Parry also tries to examine roles and responsibilities and parlay times of reduced staffing into opportunities for cross-functional training for existing employees.

"This spreads the work load, and while it doesn't necessarily reduce the workload for anyone, it provides interesting variations in their daily duties," he says. "It also ensures that there's a built-in contingency and succession plan so that the departure of any one individual does not create a single point of failure."

Keep it simple
For organizations that must make do with a smaller security staff, cutting down on IT complexities and embracing security compliance controls will lesson the chances of a mistake-fueled catastrophe, says Atlanta-based strategic architect James DeLuccia.

DeLuccia offers audit and consulting services for companies trying to comply with such security laws and standards as the Payment Card Industry's Data Security Standard (PCI DSS). One of the common requirements of regulatory compliance is to reduce complexities and redundancies in the network so data can be better tracked and protected. A side benefit is that fewer complexities means few opportunities for a security failure, especially in an organization where staffing and tech savvy is in short supply.

"Security and technology service the entire business and must reflect the entire business challenge—regulatory and best practices," he says. "Failure in either case will lose customers, have regulatory enforcement agencies ban the company from operating in a market, cause fines for lack of best practice, and such."

When staffing is tight, the last thing a company wants is a badly-configured patchwork of legacy systems full of redundant databases and processes, the likes of which he has seen in companies that have been through mergers and acquisitions, he says.

And so his advice is to "remove the froth off network architectures that result from mergers and acquisitions and eliminate the redundancy in situations that occur where people say 'that is how we always have done it.'"