“New Normal”
Kerry Ann Anderson · Auerbach Publications eBooks · 2014
Many information security professionals have read of or experienced the three-legged stool as analogy to describe the interrelationship between the three dimensions of a project or deliverable: time, cost, and quality. A budget must be appropriate to support the amount of security required by a specific organization based upon an assessment of its threat environment, regulatory requirements, and management’s current level of risk tolerance. Information security managers need to make their own evaluations of the adequacy of their budget amount. Many information security managers look back on the deep-pocket budget days of the late 1990s/early 2000s created by a booming economy fueled by irrational exuberance and use this period as a measuring stick for funding of security budgets. Some chief information security officers and cyber security consultants have used fear, uncertainty, and doubt as their primary tactic for securing additional budget. True security involves protection of people, processes, and technology against danger, loss, or unauthorized use.