​

WITH REGARD TO IT SECURITY, many organizations will be asked to accomplish more with less in the current downturn.

Companies will need to optimize interdepartmental budget sharing, to share security- related tasks, and they may have to outsource more widely. They should also seek ways to improve their return on investment from tools they already have.

Those were some conclusions from a report from RSA, the security division of data services firm EMC. In researching the study, interviewers spoke with 10 CIOs and CISOs from global companies about the best security strategy for challenging times.

When it comes to investing in new technologies, there are some security areas that represent “low hanging fruit,” according to the study, Driving Fast and Forward: Managing Information Security for Strategic Advantage in a Tough Economy. One such area is log management, which can include reviewing events in areas ranging from safety to compliance to finance. Many IT employees in different departments repeat the same reviewing tasks, according to the report. “It can slow employees down and make them compliance-wary.”

One way to view a much wider array of events throughout an organization is with Security Information and Event Management (SIEM). Such technology aggregates and monitors data from a wide range of platforms and devices, including operating systems, applications, and infrastructure services, such as firewalls and virtual private networks (VPNs). SIEM can also assist with growing compliance mandates.

The technology is sometimes acquired and used to monitor one or just a few processes, says Scott Crawford, a senior analyst at Enterprise Management Associates of Boulder, Colorado. But companies would benefit by expanding the use of the technology, which is also integrating with a growing array of management tools.

Study participants and Crawford also point to expanded use of configuration management tools as a cost-effective strategy for strengthening security. Many organizations should consider expanding the technology’s use across the enterprise, says the study.

Companies can also gain efficiencies is in account provisioning, it states. Access systems frequently differ by department in larger organizations.

Many organizations should consider the option of outsourcing, the study adds, but they should do so cautiously. If companies are spending significant sums on oversight, they may not realize cost benefits from outsourcing.

Despite the downsides of outsourcing, such as an added risk of security breaches, there’s been growing interest in outsourcing both SIEM and user provisioning services in the past year, says Crawford.

The study also recommends that companies reevaluate how they manage budget sharing. In the current evolving business environment, it makes sense to let individual departments pay for their security assets, says survey participant Bill Boni, corporate vice president of information security and protection at Motorola. But, he says, the security department should provide the standards and have a governance program.