Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
9/28/2016
09:48 AM
Tom Quillin
Tom Quillin
Partner Perspectives
Connect Directly
Twitter
LinkedIn
RSS
100%
0%

‘Beep’ Prepared: How Security Economics Can Help The Coyote Catch The Roadrunner

The practice of security economics demonstrates how gaps in the security architecture impair business results.

Acme Corp., fictional purveyor of fine products to the coyote in a relentless quest to catch the roadrunner, has found that cyberattacks are affecting its manufacturing processes and are at least partly to blame for repeated product failures in the field. They asked Intel Security to take a look at their operations and recommend ways to improve them.

Like many real-life organizations, Acme is experiencing cyberattacks that are getting nastier, taking longer to clean, and affecting multiple aspects of business operations. It knows that it needs to update its security systems, but it struggles to quantify what it takes to move forward. And -- just as importantly -- the company isn’t sure how to capture and quantify the benefits of its potential actions. Acme’s CFO is holding tight on the purse strings until the security team can provide a business case. Meanwhile, the clock ticks…

Does this sound like a familiar challenge to you?

For many of us in security, the conversation between us as technical experts and our non-technical colleagues can be frustrating. We have our top priorities: must-do, urgent actions that will advance our organization’s security. But sometimes it feels like our partners in finance or lines of business speak a different language.

The practice of security economics helps bridge that divide. Our practice at Intel Security started with building a process and methodology to use in conversations with security teams in any size businesses as well as government and other organizations.

Let’s go back to our fictional friends at Acme. Say Acme was suffering from advanced targeted attacks that were able to evade their existing defenses. Acme has implemented lots of tools from many different vendors, all with the best intentions. Frustratingly, though, Acme is still getting penetrated and, in spite of all the top quadrant products from the latest start-ups, Acme has limited visibility into what’s happening.

Acme’s CISO says she is driving focus on rapid remediation to get systems cleaned and returned to operation as quickly as possible. She has quotes from security vendors that have compelling technology to help her reduce infection rates. The problem? The CISO is struggling to get funding for her investment because her stakeholders see the situation as a security problem, not a business problem.

Our first step is a conversation with the team for data gathering. Turns out, Acme is suffering several dozen attacks per year. Most of the attacks are minor and can be remediated in two to four hours.

For the daily work involved for minor incidents, we estimate the cost for IT’s remediation work at about $100 per incident. But here’s the thing the security team forgets: Remediation has costs beyond the security team. For an endpoint machine, an end-user without a PC is a less productive end-user. So in our model, we want to make sure we are capturing the impact to Acme’s line of business teams. This becomes the key insight for our CISO to use in influencing her business partners to support funding her plan.

We determine that the productivity impact for end users is roughly equal to the impact on the security team. In other words, the number of hours consumed by infections is hurting Acme’s business (no wonder Road Runner keeps on winning!). The table summarizes the math.

Total scale of the problem

 

Minor infections per year

100

   

IT labor costs for minor incidents

IT hours to remediate

2-4

IT loaded hourly rate

$35

IT cost per incident

$100

   

End-user labor costs for minor incidents

End-user hours

4

User productivity loss

50%

User loaded hourly rate

$55

End user cost per incident

$110

   

Total cost/year for minor incidents

 

IT's staff costs for remediation

 $    10,000

End-user staff costs

11,000

 

 $    21,000

Solving this problem alone won’t justify the investment Acme’s CISO wants to make, but it does begin to help demonstrate how gaps in the security architecture impair business results. Next time, we’ll share some other examples of how we worked with Acme’s CISO to build a compelling business case for change. 

Tom Quillin is the Director of Cyber Security for Technologies and Initiatives at Intel Corp. He is responsible for identifying security risks, as well as contributing to product planning that addresses future security challenges. He also manages Intel's policy positions on ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19604
PUBLISHED: 2019-12-11
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVE-2019-14861
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permiss...
CVE-2019-14870
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authent...
CVE-2019-14889
PUBLISHED: 2019-12-10
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence...
CVE-2019-1484
PUBLISHED: 2019-12-10
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.