Spending on information security is up, but companies are making these investments at the expense of other IT initiatives. According to a recent report by Stamford, Conn.-based Meta Group Inc., 41 percent of companies worldwide are spending at least 5 percent of their IT budgets on information security, up from 33 percent of companies in 2001. By the end of 2003, Meta Group expects 55 percent of companies to be budgeting at least 5 percent of their IT spending toward security.
"The biggest problem at this point is it is taking IT dollars from other functions, and that continues to grow," says Chris Byrnes, vice president for security programs at Meta Group. "If things don't turn around it will continue to cannibalize other IT functions."
Byrnes says application development and IT operations will be most affected as CIOs are pressured to control costs while investing in security. He also says areas such as customer relationship management and storage, areas previously expected to boom, will also take a backseat to security investments. "We see incremental growth in some cases," Byrnes says, "but it's very, very low."
The Meta analyst believes that there are still many companies, however, that are not investing enough in security. According to the report, 41 percent are investing as little as 2 percent or less of their IT budget on security. "They're unsecure,"Byrnes says. "Above that [figure] you're looking at companies making more intelligent business decisions about how much security is appropriate."
Byrnes says financial institutions tend to spend the most on security, with 6 to 10 percent of IT budgets allocated for it. Manufacturing companies (with minimal labor/management strife) fall in the 3 to 4 percent range. Energy companies, as part of the nation's critical infrastructure, fall in the 4 to 6 percent range. Byrnes says most industries are spending between 3 to 5 percent, and they're comfortable with that figure.
"These spending levels are a result of underinvestment in good times," Byrnes says. "We believe that this is a trend that will continue over at least the next two years."