Managing information security on a shoestring budget