Business Technology

The battle for business buy-in: 3 ways to justify your IT security spend

6 min read

23 August 2018

Proving ROI in IT security has traditionally been a struggle. However, businesses are now starting to treat IT security as an investment, rather than simply a cost-centre.

This is according to a recent Kaspersky Lab report. But despite this trend, justifying IT security spend can still be a challenge.

Below are three key points that highlight why it’s so important for businesses to keep cybersecurity updated, both in terms of budgets and approach.  

1. Cyber security incidents impact current and future business operations

Business leaders are realising they have to prioritise cyber security spend. Enterprises are now spending almost a third of the IT budget (£6.9 million) on cyber security and budgets are expected to rise over the next three years across all segments. Both SMEs and large corporates expect spend will rise up to 15%. 

Why? Because the consequences of a hack can spread far and wide. WannaCry stopped the production lines of five Renault factories, while exPetr disrupted business operations at Maersk, the world’s largest container ship and supply company, resulting in losses of between £155 million and £250 million. 

Along with undermining current business operations, cyber threats also impact future-focused initiatives. Digital transformation and business mobility require organisations to operate a growing IT infrastructure, meaning they often lack visibility into their hybrid clouds.

Consequently, data is put at risk of compromise or even encryption. The Zepto ransomware, which was spread via cloud storage apps, provides a prime example of this threat in action.

Moreover, the costs of dealing with the consequences of a cyber security threat are on the rise – due to factors such as having to hire external consultants, acquire new software, deal with PR risks and litigations, etc.

With costs rising and crucial business operations being put at risk, it’s no surprise that top management is now getting involved in the cyber security provisioning debate. But it’s not just their own infrastructure that they have to be thinking about.

2. Even if your corporate perimeter is protected, what about suppliers?

It’s important to understand that a breach can happen even if the business’s own corporate network has the necessary level of protection — through supply chain attacks or breaches as a result of vulnerabilities in third party legitimate software.

We saw the groundbreaking breach of US retailer Target, when criminals gained access to the company’s network credentials through its ventilation and air conditioning vendor. This was followed by the Equifax breach, which was hacked through a vulnerability in legitimate open source software. 

For enterprises, data protection remains a critical issue even if a threat is somewhere outside the corporate perimeter: data breaches resulting from incidents affecting suppliers businesses share data with cost them up to £900,000 million on average. And, with data being stored in multiple locations, cyber security becomes a significant challenge.

3. Business data must be protected, wherever it is

It’s no secret that cloud services offer many benefits to businesses, from taking advantage of a more efficient mobile workforce, to reducing infrastructure costs and optimising business operations.

As such, 73% of SMEs use at least one SaaS hosted business application, while 45% of enterprises have either already raised or are planning to grow their use of hybrid cloud in the next 12 months.

However, as businesses move more data to the cloud, they often end up losing visibility of their data exposure. Data “on the go” that is actually stored outside of the corporate data centre is presenting businesses with new security issues and new costs. The most expensive incidents over the past year were related to cloud environments and data protection issues.

For example, for SMEs, two-thirds of the most expensive cyber security incidents are related to the cloud and third party hosted IT infrastructure failures result in an average £140,000 loss. That’s why it is so important to consider a dedicated level of cyber security when moving workloads to cloud platforms.

To summarise, these three insights can help explain why cyber security should be prioritised. For an advanced level of cyber security, businesses must implement cyber security as one of the core functions across their IT infrastructure.

A set of appropriate cyber security solutions can then be deployed, enabling the adaptive and manageable protection of workloads across physical and virtual machines, containers and public cloud. It’s critical to achieve seamless administration and visibility across a hybrid cloud infrastructure.

And last but not least, businesses have to realise their responsibility for data and workloads that are stored in cloud applications and platforms. A false sense of safety and relying on providers to ensure security can be extremely costly – your data is your responsibility.

Maxim Frolov is vice president of global sales at Kaspersky Lab.