Poor Security Budgets Help Hackers Win
Cybersecurity is a hot topic — for businesses one breach can be devastating in terms of financial costs, lost trust and damage to reputation. It is vital, therefore, that security budgets reflect the amount of risk that your company faces.
In reality, most businesses only allocate around 3% of the budget to their application security when around 30% of threats will attack at this level. This is a dream come true for hackers!
It is clear that spending on application security has fallen back to unrealistic levels and part of the reason for this is that non-specialists are often out of their depths when it comes to making decisions of a technical nature. However, the stats alone indicate a real need to invest in application security.
Why Is This Threat so Underfunded?
Security budgets are often set following practices that have been established over some time without looking at the fact that the nature of the threats has changed. This means that the organization lags behind the sophisticated breaches that are the specialty of modern hackers. Whereas in the past an app may have been used for marketing alone, now with the product online, access to the cloud and mobile apps provide a way into company assets and hackers know this.
As there has been an increase in DevOps as companies seek to become more agile there is also a need to restructure their architecture. Threat protection needs to be part of this. The IT budgets will need to be realigned and failing to allocate a good portion of this application security is short-sighted and risky. Security budgets must be re-balanced, particularly when your largest asset is currently attracting the smallest allocation!
If you increase the budget in one area it needs to be accounted for by reductions in another. An area that has been identified for reduction has been network security which can take around 70% of an average security budget. This is based on the past needs of businesses running internal servers. With the movement into the cloud, there are fewer internal servers that need protecting and although these threats will not go away it does make sense to move part of the budget across to protect the cloud and the data contained therein.
Security changes all the time as threats continue to increase and evolve and in a decade business will likely be having the same discussions. But for today, hackers will exploit an unsecured application which will then enable them to launch multiple successful and damaging breaches. This must be addressed as a key priority.
If you’re looking for a company that provides system integration services and other software development services contact us.
