Ugh! Is that your security budget? *Sucks teeth and shakes head*

It's not the spending,

It's not the spending, it's the use of products and diligence that should be evaluated.

Got a expensive firewall, fine. How well is it configured? has it been pen tested? or updated..

Got a security tech(s), how fast do they respond, immediately, somewhere within 4 hours? (to late)

Are the employees treated well enough to take pride in their work or are they so beaten down that they function just enough to not get fired?

HORRIBLE ARTICLE

1) don't write an article which references a report where you have to pay out almost $200 to read.

2) find someone who is known. Perhaps a well published individual so you have more than one piece of reference to use.

3) What he stated is DUH. Nothing new or impressive.

4) Spending depends on more variables than can be put into this article. Many MORE. Again, what is stated isn't new or impressive.

5) What does he mean by "misuse IT security spending"? What an idiotic statement. This alone should let you know he's someone who will be disregarded by the InfoSec community.

6) I assure you, most organizations know their security budget. I assure you it's all based on risk and accepting the fact nothing is totally secure. It comes down to whether an organization can afford something vs the risk. Not a difficult subject to work.

Some organizations accept more risk than others. Some organizations can accept a huge amount of risk, others cannot accept much at all. This largely depends on the type of industry IT is supporting.

In short... making the statement on what percentage of the IT budget should be spent on InfoSec is moronic. Putting together a sound risk management strategy to allow a business/organization to still make money is where this article should focus... not some stupid range of numbers.

No lock on front door

I once worked at a high security site that had no lock on the front door.

When I asked why they had no lock, they said spending money on a lock was not needed as they had 24*7 security guards checking ID's and generally making the site secure.

Seemed sensible to me.

Analysis?

One problem with the "analysis" is different organizations will place the same activity in different budgets. Unless, one digs very deeply into the numbers and knows what to look for the top line number may not include some security done elsewhere and include activities that not security related but got put there.

Money is not a sensible measure of effectiveness

A company who employs a very clued-up I.T. person might have excellent security for an outlay of under £100K p.a, while another company might have terrible security after spunking £millions on a rip-off consultants, a team of "experts" and the latest shinies from Cisco. Security is more down to configuration than equipment.

In almost all things there is only a very loose correlation between cost and effectiveness.

Why do security when there is no real consequence for getting hacked .

For a given value of effective

All that the suits need is support for the claim that they are "Taking cyber [security] seriously.". The amount spent and the trend in that amount sound very detailed and very objective without having to leave the world of pounds and pence. If they have benchmarked their spending against industry norms they'll get extra points for thoroughness even if the outcome of the benchmarking isn't talked about.

This is part, a depressingly effective part, of managing the only aspect of risk that the stratospherically high-ups care care about - reputational risk.

The question of whether corporate or personal reputation is more seriously considered is left as an exercise for the commentariat.

Security metrics

"management" and "the business" are always whining about needing metrics about the RoI from the infosec budget. Posit: a more useful metric would be "how mature is our security setup?" and that a useful and interesting number would be the ratio of expenditure on people to expenditure on the latest, greatest security snake oil. The more spent on people, the better. Good security people only need a Linux box, maybe with a few Windows VMs in a lab environment for testing purposes, smart cooperative colleagues in dev, ops and management, and a stack of Free software. (OK you might want commercial AV, if you disregard the TavisO attitude that it does more harm than good, and some of the fancy UTM / ng firewalls have their merits; but 98% of commercial security products are bullshit.

Security is a cost so budgets will always be under threat

Many organizations view security as a cost and therefore to be minimized wherever possible. The other problem is it is considered to be something associated with the admin infrastructure and therefore subject to even more pressure to minimize overheads. I don't see this changing anytime soon, even in industries that are responsible for critical national infrastructures. Recent highly publicized DDoS attacks coming from mundane devices such as home webcams have brought welcome attention to the problems. But in my experience, corporate memory is short lived and we will be back to business as usual (minimizing the cost of security) in no time at all. I wish I had an answer to corporate blindness on the imperative to treat security as a high value corporate capability, but it eludes me.