How Much Should I Expect to Spend on Web Security?
Wednesday, November 25, 2009 at 03:24PM By Rob McAdam
When addressing the issue of web security there are two ways to phrase the question concerning what to spend on IT security. The first question is: How much should I expect to spend on web security? The second question is: How much will it cost the company if I don't spend enough on web security? Of course a business not only needs to spend money on system security, but it must be spent on effective security systems and reviews.
In today's economic climate the issues of security have come to the forefront as web site hackers and computer system attacks grow globally. When looking at the issue of systems and software security, you must consider potential company losses due to online theft, the return on investment for having adequate security, and the need to stay ahead of the brilliant hackers able to manoeuvre their way through even the most sophisticated muli-leveled software systems.
In March 2009 a hacker's group proved that hacking can reach into a customer data bases without a company even knowing. A UK newspaper, "The Telegraph", was compromised by a hacking group and the newspaper found out when the nameless hacking group posted screen shots and other information on the internet, gleaned from their hacking of a 700,000 customer base, as proof of their success.
Upon reading the story closer it seems The Telegraph was using a 2-year old third party code that simply was outdated in the world of sophisticated hackers. When hackers obtain access to customer credit card data, personal information, or government identification numbers, it won't take long before a company finds itself losing business because the targeted market is unwilling to take a chance on accessing their website.
Cost of Doing Nothing
There is a cost to doing nothing when it comes to securing a website. The research shows that up to 10 percent of a company's IT budget may be dedicated to hardware and software security. In most cases it is probably closer to 3 to 6 percent of the budget. Smaller businesses tend to spend smaller percentages of their IT budget on security because of lack of resources more than anything else.
But the fact is hackers can ruin a small business as well as a large business. Deciding what to spend on a web security system is dependent on a number of factors. One of the overriding factors is the type of business itself. For example, a bank or investment business will need state-of-the-art server, router, and operating system securities in place in addition to regular security assessment and penetration testing.
Even as you read this article, hackers are devising new ways to penetrate firewalls and break into websites in order to steal information. Your business should be working just as hard to protect the system as hackers are working to break in to it. Implementing a security system without regular assessment and upgrades is the same as doing nothing. That is what The Telegraph newspaper discovered with their two-year old system.
Mitigating Risk
Mitigating risk is certainly one of the main reasons for security assessment. The underlying infrastructure and codes, employee access capabilities, and customer use of systems must be reviewed regularly for new vulnerabilities. The most common vulnerabilities include SQL injection, URL manipulation, cross-site scripting cookie poisoning and the database server.
Other factors determining how much should be spent on IT security include the following.
* Government regulatory compliance
* Sophistication of system including use of wireless networks, remote access to computer system, dependence
* Need to assure customers system meets industry security standards and best practices
* Rate of past incidences of security breaches
* Size of the potential losses in the event a computer system is attacked
The one thing a company cannot afford to do is to do nothing. Computer data and system protection costs should be budgeted at a rate that gives a company the assurance it can provide customers safe access to its websites and no access to hackers.
Article Source: http://EzineArticles.com/?expert=Rob_McAdam
NOTICE - This article is the opinion of the author or reports the news and opinions of others and is NOT INTENDED TO OFFER ADVICE. This story/article/feature may be an opinion piece — and should be treated accordingly — or reporting on the opinions of others, and should never be considered as a sole source of information or as a suggestion, instruction or prescription. For crime stories, always read the word "allegedly" in any story mentioning "suspects" or "persons of interest". For money/trade and exchange stories, this magazine and its writers accept no responsibility for accuracy — always check with other sources for important decisions. In the case of food/health stories, these facts have not been evaluated by the United States Food and Drug Administration (FDA). Information stated here should be NOT be considered as medical, health, psychological or behavior advice. All information in this story and on this site is provided for educational or entertainment purposes ONLY. Always seek the advice of experts, including doctors for medical opinions. Only a licensed medical doctor can offer medical advice. Legal advice or other expert advice is best referred to experts in their respective fields. The publishers and editors, authors, researchers, employees, heirs and assigns accept no responsibility whatsoever for any advice, facts, opinions in this story, nor for resulting actions of readers of this information. ALL READERS ACCEPT THAT THIS INFORMATION IS PRESENTED ONLY AS EDUCATION, ENTERTAINMENT OR OPINION/INFORMATION AND AGREE IN READING THIS STORY OR THIS SITE THAT USE OF THIS INFORMATION IS SOLELY THE RESPONSIBILITY OF THE READER. Copyright by the author unless otherwise indicated. EXCERPTS from other magazines or media sources are posted under fair use doctrine, on the basis of no more than 5-10% of content with links and credit to source for the complete story. These are posted in the interest of providing interesting links (description as excerpt) with navigation to the source. Likewise, we encourage our many subscribers to excerpt with credit and links to our e-zines, up to 10% of content. To use more content than 10%, please contact the e-zine for permission. ALL RIGHTS RESERVED except as stipulated herein.
Persona Corp. and Blogertize publishes several e-zines for entertainment and information, but cautions readers to read the NOTICE above:
• Advance Magazine
* Secure Network News
Sponsored Advertisers
Jameson Bank – Canada's "It's Taken Care Of" Bank
Amer.com – Technology for Life
View Printer Friendly Version
Email Article to Friend
Reader Comments