Hear about the four questions you should be asking yourself to optimise your cyber security budget from Dallas Silcock, Security Operations Centre Manager.
Hear about the four questions you should be asking yourself to optimise your cyber security budget from Dallas Silcock, Security Operations Centre Manager.
Transcript
"Hi, my name is Dallas Silcock.
I'm the Security Operations Centre Manager here at AC3.
How would organisations know if they're overspending?
Anyone with cyber budget responsibility is going to be asked this question repeatedly. It's a question commonly asked by executives, board members, shareholders, to determine at what fair market price can cyber security peace of mind be purchased?
While some organisation’ CISOs enjoy unlimited budgets that give them access to alluring and expensive new technical solutions.
No organisation has a boundless capacity to implement and will struggle to operate simultaneous improvements alongside an unlimited budget.
The following four questions and action plans can help you determine if you're overspending.
Question one, what is our current risk appetite?
Develop an asset list or inventory that determines what information assets you're protecting.
Next, define a risk appetite that will instil strategic direction in your security spending decisions and finally, assess the financial impact of the cyber attacks you feel you might face.
Question two, where will our investment be most effective?
Getting the best value from your cyber investments requires understanding the risks you're facing, your risk appetite, and the defensive capabilities that you currently have.
The gap between risks and capabilities is where companies should aim their investment.
Organisations may consider Cyber Security Risk Quantification methodologies such as FAIR, to determine the impact to their risk level through their investments.
Question three, how do we make those investments work?
Once you've identified the biggest gaps between your risk and your capabilities, you now know where to spend.
The next and most difficult question is how and where to spend?
Does this mean buying something new?
Or spending to strengthen an existing security control or capability?
Question four, how do we monitor for overspending?
Once you've made and installed the investments, take a measure, monitor, and measure again approach to determine if the budget being spent is effective based on real-time results.
Cyber threats are always changing and organisations need to have an adaptive mindset and be ready to change their methods, tactics and tools of operations, meaning departments should evaluate and review how they're spending their budgets on a quarterly basis."
