Folks struggling to get funding to implement security programs are a hot button of mine. I know it’s hard. I know we are expected to protect stuff with tighter budgets and fewer resources. A cornerstone of our research is effective prioritization so you can focus on the things most important to your organization. I get all that. But most folks aren’t a lot more sophisticated than passing around a tin cup during the budgeting process and hoping they get sufficient funding.

If you want any chance of success in security, you need to be able to get funding for your key projects. And passing a virtual tin cup doesn’t cut it. I recently saw an article on NetworkWorld that hits on these topics, 10 tips to secure funding for a security program, and figured it was another one of these lightweight slide shows meant to drive a bunch of page views.

But when I started reading and almost immediately saw a discussion of ROI for getting security funding I was a bit chagrined. If you talk ROI you have very little chance of success. Although the author (Dominic Nessi) makes a good point:

However, cyber security budget requests are more difficult to quantify. Security ROI is typically expressed by comparing security investments with the potential liability caused by security breaches. This is similar to calculating the financial benefit of insurance for physical assets, such as buildings and equipment.

Insurance. Awesome. But it is what it is. It’s about risk – either minimizing or transferring your risk. Don’t even waste time thinking about eliminating risk. Dominic talks about putting a program framework in place and relating the goals of the security framework to the goals of the business. Yup.

So read these 10 tips, and understand they aren’t really 10 tips – these are all basic things that go along with having a strong security program.

But I’m not sure why getting a CISSP is important for getting funding. If you are looking at a certification to prove competence to your senior management you’re doing it wrong. But railing on certifications is another topic for another day.

Photo credit: “Beggar girl” originally uploaded by Taifighta