It is getting to be budget time for many companies out there, and what better time to look at what we need to do our jobs. We all have our wish list, our dream list and eventually whittle that down to a practical list. Between all of that, there are the renewals to budget for plus figuring out any other spending to do. It is also a time to really take a look at our security maturity level and use that to actually work on the budget, or at least make recommendations to our bosses.

I honestly believe most blue teamers have one of two outlooks on their security maturity. First is the doom and gloom, always figuring they are not mature, always lamenting that they never will be mature. Now, this is not a completely bad outlook to take. Figuring you are less mature than your company is, allows you to focus on what you have and using it to the maximum potential. Unfortunately most of the gloom comes from the fact that you are understaffed and overstretched. Meanwhile the higher ups have bought into the latest marketing of the newest products. Oh boy, here comes more stretching on Stretch Armstrong. The thing is, even Stretch Armstrong will eventually either break or snap back, neither of which is good. Burnout is burnout no matter how you look at it, and a human can only do so much at once. If this is your situation, you need a champion in your corner, be that data or some other higher up who understands that by stretching so much, all that is happening is more hole are being put into place. What is the point of being cutting edge if you don’t know how to use it, or ignore most of it anyway? Really that doom and gloom all stem from the second outlook, which tends to permeate the higher ups more often than the rank and file.

We are more mature than we really are. We all see that, people thinking they are ready for the next step in security. We have all the latest and greatest so we have to be mature. What does it matter that our people have not had time off. We can just get another piece of automation software to replace them, or we can outsource. This comes with the other huge security hole to it. Even security software and products need updating and upgrading. who is going ot take that time? Who is going to have the time to train the software properly, and keep it tuned?

The reality of it all is once you have figured what you have to spend on current technology that you have in the company (licensing, upgrades etc…) and new personnel, the first thing that should be budgeted for is training. In fact, training should be all paid for in the first quarter, while the full budget is there, because as the year goes on that money will be the first thing chopped. You can go to the training in the third or fourth quarter, but pay for it as soon as the new budget takes effect, or as close to that as possible. That training should include training on the technology you have and/or the methods of doing what the technology you have does. From there should be training on something each person is interested in overall. That allows for growth of the staff in the areas they enjoy. Finally should be at least one security conference such as a BSides, Derbycon, Circle City Con or other lower cost options. This allows for networking and exchanging of ideas. Some of the best ideas I have had come from talking to people in the community, and some solutions to problems (scripts, stuck on how to do something with product X, etc…) have been found this way. Google is fine, but being able to know someone who has worked with X is better.

Once training is done, then you can look at what is available to potentially get. This should not be done without taking a look at what you already have and if you are using that to its maximum benefit. Taking that hard look must include results of any pen test/red team events that you have had done during the year. What were they able to do, and could that have been stopped or alerted on by the current technology you have. If it could have been taken care of without new technology, then why wasn’t it, and how can you get that tech to that point? Why waste money on a new technology that will do the same as some of what you already have? This also goes into the security idea of complexity breeds more holes. It doesn’t matter that it is security technology, the more complex something is, the more likely some hole is going to be missed.

Good luck to everyone on their new budgets. May you all get what you want and have to want for what is actually needed.