"Almost certainly people are experiencing cuts," says Pete Lindstrom, an analyst with the research firm Spire Security. "If you think of security as a cost center within a cost center [IT], ... then security is a great place to start," he adds. "There are companies that are discounting their security in order to drive bottom line," says Charlie Meister, executive director of the University of Southern California's Institute for Critical Information Infrastructure Protection. "I've seen a pretty significant cutback over the past six months," says Rich Cummings, CTO at HBGary, a security company that has clients in the financial services industry.
The risk of cutting security is that a security breach can be disastrous. The Ponemon Institute pegs the average cost of a data breach at US$6.7 million.
But you may have no choice if the money is not there. Experts say companies that have done the hard work of really understanding their risk posture can trim spending without increasing risk. And companies that have taken security seriously can be equally smart about how they reduce their security costs, says USC's Meister. Sadly, he notes, the companies that are in this position are exceptional: "I don't think enough companies have done a great job of managing their risk profile. And it doesn't really occur [to them] until somebody loses a laptop."
So how do you cut security safely?
One method is to get your security intelligence from free projects, such as the Shadowserver project, rather than paying for the information, Cummings says.
The use of can also be a great place to cut security costs -- especially for small and medium-size businesses, says Spire's Lindstrom. They let businesses get equivalent security tools for less money. "If the product is commoditized enough and your people are skilled enough, it's not unreasonable at this stage of the game to consider open-source applications," he says.
For example, the ClamAV antivirus software and Snort intrusion-detection system are two widely used open-source antivirus products, as is the Open Source Security Information Management security event management software.
Companies that don't have the money to pay for might want to look at TrueCrypt, another open-source project. Because it lacks centralized management capabilities, TrueCrypt is "not going to be appropriate for every environment," says Morey Straus, an information security officer with the New Hampshire Higher Education Assistance Foundation, but it does work for some.
For cash-strapped organizations, moving security processes out of the house can be a money-saver. "Look to the cloud computing services to replace some [security products]," Straus recommends.
Forrester Research reports that 28 percent of companies that move to in-the-cloud managed security services do so to cut costs. Although e-mail and Web filtering are the most popular managed security services today, Forrester projects that more businesses will move to the cloud for vulnerability assessment and event monitoring as well.
But for companies that want to improve their security posture without spending money, taking the time to promote an information security awareness program can pay off big-time, according to Straus. "That's just one of the easiest, most effective things you can do and it costs very little."
Straus says he did this in two phases at his organization, a student loan provider. First, he started with a mass presentation outlining good security practices for his users. He then followed up with departmental meetings, which he described as more of a two-way discussion. "I'm able to get the employees to share with me some of the risks and possible pitfalls," he said. "Those meetings are very beneficial."
Analysts say that cutting down on manual processes is one way that smart companies can reduce costs and refocus staff resources.
Luckily, many IT shops are not being forced to make the hard decisions just yet about where to cut security spending. Forrester Research says that security will get a slightly larger percentage of IT budget dollars this year -- on average, 12.6 percent of total IT spending, compared to 11.7 percent in 2008. But because IT 3.1 percent in 2009, that's a big jump in relative terms.