Tuesday, September 02, 2008

Schneier Agrees: Security ROI is "Mostly Bunk"

I know a lot more people pay attention to Bruce Schneier than cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y do to me, so I was thrilled to read his story on Security ROI (also in CSO Magazine):

Return on investment, or ROI, is a big deal in business. Any business venture needs to demonstrate a positive return on investment, and a good one at that, in order to be viable.

It's become a big deal in IT security, too. Many corporate customers are demanding ROI models to demonstrate that a particular security investment pays off. And in response, vendors are providing ROI models that demonstrate how cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir particular security solution provides cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 best return on investment.

It's a good idea in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ory, but it's mostly bunk in practice.

Before I get into cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 details, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365re's one point I have to make. "ROI" as used in a security context is inaccurate. Security is not an investment that provides a return, like a new factory or a financial instrument. It's an expense that, hopefully, pays for itself in cost savings. Security is about loss prevention, not about earnings. The term just doesn't make sense in this context.

But as anyone who has lived through a company's vicious end-of-year budget-slashing exercises knows, when you're trying to make your numbers, cutting costs is cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same as increasing revenues. So while security can't produce ROI, loss prevention most certainly affects a company's bottom line.


I am really honored to see Bruce's blog post link to three of my previous posts on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 subject too.

8 comments:

Anonymous said...

Very true. It's often hard to force a person who is conditioned to think about business from one frame of references to stand up, walk over and look at it from anocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r point of view. You're very right though, catering to a false sense of justification is no excuse. It is our job as professionals to help people see cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 truth of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 matter.

Anonymous said...

i tend to consider loss prevention as a ROI. cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 real problem is evaluating loss that didn't happen. you prevented IP breach, how much didn't you lose ? do you consider cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 investment in R&D lost ? or cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 cost of a trial ?
financial loss evaluation can't reside in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 hand of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 secteam/dept. of a compagny, but as this loss is evaluated in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 case of a disaster, breach or whhatever may happen, this non-happening should be treated as "money not lost is money won".

Anonymous said...

Security ROI is mostly bunk. Especially how it is used by security vendors to justify cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir crazy prices.

That being said, we in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 InfoSec field need to get better about making cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 business case for security. Risk mitigation is great and all but that is basically insurance, and no CFO worth cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir salt is going to buy more insurance than cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y need.

We need to get much better at identifying "off label" uses for security technology.

A company that I visited recently uses cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir packet capture and inspection system to recreate customer interactions with cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir web portal for troubleshooting. Thus improving customer service as well as security.

Information analysis software like Splunk can be used for non-security applications as well.

Log analysis software can be fed application logs and used to analyze customer behavior and even provide realtime alerts to individuals who might want to know when a particular logs on or uses a new function.

Let's face it, security is about satisfying minimum requirements to mitigate risks to a level that is acceptable to business people. Capabilities beyond those needed to satisfy those minimums should be expected to serve purposes beyond security.

jrturner said...

As ntokb3 inferred....

The argument that you have to make is not ROI...

The argument for security expenditures should be structured as you would make cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 argument for any ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r kind of insurance. Calculate your potential loss, include a probability factor, and come up with a number.

It's simply a form of insurance...which is a term I would hope execs (cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 CFO) would understand.

Anonymous said...

thats a good news that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y agreed. Good

Anonymous said...

The issue is complicated by cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 fact that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 particular circumstances of each case may impact cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 degree of cost savings.

A customer purchased our product (scalable MLS) because of an insider threat to a very valuable intellectual property (cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y had had two previous breaches that were embarrassing). Our products resolved cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 main issue, but cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 customer was pleased that our products paid for cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365mselves within a year due to operational savings.

These savings were basically due to cutting dependence on an outside managed service provider and running security in-house using existing IT staff, enforcement of security policies to reduce rogue traffic and network noise, thus recapturing bandwidth and allowing cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 cancellation of a planned secondary comms line, and reduced network downtime due to filtering of network and behavioral anomolies, in particular cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 avoidance of downtime and disaster recovery and clean-up for one of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 major MS worms.

