The first edition of the excellent book “Hacking Exposed” by McClure, Scambray and Kurtz proclaims that “Network security is Y2K without the deadline.” While I agree with that assessment—security can indeed be a disaster waiting to happen if ignored—I also worry that it may be an accurate observation for another reason.
The millennium bug was, for technology professionals, a call to arms in ensuring that mission-critical systems would actually work after midnight on Dec. 31, 1999. But while the majority of networks continued to run into the new millennium, the follow-up publicity and sentiment sometimes implied that Y2K concerns were overwrought, a waste of time or the product of computer geeks trying to cash in on manufactured fear.
Security can also fall prey to the same inaccurate perception. Like Y2K efforts, the measure of security success is what does not happen.
To avoid being tarred with the same brush as those who toiled unthanked on Y2K, security professionals need to explain and sell the value of security. Start with a dose of common sense and explain to senior management that security, like many common endeavors, can be assessed based on its preventative benefits. Few people question the need for periodic physicals or cite illness not suffered as confirmation that examinations are unnecessary. The same concept applies to a well-implemented information security program.
Showing senior managers some numbers can also help. Fortunately, data is available on the cost and prevalence of security incidents, which means that security return on investment can be credibly viewed as the monetary savings achieved by avoiding security problems.
The Computer Security Institutes (www.gocsi.com) annual Computer Crime and Security Survey, for example, says 85 percent of respondents detected security breaches in the last 12 months, and 64 percent acknowledged financial losses due to those incidents. Another 35 percent can quantify their total financial losses at an average of more than $2 million per security breach.
These numbers should help your top management understand that an investment in security is money well-spent and that they should keep your security organizations efforts from being likened to the “Y2K Bust.”