How To

counsel

By CSO Contributor

April 01, 2005 — CSO — Q: Can you use the same approach for calculating ROSI in corporate security as you do for information security?A: While there are subtle differences between the two, you still have the parallel of using the same metrics to calculate the savings from implementing a form of risk management. In a lot of cases, it is easier to quantify savings based on known variables of physical risk management. One example of this would be the effect of implementing surveillance on shoplifting. In a lot of instances, it is more tangible than in information security risk management.Q: How would you suggest a government agency calculate its return on investment?A: A government agency should think of itself as an individual business unit when doing this so as not to confuse calculations, metrics and baselines that may not apply to it. Start by reviewing any recent cost studies by budgeting and accounting entities for applicability to your specific case. Pick smaller instances where you want to calculate ROI to draw metrics that can be applied to calculate overall ROSI.Q: If you were the CSO of a major bank doing business online, how would you calculate the ROI of a software solution that monitors your website for application security vulnerabilities?A: I would list all the variables of risk and assign priority, weight and value to them. In this situation, you have two kinds of vulnerabilities: vendor-inherent and developer-induced. Many people faced with doing this often forget the training aspects of this situation. You can use your vulnerability assessment to direct training where the same mistakes are being made, such as how to do proper input validation. That alone saves development and QA time.Q: I've read several articles on ROSI, and they all sound great. But when you actually try to implement a quantitative risk analysis, it's easy to get lost in the details. Network security is an especially difficult item. There are a dozen really important mitigations one can implement to protect network availability. How do you calculate ROSI for network security items?A: Establish which mitigative measures are really necessary and which are "nice to have." A lot of the time spent implementing a preventive or mitigative control can have the reverse effect on network performance, which should be taken into consideration as part of the overall factoring. If you find yourself getting buried in details, take a wider view. You can always delve deeper