{"id":27666,"date":"2017-10-26T10:00:56","date_gmt":"2017-10-26T14:00:56","guid":{"rendered":"https:\/\/sdtimes.com\/?p=27666"},"modified":"2017-10-26T08:53:14","modified_gmt":"2017-10-26T12:53:14","slug":"security-budget-helps-hackers-win","status":"publish","type":"post","link":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/","title":{"rendered":"How your security budget helps hackers win"},"content":{"rendered":"

When a single breach can cause untold damage to your business, from millions in losses to reputational damage, operational disruption, and lost trust, you want to align your security budget with the actual threats you face. So why does the typical company allocate less than 3% of its\u00a0<\/span>security budget<\/span><\/a>\u00a0to\u00a0<\/span>application security<\/span><\/a>\u2014when a full\u00a0<\/span>30% of successful breaches<\/span><\/a> strike at the application layer?\u00a0<\/span><\/p>\n

For hackers, it\u2019s a dream scenario, like a burglar watching a homeowner install expensive new door locks while the windows remain wide open. But it\u2019s a dangerous situation for your business, leaving you one unlucky break away from making the wrong kind of headlines.\u00a0<\/span><\/p>\n

How has application security spending fallen so far out of line with the actual threats companies now face?<\/i><\/b>
\nThe highly technical nature of this area can make it challenging for non-specialists to provide meaningful guidance for the allocation of security budgets\u2014at least, that\u2019s the excuse that\u2019s often given. But identifying and quantifying risk doesn\u2019t have to require specialized expertise. The stats above make all too clear that there\u2019s gross misalignment between current attack and breach trends, and the amounts being invested in protection at those layers. The conclusion is inescapable: in light of the prevalence of successful application-layer attacks, application security spending is inadequate by an order of magnitude.<\/span><\/p>\n

The underfunded threat<\/b>
\nOften, security budgets tend to follow established industry practices, focusing on incremental improvements on the types of defenses already in place rather than making major shifts in approach. That would be fine if the nature of the threats companies faced remained fairly constant\u2014but it leaves the organization at risk of falling behind when fundamental shifts in computing architecture reshape the threat landscape.<\/span><\/p>\n

Ten years ago, the typical web app amounted to little more than a marketing channel. The site contained product information, where-to-buy or online ordering functionality, and so on, but the actual logic and data resided within the company\u2019s own network. In that light, it made sense for network security to play the central role in threat protection. Now, however, the product itself is online, including all of its code and customer data\u2014making web, cloud, and mobile apps the company\u2019s largest digital assets. That also makes those assets the largest target to attackers.\u00a0<\/span><\/p>\n

DevOps is part of the story as well, as is so often the case these days. While DevOps isn\u2019t directly responsible for driving the need for more application security spending\u2014that\u2019s more a factor of the changes described above\u2014it does create an ideal opportunity to address the changing threat landscape. As companies seek to leverage the speed and agility made possible by the DevOps model, they\u2019re re-architecting their systems from the ground up around cloud services and other next-generation resources. Threat protection is a natural part of that conversation\u2014as we realign the broader IT budget with the changing needs of our business, how should we also realign our security budget according to the changing nature of the risks we face?<\/span><\/p>\n

When your biggest digital asset draws only a small fraction of your security budget, the answer is clear.<\/span><\/p>\n

Rebalancing the security budget<\/b>
\nEven a business-critical area like security can\u2019t be allowed unlimited resources; increased spending on application security will need to be accompanied by reductions elsewhere. Again, changes in computing architecture provide a useful way to think about this.<\/span><\/p>\n

In discussions with CISOs, network security accounts for approximately 70% of the typical security budget. This made sense in past years, when the typical IT organization ran a large number of internal services on physical hardware that needed continual OS maintenance and firewall management. Today, the majority of such services have been outsourced to\u2014and protected by \u2014 SaaS, IaaS, or PaaS providers. With far fewer internal services to protect, and a network perimeter that is being relocated into the cloud, IT can focus on what still needs to be secured for customers: the application logic and customer data in web applications. While it might not make sense to flip the allocation entirely–traditional network security threats aren\u2019t going away– the fact that your cloud and DevOps teams are building new software from the ground up for the first time in more than a decade offers a unique opportunity to rethink and reallocate your budget to more accurately reflect your risk.\u00a0<\/span><\/p>\n

