Studies clearly indicate that the cost of incorporating security controls in initial systems design is far less than that of retrofitting a system with security countermeasures after the system has been compromised. Security is a business decision. The level and type of security a company decides to implement is a business not a technology decision, making business case analyses essential for a successful security program. A business must decide how much and what types of risks are acceptable, and what cost the business is willing to bear to secure itself. Security is an investment and good management practice .
Prevention is always a good investment with information systems.
Retrofitting into a production environment naturally costs more, while recovering from a disaster can destroy a business. Many lower-cost, passive measures can be employed and products with weak security features can be avoided. Most importantly, security planning can leverage network configuration management and define the systems topology. Contingency planning ensures rapid recovery. No business can sustain extended periods out of operation.