Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
9/28/2016
09:48 AM
Tom Quillin
Tom Quillin
Partner Perspectives
Connect Directly
Twitter
LinkedIn
RSS
100%
0%

‘Beep’ Prepared: How Security Economics Can Help The Coyote Catch The Roadrunner

The practice of security economics demonstrates how gaps in the security architecture impair business results.

Acme Corp., fictional purveyor of fine products to the coyote in a relentless quest to catch the roadrunner, has found that cyberattacks are affecting its manufacturing processes and are at least partly to blame for repeated product failures in the field. They asked Intel Security to take a look at their operations and recommend ways to improve them.

Like many real-life organizations, Acme is experiencing cyberattacks that are getting nastier, taking longer to clean, and affecting multiple aspects of business operations. It knows that it needs to update its security systems, but it struggles to quantify what it takes to move forward. And -- just as importantly -- the company isn’t sure how to capture and quantify the benefits of its potential actions. Acme’s CFO is holding tight on the purse strings until the security team can provide a business case. Meanwhile, the clock ticks…

Does this sound like a familiar challenge to you?

For many of us in security, the conversation between us as technical experts and our non-technical colleagues can be frustrating. We have our top priorities: must-do, urgent actions that will advance our organization’s security. But sometimes it feels like our partners in finance or lines of business speak a different language.

The practice of security economics helps bridge that divide. Our practice at Intel Security started with building a process and methodology to use in conversations with security teams in any size businesses as well as government and other organizations.

Let’s go back to our fictional friends at Acme. Say Acme was suffering from advanced targeted attacks that were able to evade their existing defenses. Acme has implemented lots of tools from many different vendors, all with the best intentions. Frustratingly, though, Acme is still getting penetrated and, in spite of all the top quadrant products from the latest start-ups, Acme has limited visibility into what’s happening.

Acme’s CISO says she is driving focus on rapid remediation to get systems cleaned and returned to operation as quickly as possible. She has quotes from security vendors that have compelling technology to help her reduce infection rates. The problem? The CISO is struggling to get funding for her investment because her stakeholders see the situation as a security problem, not a business problem.

Our first step is a conversation with the team for data gathering. Turns out, Acme is suffering several dozen attacks per year. Most of the attacks are minor and can be remediated in two to four hours.

For the daily work involved for minor incidents, we estimate the cost for IT’s remediation work at about $100 per incident. But here’s the thing the security team forgets: Remediation has costs beyond the security team. For an endpoint machine, an end-user without a PC is a less productive end-user. So in our model, we want to make sure we are capturing the impact to Acme’s line of business teams. This becomes the key insight for our CISO to use in influencing her business partners to support funding her plan.

We determine that the productivity impact for end users is roughly equal to the impact on the security team. In other words, the number of hours consumed by infections is hurting Acme’s business (no wonder Road Runner keeps on winning!). The table summarizes the math.

Total scale of the problem

 

Minor infections per year

100

   

IT labor costs for minor incidents

IT hours to remediate

2-4

IT loaded hourly rate

$35

IT cost per incident

$100

   

End-user labor costs for minor incidents

End-user hours

4

User productivity loss

50%

User loaded hourly rate

$55

End user cost per incident

$110

   

Total cost/year for minor incidents

 

IT's staff costs for remediation

 $    10,000

End-user staff costs

11,000

 

 $    21,000

Solving this problem alone won’t justify the investment Acme’s CISO wants to make, but it does begin to help demonstrate how gaps in the security architecture impair business results. Next time, we’ll share some other examples of how we worked with Acme’s CISO to build a compelling business case for change. 

Tom Quillin is the Director of Cyber Security for Technologies and Initiatives at Intel Corp. He is responsible for identifying security risks, as well as contributing to product planning that addresses future security challenges. He also manages Intel's policy positions on ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5421
PUBLISHED: 2020-09-19
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-8225
PUBLISHED: 2020-09-18
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
CVE-2020-8237
PUBLISHED: 2020-09-18
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
CVE-2020-8245
PUBLISHED: 2020-09-18
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11....
CVE-2020-8246
PUBLISHED: 2020-09-18
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-W...