Security and technology can seriously suffer within an organization that has bitten by the skills shortage bug. Consider these possible scenarios:
1) The Swing and Miss
An organization lacks sufficient in-house skills to handle complex security tasks, such as managing emerging and evolving threats, testing for vulnerabilities and preparing for and responding to incidents.
2) The Short Shrift
Security consumes so much bandwidth from the internal team because of its complexity that other areas of IT receive far less attention than they require.
3) The Cold Shoulder
An organization's IT staff decides against investing adequate time and effort into security because it demands a disproportionate number of resources. Other, more business-enabling and strategic-focused IT tasks receive those assets instead.
Do any of these situations sound familiar? Perhaps more than one? Maybe all of them?
With virtually every organization now a digital organization, you may find yourself entangled in a vicious cycle of trying to sufficiently attend to all of your technology needs and initiatives, security included. Across organizations of all sizes, IT practitioners are being stretched to the max to keep pace.
According to a recent survey of 287 IT and business professionals conducted by CSO, CIO and Computerworld, most organizations turn to their general IT department to handle security tasks. Far fewer have a dedicated security group due to the challenge of discovering, hiring, training and retaining suitable talent.
And what about the rest? A growing number of organizations are using or contemplating third-parties to provide security augmentation for some or all of their responsibilities.
And don't think that an organization fortunate enough to employ a senior executive to oversee the security program is swimming in an abundant supply of competent infosec staffers either.
Instead, the presence of a CISO may be more indicative of a company that views security through the lens of business. Among the security leader's many duties is to examine and measure the viability and value of their existing resources, with the goal being to prioritize the best possible ROI outcome.
Oftentimes, as veteran security analyst Jon Oltsik of Enterprise Strategy Group points out, this "portfolio management" approach results in both a recognition that organizations can't do security entirely on their own and a decision to work with a partner to help them amplify their available resources.
Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.
