How to reduce the cost of IT ownership… security and compliance
Compliance and security are legitimate buzzwords. The environment in which businesses operate is rapidly becoming more dangerous.
Security has transformed from a technical discipline to a strategic discipline in recent years. This allows companies to better manage overall risks and liabilities. But security needs to be seen as one of the foundations, which means incorporating it from the beginning and into all areas.
Compliance has gained momentum in recent years with the introduction of new directives and laws issued by the EU. Although it seems like another bureaucratic step, many of these regulations are aimed at a higher level of security and privacy.
So how is it possible that with increasing requirements for security and compliance, these concepts can be used to optimize the costs of operating not only IT, but also the entire company? Let’s take a look.
Other reasons for decision makers
But first, let’s expand the list of reasons why security and compliance should be included in the strategic decision-making aspects of management.
One of the biggest nightmares of managers is costs spent “for nothing”. In order for security and compliance to not fall into this category, it is necessary for decision makers to devote enough time to fully understand why regular costs for these accounting items are necessary.
As you can see, it is the numbers and risk analysis that then determine specific technical measures. However, in order for IT tools to be used correctly, they must have the right purpose. And this is closely related to the strategic management of the company.
How we commonly view security (and why it's not enough)
The initial state that is commonly found in companies reflects the superficial view – security and compliance are necessary evils. They cost a lot of money, there is no business from it and the question is still hanging in the air whether it is really needed to this extent in the company.
The unacknowledged key role then leads to audits being done once a year – at best – because that is enough. The cost item is constantly sitting on the statement, which makes managers nervous, because they would very often like to “optimize” it.
And all responsibility ideally lies on the shoulders of one technician, who is a Jack-of-All-Trades.
We hear about security incidents every day, but companies still live with the feeling that such a thing cannot happen to them.
But it can happen to any company regardless and if security and compliance are only a nuisance, then in the event of a problem, a big problem will arise. Security needs to behave like a living organism. It needs to develop, respond to changes in the environment and adapt its actions.
However, this is completely inconsistent with the view of security being degraded to a necessary evil and its adaptation and adjustment can change at most once a year.
The most common blind spots in safety management
That was the attitude towards security. Then there is the approach to security. But the view is not much prettier.
Companies often solve security by purchasing software or tools. But that is only a small piece of the huge puzzle of securing the functioning of the entire copmany. Given the complicated cybersecurity environment, only a handful of people can think that appropriately selected programs will protect the company.
Much more must be included in security. And only thanks to a correct approach to security and analyses is it possible to uncover real risks and assign them a level of criticality. Otherwise, all the threats are on one pile and no one knows which will cause a collapse and which will only cause a minor inconvenience to the operations.
Companies also do not like to face specific potential impacts expressed in time, finances and reputation. Such an approach is seen as too negative, pessimistic or even bringing bad luck. But if a company does not calculate the impacts well, then it does not know what it is facing. And if they don’t know what they’re facing, they can never handle it well.
We’ll end the whole list with the traditional security settings in companies. Quite often, the default setting is in the reactive security state. We only do something when something happens. But that is too late.
Actual impacts on the company
What does the sum of the attitude and approach cost the company? It is not a small amount.
The company will encounter unplanned outages that can stem from various sources. But it does not matter which way the wind blows, because an unplanned outage will always mean a disruption in the company’s operations. And this equation often ends in lost sales and increased costs for resolving the incident.
This reaction is not a cheap matter. In the case of unplanned outages, the first stage is the detection stage. This is followed by the resolution, recovery and return to operation stages. And ideally, the implementation stage is then followed by the implementation of measures to prevent it from happening again. As the word in this paragraph implies, there are considerable additional costs.
And then we have the damage that cannot be quantified at all. That is precisely its problem, because without financial value, managers can often ignore it. Failure to meet commitments to customers leads to a loss of their trust. And if the company operates in a regulated environment, then the regulator can start breathing down its neck.
The bottom line is that chaos always costs more than controlled operations. So if you set up clear security and compliance processes in your company, you will pay for it in incidents that will never happen to you.
Changing perspective: safety as an operational discipline
Is your misconception already eroding? Then we can complete its transformation. In order to properly incorporate security and compliance into the functioning of the company, it is necessary for management to bear the responsibility for these areas. Only in this way will there be fully central management of the main aspects of operation and it will be possible to fully coordinate them. But only if there is close cooperation with technicians.
They must be allowed to work regularly on security, audits, patching and monitoring. And of course, this requires appropriate tools that will appropriately automate their work.
Simply put, ensure that IT experts have a position at the decision-making table so that they can fully and with full support perform their work. It is not just about the security of the IT department, but about the safe operation of the entire company.
Risk vs. prevention: an economic perspective
From an economic perspective, we will always look at the balance between risk and prevention. Some companies are more risk averse than others. The same applies to the management of these companies. So once you have determined which category your company falls into based on your needs analysis, it is time to assign the appropriate tools, processes and measures to this risk-prevention scale.
To determine the extent to which a company is willing to bear risk, it is useful to imagine risk and prevention as financial items.
Risk – a one-time payment with an uncertain maturity date
Prevention – a regular, predictable payment
Quite often, companies only look at how much security and compliance cost. But there is another question that is just as important: how much does it cost to not have them in place?
The role of company management
So let’s summarize the role of company management in ensuring IT security and compliance.
- Involve IT in strategic decision-making
- Prepare a risk aversion profile based on needs
- Engage in regular security and compliance reviews
- Incorporate business continuity and disaster recovery
Questions decision makers should ask themselves
Let’s go back to point number two – the risk aversion profile.
Decision makers need to understand what it will look like if a key company system goes down. They also need to calculate how long the outage can last without significantly jeopardizing the future functioning of the company.
Then it is also necessary to compile an overview of employees who have access to individual aspects of security. It is necessary to know who is responsible in order to manage the entire process effectively.
The risk profile also needs to explain why the company is accepting the risk. This will make it clear what types of incidents it will approach reactively.
Summary
In today’s situation, it is not possible for a company to be “bulletproof” against all threats. It is necessary to be prepared in such a way that an incident does not ruin the company.
