Mark Curphey wrote:
With respect, the cost to repairing a server from a virus attack is not an
affective metric that will get most senior managers attention. You should
always tie back information security to the business. Almost every company
in the world (with very few exceptions) are in the business of making money
and not in the business of running a secure environment. Put another way
they are in the business of running an environment that is secure enough to
do business. The financial cost due to lost productivity or due to loss of
critical business data will almost always far outweigh the cost of a
relatively low paid system admin repairing a host. Senior executives will
also relate to wasting time due to IT issues and annoyances of not being
able to get to their saved copy of that great Forbes article "Top Ten Global
Golf Courses to Do Business On".
IMHO ROI from security is widely touted by salesmen who think they can
somehow prove to someone that they can save money by lining their pockets in
exchange for a silver bullet. In reality unless they understand the detailed
financials of a company and how it makes money it is generally bs.
Quantitative risk assessment is usually based on assumptions that make it
meaningless.
The value of an info sec to most companies is that it lets them get on with
what they care about. Making money.
Or, from a finance perspective: creating value. Making more money
increases the value of a company, but so does reducing the cost of
capital. A stream of cash flow is worth more at a 5% cap rate than a
10% cap rate. I think many CEO/CFO/Board types would understand info
sec investments presented as risk management techniques that reduce the
cost of capital as part of an NPV equation. You could include
insurance as a line item too, to reinforce the idea.
ROI is helpful for the sales guy because it relates directly to the
investment in the product, but what the company needs is to increase
NPV. How the project's ROI ties into NPV is of interest to management, I
suspect.
Nick
--
Nick Owen
WiKID Systems, Inc.
404.962.8983
http://www.wikidsystems.com
Commercial/Open Source Two-Factor Authentication
https://www.linkedin.com/in/nickowen
