Despite lots of discussion around the IT industry to the contrary, organisations don’t necessarily have to spend a lot of money to deliver good security.