Jeff Multz, VP of Sales

1
How to get your share of the budget for your IT
security needs

• Jeff Multz, VP of Sales

2
Agenda

• Why is it so challenging to get the money you
  need to secure your network?
• Rules for communicating with CFOs
• 7 Steps for highly effective IT Budgets
• Questions answers

3
Your network handles millions of dollars in
assets . . . .

• So why
• is it such a challenge
• to get
• the money you need
• to secure your system?

4
Whats your picture of a CFO?

• Controlling

• Penny pincher

• Buttoned-down

• Caustic

5
The Rules

• What to know before you ask your CFO for IT
  security dollars

6
Communicate early often.
Rule 1
7
Speak the CFOs language.
Rule 2
8
Speak the CFOs language . . . not Techno-ese
Phishing
Spamming
VPN
SQL
IIS
Patching
FIL
Spoofing
IT
Sniffing
SSL
RPC
CERT
IPC
Hacking
Buffer Overrun
IPS
RSA
CRC
IDS
MD5
9
Know the business situation.
Rule 3
10
Be a straight shooter dont pad your budget.

Rule 4
11
Pass the weight test be prepared.
Rule 5
12
Pass the weight test. Be prepared.

• Fly with the eagles first.
• Get your numbers straight
• Justify the decision in terms of price,
  functionality, requirements
• Refer to past expenses and trends

13
Dont create surprises . . .not even good ones.
Rule 6
14
The Rules

• Communicate early often
• Speak the CFOs language
• Know the business situation
• Be a straight shooter
• Pass the weight test
• Dont create surprises

15
The 7 Steps for Developing Highly Effective IT
Security Budgets
16
The Seven Steps to Highly Effective IT Security
Budgets
1. Document current situation
17
Document your current situation

• What are your capabilities today?
• Infrastructure
• Inventory management
• Network diagram necessary
• Security
• Operations
• Expertise/skills
• What does it cost you today?

18
The Seven Steps to Highly Effective IT Security
Budgets
1. Document resources
2. Perform gap analysis
19
How do you get from here to there?
What I have today
What Ill need tomorrow
20
Bridging the gap

• What business objectives do you want to achieve?
  How do those objectives compare to what you have
  now?
• If there is a gap, how will you get from here to
  there? What resources will you need to achieve
  your objectives?
• What are the possible solutions?
• A product?
• More personnel?
• Training?
• Outsourcing?

21
The Seven Steps to Highly Effective IT Security
Budgets
1. Document resources
2. Perform gap analysis
3. Gather information
22
The Seven Steps to Highly Effective IT Security
Budgets
1. Document resources
2. Perform gap analysis
3. Gather information
4. Consider external forces
23
Consider external forces

• Compliance issues
• Non-IT initiatives (corporate growth plans,
  product rollout strategies, etc.)
• Changing industry practices
• Contractual obligations
• Existing organizational policies

24
The Seven Steps to Highly Effective IT Security
Budgets
1. Document resources
2. Perform gap analysis
3. Gather information
5. Generate budget needs
4. Consider external forces
25
The Seven Steps to Highly Effective IT Security
Budgets
1. Document resources
2. Perform gap analysis
6. Review Determine ROI TCO
3. Gather information
4. Consider external forces
5. Generate budget needs
26
The review phase

• Determining ROI (Network security savings cost
  of security breach)
• How long did it take to repair the problem?
• Add up number of incidents
• Consider time lost, hourly wages, benefits
• Was there network downtime? How much business
  was lost as a result?
• ROI is a journey, not a destination
• Opportunity Cost
• How many projects were shelved, delayed, or
  deferred because you had to resolve a crisis?
• TCO

27
The Seven Steps to Highly Effective IT Security
Budgets
1. Document resources
7. Present business case
2. Perform gap analysis
6. Review Determine ROI TCO
3. Gather information
5. Generate budget needs
4. Consider external forces
28
Construct the business case

• Business Issue Network security management
  monitoring
• Expense
• Hardware/Software 15,000
• Setup/Installation (one-time) 2,500
• Management N/A
• Employee Salaries 140,000
• Employee Training 36,000
• Totals 193,500
• MSSP 25,000
• Solution Go with MSSP

29
Begin the second phase
1. Document resources
7. Present business case
2. Perform gap analysis
6. Review Determine ROI TCO
3. Gather information
5. Generate budget needs
4. Consider external forces