Can mature organizations cut security spending?

Computerworld Australia - Organizations that have reached a high level of IT security practice maturity can safely reduce spending to between 3% and 4% of the IT budget by 2008, according to research firm Gartner Inc.

By contrast, organizations that are inefficient or have historically under invested in security may spend upwards of 8% of their IT budget on security. This means that many organizations will still be investing aggressively for the next few years.

Rich Mogull, research vice president and conference chair of the Gartner IT Security Summit which starts in Sydney Tuesday, said that there are now solutions to most information security problems.

"It's just a matter of implementing the technology efficiently and effectively so resources can be focused on new threats," Mogull said.

"While information security has become a highly specialized branch of IT, commodity security functions are often being returned to IT operations.

"Organizations that are still impacted by everyday, routine threats must ramp up and become more mature in their approach."

Mogull said the message isn't about more security, but more security process.

"Security now has executive attention, and we need to treat it like a business issue, not just a technology problem," he added.

Also this week Gartner released its updated hype cycle for information security technologies, designed to help executives make decisions about how to allocate their security budgets.

It shows technologies such as spam filtering and Web services security standards moving rapidly towards broad acceptance, while the widespread adoption of biometrics remains more than 10 years away.

"Aside from the age-old need to 'keep the bad guys out', compliance with government and industry regulations is now playing a significant role in security spending decisions," Mogull said.

"In deciding when to adopt a new security technology, timing is crucial; invest too soon and you risk the pain and expense of an immature technology; invest too slowly and you risk being left behind and leaving your organization vulnerable."

Mogull also said that functional convergence in security products is occurring.

For example, host firewalls, antivirus, antispam, and basic host intrusion prevention are combining into single, desktop agents.

In the future, this will make security less complex, he said.