1. Rachel Greenstadt October 17, 2016
Lecture 6: Spending
Rachel Greenstadt
October 17, 2016

2. Cyber losses

3. Reminders CITI Training due Thursday before class
Discussion on Thursday/Friday online
Mini-Guest Lecture today
Andrea Forte on qualitative research
Feb 13
Midterm

4. Spending on Security
2016 numbers from SANS survey

5. Why Spend on Security?

6. Why Spend on Security?
Avoid Loss
How much loss?
Will spending work?

7. Other reasons Reputation / Branding damage New business process
Share price effect
New business process
Compliance with standards
SOX, HIPAA in U.S.
PIPEDA (Canada), EU data protection
National security (defense contractors)
Nonprofits – ethical not just business case

8. Individuals
Theft prevention
Privacy concerns

9. Non-reasons Forensics and attribution Hard and expensive
Uh oh. Some state actor must have turned down the hot water pressure to my shower this morning. – Matt Blaze
Hard and expensive

10. Non-reasons: Worms Fast spreading Internet worms
How to 0wn the Internet in your spare time
Incentives – fast spreading worms not that useful
Though slow, subtle ones (Stuxnet)

11. More non-reasons History of non-spending Competitive advantage
New CISO
Fear / Guilt
Competitive advantage
Most businesses don’t develop in-house security, so other people can buy it too

13. How much security for software products?
Argument for very little
Customers think cost/speed/functionality more important
Just enough to overcome claims of insecurity

14. How much security for software products?
Argument for “top priority”
Avoid competitive disadvantage
“good enough” security
Enhance other IT functions (monitoring/awareness)

15. How much to spend? “To avoid security incidents”
negative goal, hard to measure
Measurable goals might be better, but difficult

16. Spending approaches Wait and see, then recover Buy one of everything
Externals measures
What do consultants recommend?
What is everyone else doing?

17. Price does matter (Let’s Encrypt)

19. Return on Investment (ROI)
Size of investment / gain
Gain = losses that didn’t happen
ROI security measure – reduce losses
Annual loss expected (ALE)
Prob (loss event) * Cost(loss event)
How to we get these numbers
(esp Prob (loss event)
Doesn’t account for possibility of failure or opportunity cost

20. Actuarial data

21. Cyberinsurance CLIC – Cyber liability insurance cover
Available since early 2000s
Now $2.5 billion, 80 carriers
% of companies with > 1,000 employees bought a policy-Insurance Business
Improvement in underwriting

22. Policies
First party – expenses occurred by company experiencing breach
Third party – effect of breaches on other companies that affect you

23. Why insurance Cover cost of breaches Contractual obligations
especially notifications
Contractual obligations

24. Effect of Cyberinsurance
Motivation for data on risks, measurable security

25. Fear as a motivator
> 500 road fatalities per year caused by avoidance of air travel due to security screening procedures
1018 estimated additional road fatalities during the three months post 9/11

26. Big event High profile breach, worm infection No $$ - lots of $$$
Might be spent irrationally
Boom/bust
“Fighting the last war”

27. Security Tools Total cost of ownership (TCO)
Hard for security because operational costs often exceed purchasing price
SANS : most spending for in-house labor
Survey respondent on the relationship between tools and skills: Do not overspend for tools that you do not have the personnel or expertise to use.

28. Vulnerability Scanning
The more the better?

29. Dlp – data loss prevention
IPS/UTM – Intrusion prevention system, unified threat management (fancy firewalls)
Byod – bring your own device
Mdm – mobile device management
Nac – network access control

30. Spending questions Already have capability?
Existing vendors will soon provide?

31. Security awareness training?
Breaking security rule makes life easier
Little company loyalty
“Users are not the enemy” – most people who violated security rules were trying to get work done

32. Security policies Not a firing offense
Most people don’t know company security policies
Even if they did – either too detailed and technical or too abstract

33. Invest in Cyber Security Boom?
HACK ETF – exchange-traded fund
Various “cyber” companies

34. Invest in Cyber Security Boom?
HACK ETF – exchange-traded fund
Various “cyber” companies