Information Security Cost Management

Security programs often promise thorough protection while ignoring how little time, personnel, and money most organizations actually have. This book takes a practical stance on information security, building its guidance around those budgetary and day-to-day limits. Its frameworks, sequential processes, and project management breakdowns show how to shape a security strategy that fits the resources already on hand.

The book is arranged in five sections. The first helps readers chart a course that keeps their security work focused and effective. The second examines staffing, which is the largest single cost for a security team, and explains how to staff it economically. The third covers the documentation that records strategy and supports annual audits, and it shows how to report results to senior leaders in a way that gets attention. The fourth explains how to identify high-risk areas so that scarce resources go to the threats that are most immediate and serious.

The final section deals with access control. It addresses the difficulties of managing user accounts by hand, the ways automation can handle those tasks at lower cost, and the steps for responding to a security breach. Throughout, the author stresses how to stretch a limited security budget without weakening risk management, and the book supplies the tools needed to put in place the policies, processes, and training that a company's security depends on.