Risk
12/6/2013
08:06 AM
Pete Lindstrom
Pete Lindstrom
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

IT Security Risk Management: Is It Worth The Cost?

The attitude that IT security risk shouldn't be governed by traditional measures of cost and benefit is ludicrous.

At RSA a few years back, I was in a presentation by a CISO of a major company who asserted that he would spend "whatever it takes" to secure his company. This kind of rhetoric isn't uncommon, especially with those organizations that don't have any budget. What really surprised me though was that a senior IT security risk management professional of a large company would say such a thing.

I am pretty sure he didn't actually mean he would spend, say, $10 billion on security. But the attitude that tech risk management shouldn't be governed by traditional measures of cost and benefit is ludicrous, despite the fact that the "whatever it takes" approach plays well to security professionals. After all, we have dedicated our careers to protecting information and computer assets, and we see the potential for damaging people's lives when personal information gets leaked.

The problem is that in order for us to be taken seriously within our organizations, we need to eliminate the emotional element from our pronouncements and policies.  Instead, we should focus on providing appropriate security in appropriate places. (Even writing this makes me feel callous and cold, but that is the economic reality of business.)

Does that mean we should simply advocate for "appropriate" security measures and leave it at that? Hardly.  It's way too common for individuals to have varying opinions about what appropriate actually means. A better approach is to look to history and the laws that have set precedents for determining when organizations are "negligent."

For example, back in 1932 Judge Learned Hand decided in US v TJ Hooper that "...a whole calling may have unduly lagged in the adoption of new and available devices." He went on to say that "...there are precautions so imperative that even their universal disregard will not excuse their omission." This opinion may have opened up the floodgates on negligence because it implies an unattainable level of foresight with damages determined in hindsight.

Luckily, Judge Hand realized this weakness (albeit 15 years later) and followed up with a more realistic formula for determining negligence: "...if the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B less than PL." (US v. Carroll Towing, 1947). If that formula for negligence looks familiar, it should -- it is a manifestation of the formula we use to measure risk.

In short, Judge Hand ascribes a cost-benefit equation to determining negligence, effectively asserting that we should spend only as much as the consequences might cost, discounted by the likelihood of a negative event within the scope of circumstances.

So, instead of "whatever it takes," IT security risk management professionals should be spending "as much as necessary, not to exceed the value of the potential losses." Many tech risk pros intuitively understand this. But others are so caught up in the operational reality of putting out daily fires that they don't get the opportunity to put it into practice.

That’s a crucial mistake if you want to be taken seriously internally when it comes to managing IT security.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/6/2013 | 2:27:21 PM
Negligence, not risk a better metric for IT security
Thank you Pete Lindstrom and Judge Learned Hand for that common sense measure & definition of IT security risk management. The history lesson was also very interesting.

 

 
dak3
50%
50%
dak3,
User Rank: Moderator
12/6/2013 | 5:38:48 PM
Re: Negligence, not risk a better metric for IT security
The problem, though, is figuring out the "L". Loss is both monetary and reputaional and the "cost" of making the organization whole may be neyond counting...
plindstrom193
50%
50%
plindstrom193,
User Rank: Apprentice
12/7/2013 | 11:46:56 AM
Re: Negligence, not risk a better metric for IT security
Hi, Dak3 -

That is a common lament. I suggest we keep in mind that these are economic entities we're talking about, not people. So any "reputational damage" *must* reflect in higher costs or lower revenue. While that is certainly possible, attempts by economists to glean economic damage have all fallen flat in the past.

The notion of being "beyond counting" is typically a reflection of disagreement in the "market" - you and I may not pay the same amount for, say, a signed baseball from World Series Champions Boston Red Sox, but it can be valued nevertheless. Same goes with companies buying companies or even more obvious intangibles.

Btw, we don't really need some absolute value of 'L' - all we need to know is how much has been spent (the 'B') so that we can make the higher or lower comparison to 'P * L.' 

Thanks for the comment,

Pete
dak3
50%
50%
dak3,
User Rank: Moderator
12/7/2013 | 1:09:15 PM
Re: Negligence, not risk a better metric for IT security
You might want to ask the folks at DigiNotar about that

 

:)

 
plindstrom193
50%
50%
plindstrom193,
User Rank: Apprentice
12/7/2013 | 9:33:48 PM
Re: Negligence, not risk a better metric for IT security
I'm not sure why you think Diginotar's situation is inconsistent with my comments. They are the perfect example of how 'reputation problems' can easily be shown to have economic losses.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/9/2013 | 11:42:09 AM
Re: Negligence, not risk a better metric for IT security
I'd say bankruptcy following a hack is a pretty accurate way to quantify "L" and the DigiNotar incident in which the Dutch certificate authority (DigiNotar of Holland) was compromised and manipulated into issuing fraudulent certificates for Google and other large sites is a pretty stunning examploe of how to determine what an "appropriate"  IT security risk management should look like.
Gary Scott
100%
0%
Gary Scott,
User Rank: Apprentice
12/27/2013 | 2:45:02 PM
"Whatever it takes" is less than $5.00
I've seen companies with the "whatever it takes" mentality change their stance when it comes to data destruction.  We are a NAID certified company providing onsite hard drive destruction - we also carry professional liability insurance with breach notification coverage.    

We've seen some of these companies claiming "whatever it takes" balk at our $5.00 per hard drive destruction fee.  Instead of secure destruction, they risk losing confidential information by allowing an electronic recycler remove drives from their custody with the "promise" of complete erasure.    
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8896
Published: 2014-12-22
The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modify ...

CVE-2014-8897
Published: 2014-12-22
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 ...

CVE-2014-8898
Published: 2014-12-22
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.