RCL & Associates The Economic Return of Security Bob Lonadier, CISSP RCL & Associates

RCL & Associates 2 Agenda The sad state of security spending The underlying problem Why the current economic models are inadequate What to do about it Q&A

RCL & Associates 3 The Sad State of Security Spending Companies spend a lot on security, but they aren’t more secure. –Spending increases (both absolute and relative to IT spending) don’t result in more security –Most incremental spending goes toward dealing with the complexity created by the previous security investment Insecurity abounds

RCL & Associates 4 The Security Return Problem 1/ Security Relative Insecurity Relative Security Absolute Security (not possible) Cost Increased Connectivity Open Systems Hackers Insiders Advances in Security Technology Policy Creation and Enforcement Training and Education

RCL & Associates 5 The Underlying Problem Why justifying security is difficult The management view The view from the trenches

RCL & Associates 6 Attempts at Justifying Security Investment The ROI model The risk management model Other models

RCL & Associates 7 ROI: Necessary but Insufficient? According to Hurwitz Group’s e-Mentor PRO Study 2000: 77% of enterprises use ROI to evaluate e-Business solution purchases The largest companies use ROI the most – 94% of companies with annual revenues of $10 billion or more According to a 1999 survey by Cambridge Information Network of over 1,400 CIOs and senior IT executives: “ROI analysis is typically a political prerequisite to get an IT investment approved.” However, this same study found that while 91% of respondents consider cost savings as key results from ROI, 65% consider revenue creation an important factor.

RCL & Associates 8 The Shortcomings of ROI The self-serving aspects The measurement problem The challenge in reducing cost without increasing risk

RCL & Associates 9 The Risk Management Model Average loss expectancy (ALE) = impact of event  frequency of occurrence Invest in security where incremental cost  incremental reduction in ALE Outsource (insure) where incremental cost  incremental reduction in ALE

RCL & Associates 10 The Four Risk Actions Accept it Ignore it (accept it) Assign it to someone else (insure against or outsource it) Mitigate it (reduce it)

RCL & Associates 11 The Challenges of the Risk Management Model Qualifying risk –Information security risk vs. Business risk Quantifying risk –Measuring risk well (and over time) Reducing risk –Risk management in an era of uncertainty Diversifying risk –The insurance model: why it falls short

RCL & Associates 12 An Uptime Approach to Security 1/ Security Relative Insecurity Relative Security Absolute Security (not possible) Availability Security returns increased availability Security returns decreased availability Security returns optimal availability

RCL & Associates 13 Why The Current Approaches are Inadequate They cannot answer: how much security spending do I need? They cannot effectively manage or diversify risk efficiently –Security outsourcing vs. hacker insurance They cannot answer: When am I secure (enough)?

RCL & Associates 14 The Security Treadmill

RCL & Associates 15 A New Approach Towards the Economic Return on Security Security as a process, not an outcome –Business processes vs. IT processes –Re-developing security awareness Security as a teaching tool –Security and the learning organization –Security awareness as a barometer for corporate health

RCL & Associates 16 Is Security Free? Security can be a by-product of business process improvement (BPI) But, nobody really knows how to make the connection So, it’s really difficult to think about it those terms (given the status quo)

RCL & Associates 17 Next Steps Break the (in)security-return cycle –Don’t look for return where there is none Restore security as a process –Map it to the business needs of the firms –Evaluate from the perspective of total quality management (TQM)

RCL & Associates 18 How? Vendor Track –Reject conventional security ROI –Demonstrate value add to the process Management Track –Educate, educate, educate –Use security awareness (or lack thereof) as a proxy for corporate dysfunction

RCL & Associates 19 Questions?