Your Cybersecurity Budget is a Horse’s Behind

Ira Winkler, Field CISO at CYE and former Chief Security Architect at Walmart, opens with the (largely true) story that railroad cars, and even the space shuttle booster, were sized around a horse-drawn cart's wheelbase, as an analogy for how cybersecurity budgets are set: each year's number is just last year's number plus or minus a bit, not a figure derived from what protecting the organization actually requires. He argues security teams should value what they protect, not the IT hardware they run on, the way operations, safety science and accounting already quantify their own risk in dollars, and that most companies are underinsured and cannot say what a prevented incident was worth. He lays out a risk formula (value times threat times vulnerability over countermeasure), the four standard risk responses (avoid, mitigate, accept, transfer), and the Gordon-Loeb rule of thumb that roughly a third of potential loss is a sane countermeasure spend. He closes with a method for prioritizing countermeasures by return on investment using attack-path choke points, and a CISO's actual walk-in-and-negotiate example: state the exposure created by any budget cut and make the executive sign off on it.