What can you afford NOT to do on IT security?

There may be some security projects you can put off because of the recession -- without risking your company's data or reputation.

With the ailing economy putting a crimp in IT budgets, information security managers -- like just about everyone else in the tech world -- are feeling pressure to keep their costs in line.

Few expect to be hit with outright budget reductions, at least in the short term; regulatory requirements and the ever-expanding list of external and internal threats make it hard to devote less money to security efforts. But there is a growing push to curb or defer spending increases, according to IT managers and security analysts.

"It's imperative to squeeze every penny of value out of everything you do," said Jim Kirby, senior network engineer at DataWare Services, an IT services firm in Sioux Falls, S.D. This is a good time to stop working on "marginal" projects and redirect resources to security capabilities that are absolutely necessary, Kirby said.

Matt Kesner, chief technology officer at Fenwick & West LLP in San Francisco, said the law firm's security strategy for next year is to "focus on basics." Its 2009 IT budget doesn't call for reduced spending on security -- but neither does it include a funding increase.

And Fenwick & West is taking some steps to cut costs. The firm is deferring an earlier plan to hire a full-time networking and security expert because of the recession, Kesner said. It is also looking for opportunities to use open-source alternatives to some of its security tools.

One of the few new IT projects approved for next year is a replacement of the antivirus software installed on all of the law firm's PCs -- an upgrade that Kesner said is being driven by the increased threats to corporate data from malware and phishing attacks. Fenwick & West also plans to train end users more intensively on how to secure their PCs and mobile devices, and on the importance of creating strong passwords.

Even in an economy gone sour, a growing number of government and industry regulations impose security compliance costs that there is simply no getting away from. For instance, new data-protection laws in states such as Massachusetts, Connecticut and Nevada require companies to use data encryption tools and implement other security controls to safeguard the personal information of state residents.

Similarly, the Payment Card Industry Data Security Standard, created by the major credit card companies, requires all businesses that accept credit and debit transactions to adopt a broad set of data protection controls. And the federal HIPAA law includes data security and privacy rules for health care providers in order to protect patient information.

Meanwhile, cybercrooks are targeting companies with increasingly sophisticated -- and successful -- attacks. For example, Symantec Corp. said in a report last month that at least $1.7 billion worth of bank accounts were compromised in the U.S. during the 12-month period that started in July 2007.

In light of all that, not making cutbacks in antivirus subscriptions and purchases of frontline security tools such as firewalls and network intrusion-detection systems is a no-brainer, security managers said.

Kirby said investments in outbound-traffic inspection tools and controls for locking down portable media devices also are worthwhile because of the heightened risk of insider attacks at a time of increased layoffs. In addition, he thinks that cutting back on disaster recovery and business continuity projects wouldn't be wise.

1 2 Page 1
Page 1 of 2
7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon