Scare tactics no longer guarantee security funding

Chief security officers used to be able to get the funding they wanted for critical IT security projects by using newspaper clippings detailing security failures that cost other companies millions of dollars. Those were the good old days, IT security managers said at the Cyber Security in the Financial Services Sector Summit here last week. Budgeting for security today is a lot more complicated. “Responsibilities are increasing, the time pressures are increasing, and we’re under increasing legal and regulatory pressures. The only things that are not increasing are our funding and staffing levels,” said Gene Fredricksen, vice president for information security at Raymond James Financial Services Inc. in St. Petersburg, Fla. “It requires us to rethink how we budget. The old fear, uncertainty and doubt model doesn’t seem to be working anymore. We can’t scare our senior management into giving us money.” But that doesn’t mean that senior executives aren’t interested in security, other security managers said. On the contrary, many senior executives and corporate boards with control of corporate purse strings are simply demanding more information on the elusive return on investment and overall business benefit of incremental increases in security spending. Full Story