Re: Looking for Sample Security Budget

Start with staffing costs.
Don't forget insurance.

I'd invert your list - put people and process first since they will be
the major costs.  Technology and technological upgrade is easy to "push
out to next year" or finagle in other ways - heck, its often a tax
deduction and since it has "book value" as a tangible its easier to
justify.  Which means you have to work harder on the intangibles, which,
in the long run, are the ones that are really important - education and
awareness.

On Mon, 2003-09-29 at 21:59, James Bowman wrote:
> Have been tasked with contributing numbers for a 2004 security budget.  Any thoughts on what I may be leaving out?  Yes, I know this can be based on the goals of the organization, priorities, etc.  But think well-balanced...  Here's what I feel should be covered:

>
> NIDS and Firewall logs - Hire managed services to perform audits?
> Anti-virus and compliance checking
> Vulnerability scanning
> IPS?
> HIDS agents, (critical servers and sampling of workstations)
> Tripwire or facsimile
> Honeypots/nets
> Patch management
> Asset and Risk determination tools
>
> Lots of training and seminars, end-user education
>

--
Anton Aylward CISSP CISA <anton@si.on.ca>
System Integrity

>From - Mon Jan 1 00:00:00 1965
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
From: