From: Pete Herzog (lists@isecom.org)
Date: Wed Oct 17 2007 - 15:26:46 EDT
Hi,
I think such things are so dumbed down that they make no argument at all.
First, it depends upon the business. Not all business need to spend the
same became they are not all protecting the same thing. Secondly, Gartner
needs to get its act together and actually define what they are saying is
security. Are they including that RFID door pass which runs through te IT
department and site back-ups or do they mean just system solutions?
Thirdly, cost and function are two totally different beasts. You can do
stupid things like buying AntiVirus licenses for all desktops that will eat
up a great deal of any budget or you can pay attention to architecture,
design, hardening running services, etc. for the systems in operation for
the cost of a person per N systems (actually it may already be included in
the system set-up and roll-out department).
So to say people should devote ANY arbitrary number to security makes no
sense. How about they start talking instead about the level of controls
(not solutions) that all Internet-based services and infrastructures should
have in place for 2007. Oh wait, they want to reduce everything to an
arbitrary dollar amount instead of making sense.
Businesses that prepare by the percentages of pundits will always pay
premium for partial protection.
-pete.
www.isecom.org
Professional security certifications that really mean something about you.
M.B.Jr. wrote:
> Pentesters,
>
> Gartner's recently -- during its 2007 IT Security Summit -- released
> it's new corporative Information Security approach, named "Security
> 3.0".
> Basically, it suggests that 8 percent (and no less whatsoever than 5%)
> of the companies' IT budget be focused on security.
>
> It is something no doubt but personally I think it could be more, say 10%.
>
> The thing is:
> how are you, as a pentester, feeling such, concerning your incomes?
>
>
> Yours faithfully,
>
>
>
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:58:09 EDT