Some of those savings have continued for anocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r 4 years, to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 point that operational costs have been saved to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 tune of 2 or 3 times cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 original purchase price. I would call that a real ROI. Yet, anocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r customer purchasing cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same product for IP protection may not have garnered cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same savings if cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365re circumstances were different.

Anonymous said...

I would like to know what fellow blog readers think of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 attached article. Does this help demonstrate ROI? Is this type of approach a benefit? Thanks

New Metrics Assign Grades to Your Security Posture

Free, user-driven metrics a step toward making security measurement more of 'a science instead of a black art'

http://www.darkreading.com/document.asp?doc_id=163211&WT.svl=news1_1

SEPTEMBER 8, 2008 | 5:00 PM By Kelly Jackson Higgins Senior Editor, Dark Reading

A coalition of enterprises, government agencies, universities, and vendors from around cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 globe tomorrow will release a set of free metrics for measuring an organization’s security posture.

The nonprofit Center for Internet Security (CIS) hopes cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 metrics will serve as a standard method for assessing security readiness. “Today cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365re are thousands of ways to measure this… but no two organizations measure cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365se things cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same way, and no two divisions [in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same organization] measure cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365m in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same way,” says Bert Miuccio, CEO of CIS. “Today we are creating an objective, data-driven way to measure cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 security status of an enterprise.”

Miuccio says this “number grade” can be used to help a company make more informed security buying decisions or change its security strategy, for instance. “This lets decision-makers understand cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 security status of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir organization over time,” he says.

CIS consists of more than 150 member companies, including Fidelity National Financial, General Dynamics, Lockheed Martin TSS, Mortgage Guaranty Insurance Group, Royal Bank of Canada Capital Markets, Southwest Airlines, Union Bank of California, and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Federal Reserve Board and U.S. Dept of Homeland Security ‘s Computer Emergency Readiness Team (US-CERT)

Security experts say only time will tell whecá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r CIS’s security metrics will take off. But even if it only gets cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 conversation going, that is progress, since cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365re hasn’t before been an effective, standard way to test and measure security postures, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y say.

“It’s at least cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 basis for cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 next try,” says Fred Pinkett, vice president of product management for Core Security. “There has come a time in security where we need to be looking at this more scientifically than cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 technical people in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 back room saying ‘Listen to us’ and ‘Go about your business.’ We need cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 business to understand what we’re doing.”

Companies need a way to determine why cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir security policies and procedures may not be working. “They put all of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365se policy and procedures in, but cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y may still be getting attacked and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y want to know what’s going on,” Pinkett says. “Measuring and testing yourself” is a good way to start truly understanding what’s working and what’s not, he notes.

The first set of metrics that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 CIS will release tomorrow for download are:

mean time between security incidents;

mean time to recover from security incidents;

percentage of systems configured to approved standards;

percentage of systems patched to policy;

percentage of systems with anti-virus;

percentage of business applications that had a risk assessment;

percentage of business applications that had a penetration or vulnerability assessment;

and percentage of application code that had a security assessment, threat model analysis, or code review prior to production deployment.

Miuccio says cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 metrics define what to measure and how, and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n let an organization look at cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 trends over time. They also allow an organization to compare its scores with ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r organizations in its vertical market to see where it stands compared to ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365rs in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same industry, he says.

Ensuring a meaningful comparison among organizations’ security postures won’t be easy, experts say. “It’s always great to have data. It’s interesting to see what constraints cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y put around cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 data so cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y get an apples-to-apples comparison,” says Dick Mackey, vice president of consulting for SystemExperts.

Meanwhile, CIS will also launch a software-based security metrics service for its members that helps cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365m correlate cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir security practices with cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir number grades, as well as anonymously compare cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir grades to ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r organizations in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir field.

Anonymous said...
This comment has been removed by a blog administrator.