1. 1 © 2001, Cisco Systems, Inc. All rights reserved. Session Number Presentation_ID Security ROI and Conclusions Cisco commissioned custom research project July, 2002 Computer Economics, Inc.

2. 222 © 2001, Cisco Systems, Inc. All rights reserved. Presentation_ID CE’s methodology economic threats calculation Total economic impact projections are modeled on 5 years data and include costs of cleaning systems infected by malicious code, recovery costs from hack attacks/intrusions, lost revenue and lost productivity of employees Potential economic impact of threats is also determined by whether an organization is of low, medium or high e-business intensity

3. 333 © 2001, Cisco Systems, Inc. All rights reserved. Presentation_ID Annual Economic Impact of Malicious Attacks* Number of nodesLow e-biz $ impactMed e-biz $ impactHigh e-biz $ impact 2512,02531,08566,138 5025,20061,589131,040 10046,674109,684233,370 250108,375239,401509,363 500203,600430,614916,200 1,000402,225812,8971,729,568 2,000787,3501,554,2293,306,870 3,0001,244,9702,399,0575,104,377 5,0002,243,8754,113,0238,751,113 10,0004,065,4166,878,68414,635,498 20,0007,231,48811,555,91824,587,059 50,00016,789,50025,251,40853,726,400 *source Computer Economics

4. 444 © 2001, Cisco Systems, Inc. All rights reserved. Presentation_ID CE’s methodology Security costs & ROI CE has benchmarked the amount of IT budgets spent on security since 1990 Cost of security includes computer as well as network security products and the cost of personnel Typical deployments for computer systems include anti-virus and firewalls for desktops, file servers and application servers Network security deployments typically include firewalls, intrusion detection and packet filters ROI is difference between total economic impact and total security costs

5. 555 © 2001, Cisco Systems, Inc. All rights reserved. Presentation_ID Annual security cost & ROI** NodesLow e-biz Total sec $ $ ROI for sec Med e-biz Total sec $ $ ROI for sec High e-biz Total sec $ $ ROI for sec 25 8,550 3,475 4,418 26,667 9,400 56,738 50 16,900 8,300 8,836 52,753 18,800 112,240 100 33,450 13,224 17,555 92,129 37,350 196,020 250 84,100 24,275 43,898 195,503 93,400 415,963 500 168,200 35,400 92,299 338,315 196,200 719,820 1,000 336,400 65,825 210,661 602,236 448,215 1,281,353 2,000 671,800 115,550 372,076 1,182,153 791,650 2,515,220 3,000 1,010,000 234,970 561,791 1,837,266 1,195,300 3,909,077 5,000 1,684,900 558,975 941, 598 3,171,425 2,003,400 6,747,713 10,000 3,347,200 718,2161,881,175 4,997,509 4,002,500 10,632,998 20,000 5,722,000 1,509,4883,780,093 7,775,825 8,042,750 16,544,309 50,00013,334,000 3,455,5005,070,360 15,775,26820,162,000 33,564,400 ** source Computer Economics

6. 666 © 2001, Cisco Systems, Inc. All rights reserved. Presentation_ID Key steps for improving security It is key that upper level managers provide support for security improvement initiatives An individual or group should be designated to take the lead in the IS security process IS security policies should be established and documented An assessment of needs and weaknesses should be initiated Awareness should be increased via employee training Effectiveness of security measures should be monitored and evaluated continuously

7. 777 © 2001, Cisco Systems, Inc. All rights reserved. Presentation_ID CE’s observations on SAFE Security teams can benefit from the concepts* inherent in the SAFE Blueprint *defense in depth; best security practices; modular approach; scalability, etc. SAFE can serve as a guide to network designers considering security requirements of their networks

8. 888 © 2001, Cisco Systems, Inc. All rights reserved. Presentation_ID Computer Economics’ conclusions Improving IS security is critical to the operations, reputation and economic stability of any organization New laws require greater privacy protection New threats to computer and network security emerge everyday