Re: Gartner's Security 3.0

[Pete Herzog <lists () isecom org>]

Hi,

I think such things are so dumbed down that they make no argument at all. 
First, it depends upon the business.  Not all business need to spend the 
same became they are not all protecting the same thing.  Secondly, Gartner 
needs to get its act together and actually define what they are saying is 
security.  Are they including that RFID door pass which runs through te IT 
department and site back-ups or do they mean just system solutions? 
Thirdly, cost and function are two totally different beasts.  You can do 
stupid things like buying AntiVirus licenses for all desktops that will eat 
up a great deal of any budget or you can pay attention to architecture, 
design, hardening running services, etc. for the systems in operation for 
the cost of a person per N systems (actually it may already be included in 
the system set-up and roll-out department).

So to say people should devote ANY arbitrary number to security makes no 
sense.  How about they start talking instead about the level of controls 
(not solutions) that all Internet-based services and infrastructures should 
have in place for 2007.  Oh wait, they want to reduce everything to an 
arbitrary dollar amount instead of making sense.

Businesses that prepare by the percentages of pundits will always pay 
premium for partial protection.

-pete.
www.isecom.org
Professional security certifications that really mean something about you.


M.B.Jr. wrote:
> Pentesters,
>
> Gartner's recently -- during its 2007 IT Security Summit -- released
> it's new corporative Information Security approach, named "Security
> 3.0".
> Basically, it suggests that 8 percent (and no less whatsoever than 5%)
> of the companies' IT budget be focused on security.
>
> It is something no doubt but personally I think it could be more, say 10%.
>
> The thing is:
> how are you, as a pentester, feeling such, concerning your incomes?
>
>
> Yours faithfully,

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------