Risk
12/6/2013
08:06 AM
Pete Lindstrom
Pete Lindstrom
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

IT Security Risk Management: Is It Worth The Cost?

The attitude that IT security risk shouldn't be governed by traditional measures of cost and benefit is ludicrous.

At RSA a few years back, I was in a presentation by a CISO of a major company who asserted that he would spend "whatever it takes" to secure his company. This kind of rhetoric isn't uncommon, especially with those organizations that don't have any budget. What really surprised me though was that a senior IT security risk management professional of a large company would say such a thing.

I am pretty sure he didn't actually mean he would spend, say, $10 billion on security. But the attitude that tech risk management shouldn't be governed by traditional measures of cost and benefit is ludicrous, despite the fact that the "whatever it takes" approach plays well to security professionals. After all, we have dedicated our careers to protecting information and computer assets, and we see the potential for damaging people's lives when personal information gets leaked.

The problem is that in order for us to be taken seriously within our organizations, we need to eliminate the emotional element from our pronouncements and policies.  Instead, we should focus on providing appropriate security in appropriate places. (Even writing this makes me feel callous and cold, but that is the economic reality of business.)

Does that mean we should simply advocate for "appropriate" security measures and leave it at that? Hardly.  It's way too common for individuals to have varying opinions about what appropriate actually means. A better approach is to look to history and the laws that have set precedents for determining when organizations are "negligent."

For example, back in 1932 Judge Learned Hand decided in US v TJ Hooper that "...a whole calling may have unduly lagged in the adoption of new and available devices." He went on to say that "...there are precautions so imperative that even their universal disregard will not excuse their omission." This opinion may have opened up the floodgates on negligence because it implies an unattainable level of foresight with damages determined in hindsight.

Luckily, Judge Hand realized this weakness (albeit 15 years later) and followed up with a more realistic formula for determining negligence: "...if the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B less than PL." (US v. Carroll Towing, 1947). If that formula for negligence looks familiar, it should -- it is a manifestation of the formula we use to measure risk.

In short, Judge Hand ascribes a cost-benefit equation to determining negligence, effectively asserting that we should spend only as much as the consequences might cost, discounted by the likelihood of a negative event within the scope of circumstances.

So, instead of "whatever it takes," IT security risk management professionals should be spending "as much as necessary, not to exceed the value of the potential losses." Many tech risk pros intuitively understand this. But others are so caught up in the operational reality of putting out daily fires that they don't get the opportunity to put it into practice.

That’s a crucial mistake if you want to be taken seriously internally when it comes to managing IT security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Gary Scott
100%
0%
Gary Scott,
User Rank: Apprentice
12/27/2013 | 2:45:02 PM
"Whatever it takes" is less than $5.00
I've seen companies with the "whatever it takes" mentality change their stance when it comes to data destruction.  We are a NAID certified company providing onsite hard drive destruction - we also carry professional liability insurance with breach notification coverage.    

We've seen some of these companies claiming "whatever it takes" balk at our $5.00 per hard drive destruction fee.  Instead of secure destruction, they risk losing confidential information by allowing an electronic recycler remove drives from their custody with the "promise" of complete erasure.    
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/9/2013 | 11:42:09 AM
Re: Negligence, not risk a better metric for IT security
I'd say bankruptcy following a hack is a pretty accurate way to quantify "L" and the DigiNotar incident in which the Dutch certificate authority (DigiNotar of Holland) was compromised and manipulated into issuing fraudulent certificates for Google and other large sites is a pretty stunning examploe of how to determine what an "appropriate"  IT security risk management should look like.
plindstrom193
50%
50%
plindstrom193,
User Rank: Apprentice
12/7/2013 | 9:33:48 PM
Re: Negligence, not risk a better metric for IT security
I'm not sure why you think Diginotar's situation is inconsistent with my comments. They are the perfect example of how 'reputation problems' can easily be shown to have economic losses.
dak3
50%
50%
dak3,
User Rank: Moderator
12/7/2013 | 1:09:15 PM
Re: Negligence, not risk a better metric for IT security
You might want to ask the folks at DigiNotar about that

 

:)

 
plindstrom193
50%
50%
plindstrom193,
User Rank: Apprentice
12/7/2013 | 11:46:56 AM
Re: Negligence, not risk a better metric for IT security
Hi, Dak3 -

That is a common lament. I suggest we keep in mind that these are economic entities we're talking about, not people. So any "reputational damage" *must* reflect in higher costs or lower revenue. While that is certainly possible, attempts by economists to glean economic damage have all fallen flat in the past.

The notion of being "beyond counting" is typically a reflection of disagreement in the "market" - you and I may not pay the same amount for, say, a signed baseball from World Series Champions Boston Red Sox, but it can be valued nevertheless. Same goes with companies buying companies or even more obvious intangibles.

Btw, we don't really need some absolute value of 'L' - all we need to know is how much has been spent (the 'B') so that we can make the higher or lower comparison to 'P * L.' 

Thanks for the comment,

Pete
dak3
50%
50%
dak3,
User Rank: Moderator
12/6/2013 | 5:38:48 PM
Re: Negligence, not risk a better metric for IT security
The problem, though, is figuring out the "L". Loss is both monetary and reputaional and the "cost" of making the organization whole may be neyond counting...
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/6/2013 | 2:27:21 PM
Negligence, not risk a better metric for IT security
Thank you Pete Lindstrom and Judge Learned Hand for that common sense measure & definition of IT security risk management. The history lesson was also very interesting.

 

 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.