Security Recession Proof?

There have been numerous stories lately about whether or not IT security is recession proof. The answer is: noThe latest IT security recession story came from SC Magazine in Is Security Recession Proof? The story offered no conclusion, and seemed to conclude a resounding "maybe" security is recession-proof. The bulk of the story focused on the demand side of the economic equation: attacks are increasing, regulatory compliance isn't going away, and companies will increasingly seek return-on-investment for their security spend.

I've no argument with any of that. Attacks will increase, regulatory compliance demands will no doubt escalate, and companies will seek justification for their security budget. But these conditions were true before December 2007, when the recession is now believed to have started. Consider the quote from Phil Neray, of Guardium:

"Phil Neray, VP of strategy at Guardium, a Waltham, Mass.-based database security company, agrees that most companies, especially those in financial services, absolutely must safeguard the integrity of their data. But, he adds, when times are tough, companies look at how they can do more with less. "If you can replace manual processes with automated processes, you have a good shot of being approved by the CFO," he says.

While security personnel may not be accustomed to making an ROI argument to get budget approval, he says, outlining how an automated, centralized, appliance-based approach can replace licenses, mass storage of log files, third-party personnel digging through those logs, makes for a persuasive case.

"

He's right. But businesses and security professionals should always be looking for ways to improve their processes and ways to do more with less. And, security managers already should be making strong business cases for any acquisitions. When the business and security departments are run this way, things tend to go much more smoothly when tight times arrive. If you're rushing to increase automation now, and cut costs, you're already too late. And your only hope is that your direct competitors failed to streamline their business operations, just as you have. That's a bad position to be in, as you've handed part of your destiny into the hands of the competition.

The point I'm trying to make is that if you've been automating where possible, putting the right controls in place, and streamlining dead weight, then you're sitting just as well as you possibly can right now.

Now, as to whether IT security is recession proof. Of it's course not. If business initiatives get shelved, or cut down, so does the security associated with those initiatives. If new hiring is down, so is the need to manage the on-boarding of those identities. If new remote offices aren't being built, there's no need to secure and monitor those network segments. If new application development has been curtailed, so has the need for application security analysis. You get the picture.

Yet, all of these things will need to be maintained for the existing infrastructure. But the rate of IT security growth will slow with the rest of the businesses' IT initiatives. And opportunities always will exist for those vendors and employees who help businesses be more effective.

So, while IT security isn't recession proof, it is more recession resilient than other areas of the business.