Penetration Testing mailing list archives
Re: Gartner's Security 3.0
From: "Santiago Barahona" <sant-bar () dsv su se>
Date: Wed, 17 Oct 2007 12:04:18 +0200 (CEST)
Hi all, I agree with you and with the 5% also... from my perspective it depends on the maturity level of the companies. The more mature an organisation is, the less need to spend on security. That'd be because security would be completely embeded in all processes... I guess that 5-8% would be in maintenance, audits, etc... But of course, that's only my guess... I'll try to get my hands on that paper... I agree with the fact that most COs try only to "pass the audit" as you say. The problem is that it is not easy for us to justify "security" by itself, we have to justify it as a business need (security must exist only when it is needed). Security must be aligned with (and aid to reach) the business' objectives.... shouldn't it? Regards, Santiago On Wed, October 17, 2007 3:55 am, xelerated wrote:
I think it should be far more. And not even from a pen tester perspective. If you think about it, the pen tester has the easy job. Its the people that have to secure the network that have the hard job. Think of all the vectors that are never addressed, either because of its not thought of, or its not part of a regulation or audit. How many companies focus on securing desktop (or logging for that matter) as much as they do servers? Sure there are policies and common sense to lock the desktop, but a fair amount the non IT, and older folk dont even consider it. I personally think that the #1 problem in INFOSEC today is many companies do not look at the big picture. Its all about "passing the audit" not REAL security. Just because you can pass an audit does not mean you are any more secure than the next company. Chris OPST, CISSP, CNDA On 10/16/07, M.B.Jr. <marcio.barbado () gmail com> wrote:Pentesters, Gartner's recently -- during its 2007 IT Security Summit -- released it's new corporative Information Security approach, named "Security 3.0". Basically, it suggests that 8 percent (and no less whatsoever than 5%) of the companies' IT budget be focused on security. It is something no doubt but personally I think it could be more, say 10%. The thing is: how are you, as a pentester, feeling such, concerning your incomes? Yours faithfully, -- Marcio Barbado, Jr. ============== ============== "In fact, companies that innovate on top of open standards are advantaged because resources are freed up for higher-value work and because market opportunities expand as the standards proliferate." Scott Handy Vice President Worldwide Linux and Open Source, IBM ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Gartner's Security 3.0 M.B.Jr. (Oct 16)
- Re: Gartner's Security 3.0 xelerated (Oct 16)
- Re: Gartner's Security 3.0 M.B.Jr. (Oct 18)
- Re: Gartner's Security 3.0 Santiago Barahona (Oct 18)
- Re: Gartner's Security 3.0 M.B.Jr. (Oct 19)
- Re: Gartner's Security 3.0 Sebastien Tricaud (Oct 18)
- Re: Gartner's Security 3.0 Pete Herzog (Oct 18)
- Re: Gartner's Security 3.0 M.B.Jr. (Oct 20)
- Re: Gartner's Security 3.0 Pete Herzog (Oct 20)
- Re: Gartner's Security 3.0 M.B.Jr. (Oct 20)
- Re: Gartner's Security 3.0 Jay D. Dyson (Oct 18)
- Re: Gartner's Security 3.0 M.B.Jr. (Oct 23)
- Re: Gartner's Security 3.0 Jay D. Dyson (Oct 23)
- Re: Gartner's Security 3.0 M.B.Jr. (Oct 23)
- Re: Gartner's Security 3.0 pkc_mls (Oct 19)
- Re: Gartner's Security 3.0 Guilaume Vissian (Oct 19)
(Thread continues...)
- Re: Gartner's Security 3.0 xelerated (Oct 16)