis to C-Level is Key in Showing how secuirty/IT components/ are cost centers, more correctly Cost derivatives.

Peace Andre’
AT: CIAProfessional@msn.com

Enabler… yes… I do feel enabled…

When I purchase AV or another security product for the business systems it does not become my personal play-toy. This purchase was made to protect the company as a whole.

We need to change the way that products and services are delivered to non IT/InfoSec departments. Show where the costs truly come from and how they benefit the enterprise.

Lawrence,

thanks for your comment on my post about your post. Actually, I can see that we are more aligned in thought than it really appears. You used a very interesting word in your reply, “enabler”. I thought I originally did that on my post, but I wrote it in a different way. Saying that things are costs doesn’t mean that they are not good or should be discarded. Also, if you need to spend something you will want to do that in the most “bang for the buck” way, that’s what happens with security, if cannot avoid having it, do it in a way that you’ll have a small impact to the business, small cost and reduce risk as much as possible. I’ll write a more elaborate response for your comment in my blog, but it’s certainly a very nice debate

I concede that yes, it is considered a cost center. But yes, security technologies enable every revenue generating activity that exists today, from payment processing through to employee productivity. The point to my article was to have people consider realistically that rather than simply look at numbers. Look closely at the enabling technologies that exist because security technologies make them possible. The response I’m sure is that some of these things can be done without security, and I believe that many of them cannot and were not possible without security existing. Mutually inclusive like shoes are to a runner, sure they are a cost to the runner, but without them there is no winning the race. I’ve been around the block in security and my intention was to try and push this debate to the floor. How does one determine a cost to a revenue generating activity, the lines can be easily blurred here depending on how one looks at it and the business you are in. Can internet commerce be performed without security? I don’t believe so, and time and time again I am proven right by the data breaches that occur due to those security mechanisms being too lax or not properly implemented.

No blank checks, but think carefully and sell your security technologies to management based not only on FUD but the enabling technologies security provides.

In response to Mike Rothman’s blog post on securityincite.com:

1. I don’t do drugs or even drink for that matter
2. Separation of duties have existed long before SOX and were derived from DOD security measures and practices (think nukes man). I realize this is a new concept in many corporations and SOX has certainly created necessities for it these days.
3. When speaking of a Compliance Driven Company I’m thinking not just thinking SOX and PCI but best practices as well as the plethora of other compliance mandates. What about internally defined security policies and compliance to them?(I should have been more specific I guess).
3. On your Anti-Malware comment – If you wish to have no Anti-Malware, you are welcome to do so, but for me…. I’ll be installing it because I know it will prevent many of the threats. I’m a security guy, and I get that security will never be perfect but it is always better to have a door lock than to leave the door wide open.
4. As far as separations of duties costing more, not necessarily, most companies utilize existing parties to require collusion and so it really costs very little and yes, work has always shown to improve through peer review. This is why all scientific papers are peer reviewed, they become more accurate through that process.
5. I don’t feel you should ever give up selling the value of security as a revenue generator so don’t just turn to FUD. My advice to to look for those synergies where security will enable new company offerings and empower your company to become more profitable by utilizing security in that way.

Closing thoughts, I love a healthy debate as it leads us through to progress.

So you want me to ask for a blank check? Let’s assume for a minute the CFO doesn’t laugh me out of his office. Let’s even assume he gives me that check. Do I make it out to McAfee? Why should security be any less accountable than any other business unit? Does McAfee product marketing not create a business case for new products? The elitist attitude you recommend does nothing to improve the reputation of security organizations in the boardroom. Implementing the technology of the day does nothing to reduce risk or increase compliance. These can only be gained through proper policy and process, supported by the appropriate use of technology and measured for continuing improvement.

All very interesting points.

I do have two questions regarding the relation between the title “Is information security compliance really a cost center?” and all the chewy goodness you espouse all this technology and the resulting compliance brings:

1) If security compliance isn’t a cost center, are you then suggesting it’s a profit generator? So on the balance sheet it shows up as a revenue generator or profit center?

2) Assuming I deploy all this wonderful technology above — no doubt from McAfee — is it fair then to say that it’s free?

Thanks for your time and consideration in answering my questions.

/Hoff