Planning for security in your systems architecture is both cost-effective and smart. Studies clearly indicate that the cost of incorporating security controls in initial systems design is far less than that of retrofitting a system with security countermeasures after the system has been compromised.
Security is a business decision.
The level and type of security a company decides to implement is a business not a technology decision, making business case analyses essential for a successful security program. A business must decide how much and what types of risks are acceptable, and what cost the business is willing to bear to secure itself. Security is an investment and good management practice . Prevention is always a good investment with information systems. Retrofitting into a production environment naturally costs more, while recovering from a disaster can destroy a business.