Walk into the module devoted to the issue of cyber attack risk assessment and damage analysis to start
let's perform a simple simulation security solutions should be cost effective I.T. Security spendings.
As with other spending should be motivated and pay for itself in one way or another Arties systems administrators
and people responsible for eyeteeth systems security have a hard time explaining the cost effectiveness
of such spending.
Just ask your CEO or manager for $10000 for an anti-spam filter and you'll hear that there are better
ways to spend such an amount of money.
Let's try to perform a simple cost effective analysis of allowing spam or viruses.
We all assume the following scenario we work for a company where the average yearly salary is $60000.
There are 260 working days in a year.
Let's suppose that getting rid of a virus that somehow managed to infect a computer takes two hours.
This is a rather optimistic scenario but it's also even doe getting rid of a computer virus means a
two hour break in work for the user of the infected computer.
At the same time these are the two hours of work of an I.T. specialist who performs the operation.
If we divide the average salary by the number of working days in a year and then multiply the result
by the sum of the time consumed we will get the cost of getting rid of a virus from one computer.
If we assume that the company owns 500 computers and only 5 percent of these are infected by the computer
virus once a month which again is a rather optimistic assumption.
We have to multiply the result we got last time by 500 times 5 percent.
Will give us the monthly eyeteeth service cost which includes the cleaning of viruses only.
This is a direct cost of recovering computers from a virus infection.
If the people who decide where the money goes were presenting with the data above their decision might
be a little different.
You can say that the company will actually save ten thousand dollars a year by investing 10000 in the
security on a one off basis.
Such investment it would pay off after only one year.
This is the kind of talk a business user would understand after hearing such arguments.
They would probably concede
name of this module is to convince you the people who are responsible for I.T. systems security and
your companies that risk assessment and valuation is one of the elements of a successful security policy.
We need to balance profit and loss
what you can see in the slide is a graphic representation of a common problem.
The red line represents potential profits the attackers gain from breaking into computer systems.
The green line represents the amount of money spent on the protection of these systems.
99 percent of company computer systems fall into the lowest cost range which is the closest to the profit
X-ists within this cost range.
You can afford only the most basic security solutions.
These would include operating system updates real time antivirus scanner network connection firewall
as well as a firewall for the network protection as such.
Probably a software based one.
The cost of implementing such solutions is relative and so is the cost of defeating them at the end
of the range.
There is a point of departure we aim at a situation where the curve which represents the cost of the
security system increases slower than the one which represents the profit from breaking it.
If we reach the point where we have to spend less on the security system than the potential profit from
breaking it the problem of cybercrime will cease to exist.
Unfortunately this is impossible to achieve.
Just as in the real world the spending on security devices police private protection services etc. will
always be greater than the costs of carrying out a burglary.
Our homes are relatively safe not only because it isn't profitable to break into most of them but also
because burglars viewed the potential punishment as part of the cost component.
When it comes to cyber crimes the cost of punishment is still relatively low.
Until this changes our goal is to deliver the highest level of security for the lowest cost possible
before moving on to discuss one of the risk assessment models.
Let's consider one more example a bullet proof vest is an example of direct protection because of the
specific quality of the vest.
We can believe that it will protect us from the torso wounds that would otherwise be fatal.
This is definitely a considerable profit.
Nevertheless few people wear a bulletproof vest on a daily basis.
In the case of an attack the profit is great and so are the cost of the protection.
The first is heavy uncomfortable and non becoming.
The risk of getting shot is relatively low therefore it's not efficient to invest in such protection
because it's costs both direct and indirect are high and its profits are low.