Presentation on theme: "Lesson 15 Total Cost of Ownership. What Drives TCO? Networks Grow in Size and Complexity Scope of Operations Increases Skilled IT labor grows scarce New."— Presentation transcript:
Lesson 15 Total Cost of Ownership
What Drives TCO? Networks Grow in Size and Complexity Scope of Operations Increases Skilled IT labor grows scarce New applications require new solutions
What Drives TCO in Security? Vendors produce in-secure applications Vulnerabilities proliferate Business processes depend on applications System availability drives profit
Components to Consider Initial Cost of Product (25% of life cycle) Vendor Support Services Deployment Services Time for Staff to Install and Configure Training Cost Post Deployment Support
How to Reduce TCO? Simplify Infrastructure (KISS) Upgrade Infrastructure When Timing is Right Minimize Labor Intensive Activities Consider Remote Management Know Your Assessment Parameters
Security Risk LOW HIGH LOW HIGH Budget Line Acceptable Risk Option 1 Option 2 Option 3 TCOTCO Ideal Soln
Evaluating the Options Option 1 –FIREWALL At Gateway Only Option 2 –DMZ Firewall Architecture –Anti Virus Software on all DMZ machines Option 3 –DMZ, AV S/W on DMZ Machines –VPN Access to all DMZ Machines –AV S/W and Firewalls on all Clients
Evaluating Architectures Option 1 - Screening Router Option 2 - Dual Homed Host Option 3 - Bastion Host Option 4 – Screened subnet (DMZ) Which one cost more relative to risk?
Option 1: Screening Router Internet Screening Router
Assumptions Cost of Router: $3000 Cost of Firewall: $5000 Cost of Security Administrator--$75K/year Managed Security Service Provider(MSSP)-- $24K/year
Things to Consider Which Option Would You Choose? Is cost the only driver? Could You Determine TCO for the different architectures? Given a Set of Devices Could You Compute TCO?
Difficulties with ROI Investment decisions based on ability to demonstrate positive ROI ROI traditionally difficult to quantify for network security devices Difficult to calculate risk accurately due to subjectivity involved with quantification Business-relevant statistics regarding security incidents not always available for consideration in analyzing risk
New Paradigm Needed? TJ Maxx Credit Card Theft: $450M –Wonder if they had an ROI? Why not a TCS: Total Cost of Security? –What would one short-term outage cost? –What would one long-term outage cost? –Could we survive losing customer data? –What is it worth not to experience any of this? –Could we make money off our security expenses via marketing, branding
Summary What Drives TCO? Reducing TCO Option Analysis Assumptions and Considerations Difficulties with ROI