Firms wasting money on unnecessary security

Security professionals tend to focus on negative rather than positive outcomes

A former chief information officer at Google has used the opening keynote of the Black Hat USA 2009 conference to warn companies against useless security spending.

Douglas Merrill said that security budgets had been largely unaffected by the recession, and in some cases had increased by as much as five per cent.

Executives are signing off on unnecessary and, in some cases, harmful security spending because they do not understand the technology, according to Merrill.

"Everyone listens to security officers. Executives are, in fact, terrified of us. So they write us cheques," he said. "The thing is, they don't know why."

Part of the problem is down to a poor understanding of the return on investment for security spending, because security professionals tend to focus on negative rather than positive outcomes.

Some security professionals are actually harming their company by being overly restrictive, delegates were told. Merrill said that he had shifted his schedule onto Google Calendar in violation of his current employer's policy because it is much easier to access on the road.

Merrill added that companies benefit from having staff who are unencumbered by overly tight regulation, since they work in a more liberated environment. Google engineers, for example, are free to explore their own projects.