Found a pretty good blog post from the CTO of Big Fix that talks about why he believes securing an IT infrastructure is expensive for a variety of reasons:

http://techbuddha.wordpress.com/2008/01/23/the-high-cost-of-securing-it/ 

He also talks about strategies for approaching a CFO to justify spending of security dollars, which is interesting.