Risk management: the key to controlling security spending

Abstract

Introduction

Growth in IT security spending has outstripped that of overall IT budgets over the last ten years, driven by an increasingly hostile environment, more automated and open business processes, greater issue awareness and increasing regulatory requirements.

Scope

Our research reports span the global software and IT services domain covering: strategic issues, technology and services, companies and markets.Ovum' s research has, for over 20 years been focused at the junction of the technical and commercial domains. Our strategic issues agenda addresses the major disruptions that are affecting both the software and IT services suppliers, and their customers that they serve

Highlights

Ensuring that technology investments drive competitive advantage, and that technology spend is not all absorbed by routine and non-differentiating technology, is more important than ever. Developing repeatable assets, new approaches to service innovation and moving into adjacent segments are all being tried - as are many other approaches. What is clear is that selecting the right markets to focus on is more important than ever.

Table of Contents

Executive summary

• In a nutshell
• Key messages
• Risk management provides a framework for optimising decisions
• Prioritise
• There is no easy way to balance the security budget
• Look for cheaper ways of delivering security
• Security budgets must be contained
• Putting a lid on security spending
• Getting the balance right
• Business needs
• Threats
• Available resources
• Price levels
• Risk management frameworks
• The nature of risk
• Security and systems management frameworks
• ISO 17799 and ISO 27001
• COBIT
• ITGI
• The SANS Institute' s recommendations
• A comprehensive structure
• The SANS list of security controls
• Balancing musts, needs, wants and resources
• The balance
• The threats are growing
• The criminal community
• The internal threat
• Threats relating to new technology
• The range of security products keeps growing
• Don' t spend tomorrow' s money solving yesterday' s problems
• Risk management is an ongoing process
• Risk management enables you to minimise overlaps
• Managing the risk/reward equation
• The role of risk analysis
• Optimising the risk/reward equation
• Assessing the risk/reward for new business initiatives
• Reducing the cost of IT security provision
• Alternatives to spending on security
• Reducing risk
• Rationalisation
• Open-source products
• Rationalise suppliers
• Use or negotiate innovative licensing
• Use managed services
• Streamline and automate processes

List of Tables

• Table 1: Recommended security controls