Risk
12/6/2013
08:06 AM
Pete Lindstrom
Pete Lindstrom
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

IT Security Risk Management: Is It Worth The Cost?

The attitude that IT security risk shouldn't be governed by traditional measures of cost and benefit is ludicrous.

At RSA a few years back, I was in a presentation by a CISO of a major company who asserted that he would spend "whatever it takes" to secure his company. This kind of rhetoric isn't uncommon, especially with those organizations that don't have any budget. What really surprised me though was that a senior IT security risk management professional of a large company would say such a thing.

I am pretty sure he didn't actually mean he would spend, say, $10 billion on security. But the attitude that tech risk management shouldn't be governed by traditional measures of cost and benefit is ludicrous, despite the fact that the "whatever it takes" approach plays well to security professionals. After all, we have dedicated our careers to protecting information and computer assets, and we see the potential for damaging people's lives when personal information gets leaked.

The problem is that in order for us to be taken seriously within our organizations, we need to eliminate the emotional element from our pronouncements and policies.  Instead, we should focus on providing appropriate security in appropriate places. (Even writing this makes me feel callous and cold, but that is the economic reality of business.)

Does that mean we should simply advocate for "appropriate" security measures and leave it at that? Hardly.  It's way too common for individuals to have varying opinions about what appropriate actually means. A better approach is to look to history and the laws that have set precedents for determining when organizations are "negligent."

For example, back in 1932 Judge Learned Hand decided in US v TJ Hooper that "...a whole calling may have unduly lagged in the adoption of new and available devices." He went on to say that "...there are precautions so imperative that even their universal disregard will not excuse their omission." This opinion may have opened up the floodgates on negligence because it implies an unattainable level of foresight with damages determined in hindsight.

Luckily, Judge Hand realized this weakness (albeit 15 years later) and followed up with a more realistic formula for determining negligence: "...if the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B less than PL." (US v. Carroll Towing, 1947). If that formula for negligence looks familiar, it should -- it is a manifestation of the formula we use to measure risk.

In short, Judge Hand ascribes a cost-benefit equation to determining negligence, effectively asserting that we should spend only as much as the consequences might cost, discounted by the likelihood of a negative event within the scope of circumstances.

So, instead of "whatever it takes," IT security risk management professionals should be spending "as much as necessary, not to exceed the value of the potential losses." Many tech risk pros intuitively understand this. But others are so caught up in the operational reality of putting out daily fires that they don't get the opportunity to put it into practice.

That’s a crucial mistake if you want to be taken seriously internally when it comes to managing IT security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Gary Scott
100%
0%
Gary Scott,
User Rank: Strategist
12/27/2013 | 2:45:02 PM
"Whatever it takes" is less than $5.00
I've seen companies with the "whatever it takes" mentality change their stance when it comes to data destruction.  We are a NAID certified company providing onsite hard drive destruction - we also carry professional liability insurance with breach notification coverage.    

We've seen some of these companies claiming "whatever it takes" balk at our $5.00 per hard drive destruction fee.  Instead of secure destruction, they risk losing confidential information by allowing an electronic recycler remove drives from their custody with the "promise" of complete erasure.    
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/9/2013 | 11:42:09 AM
Re: Negligence, not risk a better metric for IT security
I'd say bankruptcy following a hack is a pretty accurate way to quantify "L" and the DigiNotar incident in which the Dutch certificate authority (DigiNotar of Holland) was compromised and manipulated into issuing fraudulent certificates for Google and other large sites is a pretty stunning examploe of how to determine what an "appropriate"  IT security risk management should look like.
plindstrom193
50%
50%
plindstrom193,
User Rank: Apprentice
12/7/2013 | 9:33:48 PM
Re: Negligence, not risk a better metric for IT security
I'm not sure why you think Diginotar's situation is inconsistent with my comments. They are the perfect example of how 'reputation problems' can easily be shown to have economic losses.
dak3
50%
50%
dak3,
User Rank: Moderator
12/7/2013 | 1:09:15 PM
Re: Negligence, not risk a better metric for IT security
You might want to ask the folks at DigiNotar about that

 

:)

 
plindstrom193
50%
50%
plindstrom193,
User Rank: Apprentice
12/7/2013 | 11:46:56 AM
Re: Negligence, not risk a better metric for IT security
Hi, Dak3 -

That is a common lament. I suggest we keep in mind that these are economic entities we're talking about, not people. So any "reputational damage" *must* reflect in higher costs or lower revenue. While that is certainly possible, attempts by economists to glean economic damage have all fallen flat in the past.

The notion of being "beyond counting" is typically a reflection of disagreement in the "market" - you and I may not pay the same amount for, say, a signed baseball from World Series Champions Boston Red Sox, but it can be valued nevertheless. Same goes with companies buying companies or even more obvious intangibles.

Btw, we don't really need some absolute value of 'L' - all we need to know is how much has been spent (the 'B') so that we can make the higher or lower comparison to 'P * L.' 

Thanks for the comment,

Pete
dak3
50%
50%
dak3,
User Rank: Moderator
12/6/2013 | 5:38:48 PM
Re: Negligence, not risk a better metric for IT security
The problem, though, is figuring out the "L". Loss is both monetary and reputaional and the "cost" of making the organization whole may be neyond counting...
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/6/2013 | 2:27:21 PM
Negligence, not risk a better metric for IT security
Thank you Pete Lindstrom and Judge Learned Hand for that common sense measure & definition of IT security risk management. The history lesson was also very interesting.

 

 
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Get Serious about IoT Security
Derek Manky, Global Security Strategist, Fortinet,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.