Models for Estimating Risk and Optimizing the Return on Security Investment

Introduction Objectives Using risk assessment methods to estimate security investments Categorizing risks in the Risk Assessment Cube Calculating an expected value of loss Optimizing the return on investment for security Creating a complete organizational risk profile

What Problem???  Information security is a business problem that can be assessed with the same analytic methods that are used for other business- related risks and consequences  Risk Analysis – the full identity and assessment of risk factors, as well as the balance of expected costs of incidents with the cost of defense needed to avoid incidents.

Quantitative Models for Business Decision Expected Value Model– it gauges uncertainty about the financial impact of an outcome Marginal Analysis Model – gives an estimation on investment in security defenses Basis for estimating the cost of a loss and appraising an organization’s risk exposure.

Importance of Risk Assessment  In 2001, there was an estimated 4,000 U.S. business websites were victims of the DOS attacks each week  Recent targeted attacks appear on the U.S. cyber crime website at  These figures mention helps give an estimate of both the cost and frequency of the various attacks

Risk Assessment (2)  There is a vast difference in organizations’ security needs because in the size, attractiveness to the attackers, and dependence on the networks  ISO – international standard for best practices in information security. Risk analysis is a basic requirement and is the establishment of security policy

Information Security Budgets  With budgeting, raising the priority of security investments is best done by calculating credible estimates of the expected loss from intrusions, negligence, or subsequent litigation by using risk management methods.  Risk Management techniques and IT techniques are common and enables the decision makers of those businesses to tackle information security policies with little IT knowledge.

Expected Cost of Loss  Computer security is essentially about risk management. Before decisions on security spending, you must make a tough risk assessment.  Expected Value – is a basic concept to make decisions when there is uncertainty about the financial impact of an outcome  Expected Loss – is the type of expected value method that is relevant to security

Expected Cost of Loss(2)  Expected Loss Model (ELM) provides an important benchmark against which to assess and justify investments in digital security.  Marginal cost-benefit analysis – estimates the investment in security defenses that optimizes return on investment (ROI).  Marginal analysis is to minimize over-investment or under-investment.

Risk Assessment Cube  It is a structure categorizing risks. They are divided into three dimensions: –The Probability of an Incident –The Severity of the Outcome or Loss –The Duration of the Impact  Figure 5.2 of pg 67

Expected Loss Value Estimations  ELV estimations is used to extensively to evaluate the consequences of business decisions during a particular time segment.  Here is the formula for expected loss computation: Expected Loss = (Amount of Loss) * (Probability of Loss)  The benefit of ELM is the ability to standardize the cost of incidents for comparison purposes. Provides hard data to substantiate the priority of security investment

Challenges in Estimating Loss of Digital Assets  Digital Assets are intangible – their value may only become fully understood in the actual event of loss.  All types of businesses tend to underestimate the expected value of their digital assets drastically.  They fail to take in account the variety of ways these assets can come under attack, therefore increasing probability of a loss. This also leads to poor investment decisions.

Digital Assets(2)  Physical assets tend to exist in only one place and therefore must only be protected in one instance. To protect digital assets is to retain multiple backup copies.  It protects against accidental destruction.  It also gives increased opportunities for theft.  Cache – temporary file copies to enhance system performance. Each copy is vulnerable.

Knowledge Assets  While some digital assets have a direct monetary value, others have indirect value derived from their associated knowledge.  Most knowledge assets are contained in employees themselves.  Knowledge management is the system that is used to capture and store this commonly unstructured information.

Knowledge Management (KM)  KM assets range from production techniques to personal contact information.  With these sort of assets, it is almost impossible to replace the knowledge once it is lost.  This causes the valuation of knowledge assets to usually be more complicated.

Mission-Critical Software  Mission-critical software is software that has been customized or designed by the company and usually provides a competitive advantage to the company.  This software is vulnerable in multiple ways.

Valuation of Digital Assets and Risk  There are two main ways to assign values to non-tangible assets.  One is to examine their impact, the other is to focus on loss prevention.  3 main categories: Software Assets, Knowledge Assets, and Goodwill

Valuation of Software Assets  The risk, in this case, is not the loss of the software. The risk is due to the loss of the use of the software during the period of time it takes to restore the software from a backup.  The average loss, is calculated by multiplying the average revenue by the total downtime.  Productivity software is calculated by the percentage of productivity improvement.

Valuation of Knowledge Assets  The unique knowledge within an organization is what causes risk.  The danger lies with what the attackers do with the stolen information.  Some unique information may be grounds for legal actions if stolen. ( example)

Valuation of Goodwill  With companies who are extremely active on the internet and other networks, the company’s reliance on technology causes their goodwill to be vulnerable.  The credit card information company in Atlanta is a perfect example of this.  Attacks on a company’s goodwill can cause more long term damage than theft of a specific production procedure. (customers)

Risk Information Sources  CERT Coordination Center is a federally funded organization that is part of Carnegie Mellon University. CERT Coordination Center  InfraGard is an alliance of both the public and private sector that is designed to defend against cyber terrorism. InfraGard

Risk Evaluation Profile  After Risk estimations have been done, a risk evaluation profile (REP) can be created. Asset ClassRisk of LossRisk of Lost Revenue Current Exposure Investment Priority Customer Data High ModerateHigh R&D Docs.ModerateHighModerateHigh Transaction History ModerateLowModerateLow Employee Data Low

Odds and Ends.  Over 90% of cyber attacks could have easily been prevented by the tech. at the time.  Businesses who have secure network connections between themselves and other businesses occasionally run independent audits of their business partners.  The reason the DLM works so well is because it does not only focus on technology. It mainly focuses on the non- digital aspects.

the end