Managing information security on a shoestring budget

As organizations continue to deploy mission-critical, network-centric information systems, managing the security of such systems has become very critical. Building and managing such security infrastructure can be potentially very expensive, especially for small and medium-sized organizations. The Indian Institute of Management, Lucknow (IIML), the premier teaching and research business school in India, embarked on implementing a robust security management infrastructure with a limited budget on hand. The case examines, how IIML successfully implemented the security infrastructure by appropriately developing security policies and selecting a proper combination of freeware and proprietary software components. Since security management is not a one-time activity and uses intensive technology, a careful analysis is required to assess whether the maintenance of the security infrastructure can be done in-house or outsourced. The case illustrates the trade-offs involved and presents experiences of IIML in outsourcing the post-implementation phase to a Security Service Provider. The case also highlights the challenges organizations face while implementing freeware security products and outsourcing security services.