\u00a0Security will always be something of a moving target as threats evolve in tandem with computing architecture. The landscape will likely change as much\u00a0ten years from now\u00a0as it has over the past ten years. But right now, attackers are exploiting a grievously under secured application layer to launch an alarming number of successful breaches. Addressing that imbalance should be at the top of every C-level agenda.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

When a single breach can cause untold damage to your business, from millions in losses to reputational damage, operational disruption, and lost trust, you want to align your security budget with the actual threats you face. So why does the typical company allocate less than 3% of its\u00a0security budget\u00a0to\u00a0application security\u2014when a full\u00a030% of successful breaches … continue reading<\/a><\/p>\n","protected":false},"author":766,"featured_media":27668,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"cybocfi_hide_featured_image":"","footnotes":"","_links_to":"","_links_to_target":""},"categories":[1],"tags":[132,2190,254,1205,3244,12025],"coauthors":[12024],"acf":[],"yoast_head":"\nHow your security budget helps hackers win - SD Times<\/title>\n<meta name=\"description\" content=\"How has application security spending fallen so far out of line with the actual threats companies now face?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How your security budget helps hackers win - SD Times\" \/>\n<meta property=\"og:description\" content=\"How has application security spending fallen so far out of line with the actual threats companies now face?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/\" \/>\n<meta property=\"og:site_name\" content=\"SD Times\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/SDTimesD2\" \/>\n<meta property=\"article:published_time\" content=\"2017-10-26T14:00:56+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2017-10-26T12:53:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"426\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Andrew Peterson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sdtimes\" \/>\n<meta name=\"twitter:site\" content=\"@sdtimes\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andrew Peterson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/\"},\"author\":{\"name\":\"Andrew Peterson\",\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/person\/91cdf36a0449905b5a188decd90afb84\"},\"headline\":\"How your security budget helps hackers win\",\"datePublished\":\"2017-10-26T14:00:56+00:00\",\"dateModified\":\"2017-10-26T12:53:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/\"},\"wordCount\":803,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/sdtimes.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg\",\"keywords\":[\"agile\",\"cybersecurity\",\"DevOps\",\"hackers\",\"software security\",\"threat protection\"],\"articleSection\":[\"Latest News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/\",\"url\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/\",\"name\":\"How your security budget helps hackers win - SD Times\",\"isPartOf\":{\"@id\":\"https:\/\/sdtimes.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg\",\"datePublished\":\"2017-10-26T14:00:56+00:00\",\"dateModified\":\"2017-10-26T12:53:14+00:00\",\"description\":\"How has application security spending fallen so far out of line with the actual threats companies now face?\",\"breadcrumb\":{\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#primaryimage\",\"url\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg\",\"contentUrl\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg\",\"width\":640,\"height\":426},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/sdtimes.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How your security budget helps hackers win\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/sdtimes.com\/#website\",\"url\":\"https:\/\/sdtimes.com\/\",\"name\":\"SD Times\",\"description\":\"Software Development News\",\"publisher\":{\"@id\":\"https:\/\/sdtimes.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/sdtimes.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/sdtimes.com\/#organization\",\"name\":\"SD Times\",\"url\":\"https:\/\/sdtimes.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2014\/05\/deafaultlogo.png\",\"contentUrl\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2014\/05\/deafaultlogo.png\",\"width\":225,\"height\":90,\"caption\":\"SD Times\"},\"image\":{\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/SDTimesD2\",\"https:\/\/x.com\/sdtimes\",\"https:\/\/www.linkedin.com\/company\/sdtimes\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/person\/91cdf36a0449905b5a188decd90afb84\",\"name\":\"Andrew Peterson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/person\/image\/7de62b199b7fabe199ca7a8427ac3403\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/9952f10a93f474f30b3867cd0db22bd3?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/9952f10a93f474f30b3867cd0db22bd3?s=96&d=mm&r=g\",\"caption\":\"Andrew Peterson\"},\"description\":\"Andrew Peterson is CEO and co-founder of Signal Sciences, a Web protection platform for the modern web. Previously, Andrew built multidisciplinary teams across five continents for such companies as Etsy, Google and the Clinton Foundation. He is also the author of Cracking Security Misconceptions (O\u2019Reilly). Follow him @AMPeters06 @signalsciences\",\"url\":\"https:\/\/sdtimes.com\/author\/andrew-peterson\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How your security budget helps hackers win - SD Times","description":"How has application security spending fallen so far out of line with the actual threats companies now face?