Can you cut information security in hard times and survive

Although some analysts actually expect security spending to rise this year -- at least as a percentage of total IT spending -- some CIOs are giving serious thought to the once-unthinkable idea of trimming security budgets as businesses look to cut costs during this global recession.

"Almost certainly people are experiencing cuts," says Pete Lindstrom, an analyst with the research firm Spire Security. "If you think of security as a cost center within a cost center [IT], ... then security is a great place to start," he adds. "There are companies that are discounting their security in order to drive bottom line," says Charlie Meister, executive director of the University of Southern California's Institute for Critical Information Infrastructure Protection. "I've seen a pretty significant cutback over the past six months," says Rich Cummings, CTO at HBGary, a security company that has clients in the financial services industry.

[ Trying to trim IT costs? InfoWorld reveals 7 easy ideas you may have overlooked. ]

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Although some analysts actually expect security spending to rise this year -- at least as a percentage of total IT spending -- some CIOs are giving serious thought to the once-unthinkable idea of trimming security budgets as businesses look to cut costs during this global recession.

"Almost certainly people are experiencing cuts," says Pete Lindstrom, an analyst with the research firm Spire Security. "If you think of security as a cost center within a cost center [IT], ... then security is a great place to start," he adds. "There are companies that are discounting their security in order to drive bottom line," says Charlie Meister, executive director of the University of Southern California's Institute for Critical Information Infrastructure Protection. "I've seen a pretty significant cutback over the past six months," says Rich Cummings, CTO at HBGary, a security company that has clients in the financial services industry.

[ Trying to trim IT costs? InfoWorld reveals 7 easy ideas you may have overlooked. ]

The risk of cutting security is that a security breach can be disastrous. The Ponemon Institute pegs the average cost of a data breach at $6.7 million.

But you may have no choice if the money is not there. Experts say companies that have done the hard work of really understanding their risk posture can trim spending without increasing risk. And companies that have taken security seriously can be equally smart about how they reduce their security costs, says USC's Meister. Sadly, he notes, the companies that are in this position are exceptional: "I don't think enough companies have done a great job of managing their risk profile. And it doesn't really occur [to them] until somebody loses a laptop."

So how do you cut security safely?

One method is to get your security intelligence from free projects, such as the Shadowserver project, rather than paying for the information, Cummings says.

Open source tools preserve security, trim costs
The use of open source software can also be a great place to cut security costs -- especially for small and medium-size businesses, says Spire's Lindstrom. They let businesses get equivalent security tools for less money. "If the product is commoditized enough and your people are skilled enough, it's not unreasonable at this stage of the game to consider open source applications," he says.

For example, the ClamAV anti-virus software and Snort intrusion detection system are two widely used open source anti-virus products, as is the Open Source Security Information Management security event management software.

Companies that don't have the money to pay for full disk encryption might want to look at TrueCrypt, another open source project. Because it lacks centralized management capabilities, TrueCrypt is "not going to be appropriate for every environment," says Morey Straus, an information security officer with the New Hampshire Higher Education Assistance Foundation, but it does work for some.

Outsourcing security to the cloud
For cash-strapped organizations, moving security processes out of the house can be a money-saver. "Look to the cloud computing services to replace some [security products]," Straus recommends.

The IDG News Service is a Network World affiliate.