Download - Help Net Security

As expected, cybercrime is soaring worldwide
and at the same time, the recession is
shrinking IT security budgets in most industries.
Do you see any strategies that
can fill the void as the money runs out?
What recommendations would you give to
organizations?
Now is one of the most critical times to not
drop the ball on security. So much of security
comes down to little decisions that employees
make every day that inadvertently put a business
or its customers at risk. Security tools,
processes and technologies help to create a
safety net for those mistakes, but when secu-
rity budgets are cut, the net becomes tattered
and leaky.
The key is to create a culture of security and
help make it infectious in an organization.
Some companies have managed to evangelize
security and bring awareness through
brownbag lunches, security awareness events
and sending "influencers" in the company to
industry events like RSA Conference.
Building awareness has the two-fold effect of
helping employees make good securityconscious
choices day-to-day and also keeping
security in clear view of executives that
need to make budgeting decisions.
Building awareness has the two-fold effect of helping employees
make good security-conscious choices day-to-day and also keeping
security in clear view of executives that need to make budgeting
decisions.
Legitimate businesses are not the only
ones impacted by an unstable financial
system. What kind of ramifications is the
economic downturn having on the underground
economy? What type of remodeling
can we expect to see in the near future?
Most indications are that the underground
economy is thriving and growing rapidly. In
some ways it's also becoming more efficient -
meaning that the prices for certain types of
stolen data have stabilized - making this type
of data more of a commodity. This is a scary
situation for businesses because it means that
it's getting easier to turn customer data into
cash, which means the motivation to steal
data is strong.
There has also been a maturing in the underground
services market, too. This means that
someone that has malicious intent - who
wants to launch a Distributed Denial of Service
(DDoS) attack for example - but not the
technical skills or resources to execute the at-
tack can now outsource. The result is a
broadened range of digital adversaries. All of
this means that we're likely to enter a period of
significant attacker innovation, making it more
important to carefully monitor threats and keep
up with the latest attack trends.
Achieving more on a smaller budget and
keeping an organization protected at the
same time is on the table of many security
professionals. Can we expect talks related
to budgeting security at RSAC 2010?
While we're still developing the content for
RSA Conference 2010, budgeting for security
is obviously top of mind for security practitioners.
Some organizations, pushed by today's challenges,
have been forced to innovate in the
areas of security metrics and risk management
to better use their budgets and minimize
risk. I'm looking forward to seeing the results
of that innovation at RSA Conference 2010.
www.insecuremag.com 49