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/","og_locale":"en_US","og_type":"article","og_title":"How your security budget helps hackers win - SD Times","og_description":"How has application security spending fallen so far out of line with the actual threats companies now face?","og_url":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/","og_site_name":"SD Times","article_publisher":"https:\/\/www.facebook.com\/SDTimesD2","article_published_time":"2017-10-26T14:00:56+00:00","article_modified_time":"2017-10-26T12:53:14+00:00","og_image":[{"width":640,"height":426,"url":"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg","type":"image\/jpeg"}],"author":"Andrew Peterson","twitter_card":"summary_large_image","twitter_creator":"@sdtimes","twitter_site":"@sdtimes","twitter_misc":{"Written by":"Andrew Peterson","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#article","isPartOf":{"@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/"},"author":{"name":"Andrew Peterson","@id":"https:\/\/sdtimes.com\/#\/schema\/person\/91cdf36a0449905b5a188decd90afb84"},"headline":"How your security budget helps hackers win","datePublished":"2017-10-26T14:00:56+00:00","dateModified":"2017-10-26T12:53:14+00:00","mainEntityOfPage":{"@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/"},"wordCount":803,"commentCount":0,"publisher":{"@id":"https:\/\/sdtimes.com\/#organization"},"image":{"@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#primaryimage"},"thumbnailUrl":"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg","keywords":["agile","cybersecurity","DevOps","hackers","software security","threat protection"],"articleSection":["Latest News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/","url":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/","name":"How your security budget helps hackers win - SD Times","isPartOf":{"@id":"https:\/\/sdtimes.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#primaryimage"},"image":{"@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#primaryimage"},"thumbnailUrl":"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg","datePublished":"2017-10-26T14:00:56+00:00","dateModified":"2017-10-26T12:53:14+00:00","description":"How has application security spending fallen so far out of line with the actual threats companies now face?","breadcrumb":{"@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#primaryimage","url":"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg","contentUrl":"https:\/\/sdtimes.com\/wp-content\/uploads\/2017\/10\/hacker-2883632_640.jpg","width":640,"height":426},{"@type":"BreadcrumbList","@id":"https:\/\/sdtimes.com\/agile\/security-budget-helps-hackers-win\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sdtimes.com\/"},{"@type":"ListItem","position":2,"name":"How your security budget helps hackers win"}]},{"@type":"WebSite","@id":"https:\/\/sdtimes.com\/#website","url":"https:\/\/sdtimes.com\/","name":"SD Times","description":"Software Development News","publisher":{"@id":"https:\/\/sdtimes.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sdtimes.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/sdtimes.com\/#organization","name":"SD Times","url":"https:\/\/sdtimes.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sdtimes.com\/#\/schema\/logo\/image\/","url":"https:\/\/sdtimes.com\/wp-content\/uploads\/2014\/05\/deafaultlogo.png","contentUrl":"https:\/\/sdtimes.com\/wp-content\/uploads\/2014\/05\/deafaultlogo.png","width":225,"height":90,"caption":"SD Times"},"image":{"@id":"https:\/\/sdtimes.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/SDTimesD2","https:\/\/x.com\/sdtimes","https:\/\/www.linkedin.com\/company\/sdtimes\/"]},{"@type":"Person","@id":"https:\/\/sdtimes.com\/#\/schema\/person\/91cdf36a0449905b5a188decd90afb84","name":"Andrew Peterson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sdtimes.com\/#\/schema\/person\/image\/7de62b199b7fabe199ca7a8427ac3403","url":"https:\/\/secure.gravatar.com\/avatar\/9952f10a93f474f30b3867cd0db22bd3?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9952f10a93f474f30b3867cd0db22bd3?s=96&d=mm&r=g","caption":"Andrew Peterson"},"description":"Andrew Peterson is CEO and co-founder of Signal Sciences, a Web protection platform for the modern web. Previously, Andrew built multidisciplinary teams across five continents for such companies as Etsy, Google and the Clinton Foundation. He is also the author of Cracking Security Misconceptions (O\u2019Reilly). Follow him @AMPeters06 @signalsciences","url":"https:\/\/sdtimes.com\/author\/andrew-peterson\/"}]}},"_links":{"self":[{"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/posts\/27666"}],"collection":[{"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/users\/766"}],"replies":[{"embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/comments?post=27666"}],"version-history":[{"count":1,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/posts\/27666\/revisions"}],"predecessor-version":[{"id":27669,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/posts\/27666\/revisions\/27669"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/media\/27668"}],"wp:attachment":[{"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/media?parent=27666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/categories?post=27666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/tags?post=27666"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/coauthors?post=27666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}