Hi everybody welcome to the video around budgets.
So what is a budget.
A budget is a pool of money that is presented by staff and allocated by e f for a specific use in an
org so for a company.
There are a lot of sub boards in the organizations such as a security org H.R. engineering.
All of these are considered works inside of the larger organization or business and normally what happens
is E F allocates money or a budget to a particular org and then that is then split up based on each
sub team.
So in the securities case its application security red team blue team security engineering they all
grab from the pool of money for what's required ongoing business costs etc..
Why does a budget matter to me a budget matters for everybody in an organization.
It's not just the engineers it's not just a jar.
It's the seat seat goes from CEO all the way down budget affects everybody some of the examples are
you won't get any new headcount so no new staff you'll have software limitations as an example.
Using NASA's professional which will go over in later modules you can use it in an educational setting
as we're doing there.
But using that same license in a enterprise world is now illegal and you're breaking the licensing agreement.
And that's important to understand that licensing is not free and software is not free when you start
moving to an enterprise scale doing stuff at home or in a school environment educational environment
that's all fine for most software though generally give you a license to test things out trials etc.
run the business type stuff so promotions raises bonuses.
All that stuff is still part of the budget.
Normally it's a separate budget but in some cases for smaller companies it is part of the single budget
overall.
Now the budget that EDF provides to the org itself will include the promotions raises etc. for the org
itself.
So you might get 5 promotions available inside of the security org and then you have might have six
teams fighting for one of them.
Third party assessments.
These are not cheap.
These are the external perimeter testing as an example someone can be 50 60 80 thousand dollars.
They're not cheap.
They need to be budgeted in especially if they're required for a compliance standpoint or for an executive
requesting it a customer requesting it a government agency requesting it.
Perhaps it needs to be documented of the reason why so getting the budget which is always the hard part.
Figuring out what asks you want.
So stuff like the software that you need new headcount or new employees ongoing costs.
You need to find out what your current costs are to keep the business running as it currently sits for
your team such as recurring costs that you already have for licenses or headcount.
You need to identify the priorities of what what is lost if it's not funded the return on investment
the future state of the program or team.
If it's if something's not funded return on investment is a tricky piece because there's not a true
return on investment from a red team standpoint.
There is a number that you can give.
Based on what risks might be available at that point in time and a coordinate those two if something
were to happen it would have cost this much.
It's it's pretty difficult to get a return on investment.
I recommend looking a little bit further into or other sources around how to determine that.
I will go over this a little bit later in future videos.
However it's just something to note that it's not a very simple process.
Now presenting to EA staff making sure you show the amounts used per quarter.
So using all of your asks in the first quarter is a good way to get a lot of it declined.
Companies work on revenue and they don't.
Every company is different.
Not every company uses gets all of their revenue one quarter.
Another.
Now there are heavy quarters where for example Q4 there might be more revenue coming in in Q1 there
might be new revenue coming in that exceeds what they normally have throughout the year.
However you want to spread it out as much as possible but the more it spread out in the less you're
asking initially or in one in one large chunk of the better off you're going to be.
Make sure you ask for a reasonable amount to you do not.
If you're if your organization makes 10 million dollars a year you do not want to ask for three.
You need to be reasonable.
You need to be reasonable of other teams that have requests as well that keep the business working.
So the engineering the network teams they all keep the business running just as well as you do.
Some of them have more important asked than what you're asking for.
So everything's got to be balanced.
You should also note the impact if something is not funded.
So if fishing is supposed to be used in this quarter to help uplift issues that we're seeing with employees
and getting downloading malware or sending their credentials elsewhere from from a link if we're starting
to see that as a common thing maybe the impact for this is we're going.
We could eventually have an incident on our hands.
If the wrong employee with the correct credentials provides them to somebody else they weren't supposed
to.
So going going back to bat.
So this is kind of an interesting way to look at this because asking for a budget is not a one time
thing.
So you're gonna have to head back to E F around two three four five six possibly.
You'll have to go back to bat the manager in most cases will provide and the manager in most places
will go up to the plate for you in some cases does the team lead might have to go up there or the TPM
may have to go up there and fight for you guys.
But in a general sense the manager will fight for the for the budget.
