Few expect to be hit with outright budget reductions, at least in the short term; regulatory requirements and the ever-expanding list of external and internal threats make it hard to devote less money to security efforts. But there is a growing push to curb or defer spending increases, according to IT managers and security analysts.

"It's imperative to squeeze every penny of value out of everything you do," said Jim Kirby, senior network engineer at DataWare Services, an IT services firm in Sioux Falls, S.D. This is a good time to stop working on "marginal" projects and redirect resources to security capabilities that are absolutely necessary, Kirby said.

Matt Kesner, chief technology officer at Fenwick & West LLP in San Francisco, said the law firm's security strategy for next year is to "focus on basics." Its 2009 IT budget doesn't call for reduced spending on security—but neither does it include a funding increase.

And Fenwick & West is taking some steps to cut costs. The firm is deferring an earlier plan to hire a full-time networking and security expert because of the recession, Kesner said. It is also looking for opportunities to use open-source alternatives to some of its security tools.

One of the few new IT projects approved for next year is a replacement of the antivirus software installed on all of the law firm's PCs—an upgrade that Kesner said is being driven by the increased threats to corporate data from malware and phishing attacks. Fenwick & West also plans to train end users more intensively on how to secure their PCs and mobile devices, and on the importance of creating strong passwords.

Even in an economy gone sour, a growing number of government and industry regulations impose security compliance costs that there is simply no getting away from. For instance, new data-protection laws in states such as Massachusetts, Connecticut and Nevada require companies to use data encryption tools and implement other security controls to safeguard the personal information of state residents.

Similarly, the Payment Card Industry Data Security Standard, created by the major credit card companies, requires all businesses that accept credit and debit transactions to adopt a broad set of data protection controls. And the federal HIPAA law includes data security and privacy rules for health care providers in order to protect patient information.