Economy Necessitates Fundamental Security Changes, CSOs Say

The economic downturn will have profound and long-lasting effects on the way enterprises view the IT security picture, according to interviews with 10 top security officers published today.

According to a new report from RSA's Security for Business Innovation Council -- a loose association of 1,000 top security executives -- the down economy means companies will have to make unprecedented risk-reward calculations to make the right decisions about security priorities in the days ahead.

"In recent years, [companies] have almost spent too much on security," said Art Coviello, chairman of RSA parent company EMC, in an interview prior to the release of the report. "Enterprises have been not only spending money on products, but on people and consulting. They keep throwing bodies at the problem, instead of paying attention to the risk-reward equation." Enterprises should focus more on prioritizing their security efforts and building automated, repeatable processes, he said.

In comments published in the report, Bill Boni, corporate vice president for information security and protection at Motorola, concurred with Coviello. "I think the days of big budgets, big battalions of security practitioners standing in the overhead cost line are well past," he said. "Part of the challenge is that the bigger the team becomes, the more challenging it is for leadership to really align with that kind of large cost with large value."

"In terms of looking for efficiencies, I think there are way too many security products out there now in the environment, and there is tremendous overlap," said Craig Shumard, chief information security officer (CISO) at Cigna, in the report. "The security product stack has become unsustainable. I've challenged every vendor that I've met with recently to help me define the seven or eight products that we need to achieve the same level of security that we have today. We can't continue to operate 15 to 25 (or more) security products."

"A lot of it is risk-based decision making," says Dave Cullinane, vice president and CISO at eBay Marketplaces. "You need to be able to quantify the risks and say, for example, 'We've got a $300 million exposure, and we need to spend $30 million this year getting it down to a reasonable level.' Beyond that, the fear, uncertainty and doubt stuff isn't working anymore. People just aren't buying it. Even if it does raise their concern, it doesn't do anything to loosen their wallets. Because most companies are looking at very tight budgets, so you're going to have to have a very good business case as to why you should get funding."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message