No consensus on cost of security

When it comes to IT security, companies put products before people according to the latest research from security training company (ISC)² which shows that products and services eat up more money than spending on personnel. 

Organisations globally spend approximately 57 percent of their IT security budgets on security products and services. The remaining 43 percent is spent on personnel, education and training, according to the (ISC)² Global Information Security Workforce Study.

"That only 43 percent of IT security budgets is spent on hiring and training personnel is surprisingly low," said John Colley, director of (ISC)², a not-for-profit IT security training company.

"The rest is spent on products and third party services like PKI's [public key infrastructures], that are very expensive," said Colley.

The alternative — dealing with threats in-house — is not as cost effective as outsourcing, argued third-party email services provider MessageLabs.

"If you invest in products and manage them internally, you're going to push up personnel costs — some internal services have a higher cost of ownership," said Paul Wood, senior analyst at MessageLabs. "I don't think organisations should spent huge amounts on personnel," Woods concluded.

Managed services and products taking up a greater proportion of the global IT security budget did not surprise MessageLabs, as Wood says they mitigate threats effectively.

"With the rapidly changing nature of threats, outsourcing security has reached a tipping point — it's the option with the least risk," said Wood.

However, greater emphasis on managed products and services has not curbed enthusiasm for training for personnel, according to (ISC)².

Overall, respondents anticipated their level of education and training to increase by 22 percent over the coming year, while in Europe the Middle East and Africa 60 percent of respondents said they wanted to get a professional qualification in the same period.

Compliance, the evolution of information security professionals into a separate business unit, and greater financial rewards and job prospects for qualified chief security officers were all increasing the demand for training, (ISC)² said.