Asks just know that E F by default is always going to provide you less than what you ask for.
It's always gonna be there it's your job to come back and fight for it.
So whether that is going to the manager and him saying or he or she saying hey we can't get this e Apple
fun this and then you need to project your reasons of why the risks the return on investment let's say
or any other statistics you can put together to have another chance at presenting this particular argument.
Now keep in mind going up to round two or three you have a chance of losing other things while you're
gaining others.
So you might have gotten fishing one round but lost the software.
But you need the software so you go back and round three and ask for the software.
But they reduce the fishing so you need to be careful on how you approach this.
And normally a manager will will have experience in this ahead of time to know how to approach things.
So building a budget this is something you guys are all going to do.
You're going to be building a budget from scratch.
There is a template and a sample above the video.
So go ahead and download the template and we'll work through this.
So you're gonna want to pick an area that you're located in.
The reason for this is you want to be able to when you look up a an average salary for a level one to
three offensive security engineer which will go over in the next slide you're going to want to be able
to get an accurate description of your area.
Now whether you don't happen to service your area but a area in general in this particular case I'm
using silicon valley because that's where I'm located.
Now you're going to assume that you currently have one manager two leads and then two mid level.
So a 5 five man team you're going to make sure you account for the recurring costs of headcount your
two licenses the NSA professional and your one license of quality was purposely leaving the prices of
these out and they won't be in the sample.
So your job is to go to the website and identify what the cost is for each of these licenses.
So that'll give you a good idea of interacting with a potential partner.
You're going to want to know how to engage with them how to contact them how to get a good quote.
So this is all an important piece of the project so continuing from that.
Your new net asks Are is one offensive security engineer entry level a a single offensive security engineer.
That's between a level 2 and a level 3 and then you're looking for 1 level 4 and then 1 new manager
for a.
This could be an assistant manager or a junior manager or senior manager regardless of that it's up
to you on how you want to do it.
Metis boy community edition so you want to you want to get three licences of that and one bat for fishing
you're gonna want to get three licenses.
So what we're gonna do now is we're going to go a quick overview on what a budget should look like.
So let's take a quick look.
So keep in mind I'm purposely leaving this pretty bare bones so you can kind of see a general idea.
So we have the name the quarter it's needed the amount the licence count whether it's ongoing and the
notes for each staff or the one presenting to each staff.
So in this particular case we have staff in Q1 there's an amount of five hundred thousand dollars so
that's for our initial base headcount we're just assuming one hundred grand per per person per person
per salary.
This is ongoing current staff self explanatory security engineer 1 We want them in Q2 they're at about
one hundred twelve thousand.
There's not a license is needed.
It's not an ongoing one yet and it's needed to run the new fishing program.
So we're showing that this particular employee this new net new headcount is going to be running the
fishing program and that's their task responsibility.
So not having this specific individual will hinder the performance of having a fishing program less
a professional.
This number keep is relatively close per licence we're going to ask that for in Q1 we have two licenses
and it is ongoing it's for our current vulnerability management program.
So it's showing that without we have a current program needed it's an ongoing costs.
And if you want to keep the program running we need funding for wombat.
So this is new software.
We'll need it in Q3.
It's about eleven thousand dollars give or take.
Again these are not necessarily accurate.
So go ahead and grab them yourself.
Three licenses it is not ongoing and it's needed for the fishing program.
Current fishing uplift will fail if this is not funded.
So they're wanting we're wanting to build a fishing program in this particular case and it will fail
if this is not funded.
So this guy right here the new head count and one that are both required to make the program work.
So what I was saying before is you don't want to have this guy get approved and then this one fail.
Otherwise you're going to have to go about things a different way or even worse is that this gets approved.
And this one fails then you have nobody running it.
So it's a good it's good to keep this in mind.
This is a very simplified budget.
There can be a larger amount of columns here depending on the organization what they require.
Normally most or IGs will have or companies will have a template in place for how they present the budget
in this particular case.
I'm showing you a general outline of what a budget would look like what you kind of expect to see on
it.
So what I want you guys to do is again the requirements are in the slides.
It's also below the video grab the template start filling it out and fill out based on the requirements
that I put in the slides.