If it includes trying to justify a bigger budget, then you are doing cybersecurity wrong.
https://twitter.com/Gillis57/status/1453064931394265092
2/ Ok, let's explain this.
The reason is this is the 99% of the conversations the CEO has. EVERYBODY is convinced they need a bigger budget. And they all have the same reasons.
The reason is this is the 99% of the conversations the CEO has. EVERYBODY is convinced they need a bigger budget. And they all have the same reasons.
https://twitter.com/Gillis57/status/1453139942754840577
3/ Put it another way, the CEO has already decided their reasons weren't good enough, so that when you make the same arguments, they'll decide your arguments aren't good enough.
4/ Among the many failed arguments is those claiming "we just need a little bit more". You haven't done a rational analysis of how much budget you need, you've done an irrational analysis of "whatever that is, we need more".
5/ Everyone thinks there's a slush fund sitting around, money that's not being used, and want that.
In fact, it's all being used. To give you more money means taking away money from another department -- a department using the same arguments as you for why they need more
In fact, it's all being used. To give you more money means taking away money from another department -- a department using the same arguments as you for why they need more
6/ This desire for infinite budget warps our thinking. Take "defense in depth". In military strategy, it means removing forces from the perimeter toward the center. In cybersecurity, it doesn't mean removing protections from the perimeter, but only adding more.
7/ What you haven't done is a rational analysis of how to spend the budget you are given. Is your department spending money the optimal way? You can't answer that and yet you want more.
8/ How do you know that this extra chunk of money can't be better spent on more marketing? Better HR benefits package? Upgrading the offices? etc. That's what the CEO has to decide and you provide ZERO information to help them.
9/ "But if we spend $10 now we can save $100 later". You lie. You don't know that. It's the same lie everybody tells the CEO. They are very good at spotting such lies. That money must come from some other department who made the same claim.
10/ The trick to getting a bigger budget is to spend that time with the CEO explaining how you want to address ransomware within the current budget, like not renewing AV licenses to use that money to move to a tiered domain model.
11/ It builds trust. It communicates you actually have a serious plan for addressing ransomware and that you aren't using it as an excuse to increase your budget.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
