A major challenge for any security team these days is to justify allocating IT budget to address a problem that rarely occurs. Generally, more tactical operational tasks take priority over security projects for this very reason.
As we all know, the board takes little notice of security until something goes wrong, when necessity forces it to the top of the agenda. Then, miraculously it becomes the absolute priority. The security manager is held responsible and the situation melts into a cycle of internal politics. To avoid such a scenario, forward thinking businesses should consider the wider risks and implications of a security incident.
This article intends to help IT security managers build a stronger case for investment in security.
Return on security investment (ROSI)
Determining the value of an investment in IT security infrastructure is not the same as determining traditional return on investment (ROI). When evaluating security products it is important to consider the value of the assets they will protect, as well as the type and frequency of threat they will be expected to combat.
Understanding your direct costs
Direct costs are those revenue streams that would be directly affected by some level of diminished or degraded service. In most commercial cases these are annual revenues derived from business units that are dependent on the IP infrastructure. Examples would include e-commerce, subscribers and advertising. Additional direct costs might be the at-risk investment in CRM, ERP, supply chain, e-mail, IRC and VoIP among others. The litmus test when considering direct costs should be:
* Do they provide revenue to the enterprise?
* Do they act as a channel to the enterprise which, if disrupted, would have material impact?
Such data may be taken directly from formal reports, internal memos or estimated as needed.
Understanding indirect costs
Indirect costs are more subjective than those defined as direct costs, and in some cases, are much more severe. For example, a major event against a high-profile target may have a profound effect on the market capitalisation (share price) of a publicly traded company, or it could cause brand damage through negative press announcements. More detrimental still might be the halo effect that an outage has on normal operating process within your enterprise.
When considering indirect costs it is important to reflect on the following:
* Has a past negative, or by contrast, positive experience been reflected in the market capitalisation of the enterprise? If so, what was the impact?
* Has brand damage led to customer attrition or additional cost? If so, how many customers has it affected and what was their value?
* If an application or IP dependent service was unavailable what would the impact be elsewhere within the organisation?
By their very nature, indirect costs are difficult to calculate, but should never be underestimated. Consultation with some of the individual stakeholders may help you to arrive at reasonable and broadly accepted estimates.
Understanding downtime
This is a relatively easy piece of data to collect, but an important one indeed. In many cases, enterprise IT personnel will have this data or a close approximation readily available.
Ask yourself one important question: If your IT staff were not running around solving a security issue, what other productive tasks would they be doing and what value can we put on those tasks?
Counter-measure cost
Again, this information should be readily available. In many cases the annual maintenance and support costs will need to be included, so that a fully weighted cost basis is created. Naturally, the following years will have profoundly lower costs and, therefore, much higher ROSI numbers.
Summary and conclusion
Calculating risk and return on investment when considering security products can be a very difficult task. Unlike other IT and business investments where ROI is determined as a direct result of some action, usually security risks and counter-measures must be considered with the intention of avoiding possible, negative outcomes.
Robin Hill is vice president, sales, at Webscreen Technology.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version