Risk and reward?

Security is more like buying insurance than buying an application," says Brendan Major, director of information services at child protection charity, the NSPCC [National Society for the Prevention of Cruelty to Children]. "How do you quantify your insurance premiums? How much resource do you want to put in?" he asks.

As a charity dealing with highly sensitive personal data, the NSPCC gives high priority to information security. "In the last four years, our security spend has at least doubled," Major says. "As more and more data is held and distributed electronically, that has led to an increase in our IT security profile, definitely."

Like the NSPCC, most organisations are spending more than ever on security. Market research firm Key Note predicts that in the UK, security spending will rise to £1.76 billion by 2004, from £651 million in 1999, fuelled by increasing use of the Internet and a wider awareness of the risks posed by virus attacks.

However, in order to make a business case for these investments, organisations need to determine how they may be used to best effect. Building a credible return on investment (ROI) case for security products is a major challenge, however. Most organisations are reluctant to admit that they have been the victims of computer crime, and as a result, hard data about security risks – and hence about the likely paybacks of investing in security technology – is hard to come by. So are IT decision-makers getting a good return on these security investments? The answer is, most of them have no idea.


Simon Owen, Andersen: “You only know a firewalls worth when youre broken into.”


Too little, too late
"You only really know if it's worth having a firewall when you're broken into and lose money," explains Simon Owen, a partner within the Technology Risk Consulting group at management consultancy Andersen. "Surveys have shown that the average cost associated with a security breach is around £250,000, but directors are still reluctant to spend even £50,000 on a firewall until it happens to them."

"In some cases, the only way the board will be persuaded there's a risk is when the company gets hammered with a virus," agrees Julian Bogajski, UK commercial director of Sybari, a specialist in anti-virus systems for Microsoft Exchange and Lotus Notes groupware systems. "In probably 50% or more of the sales we make, companies fail to establish cost justification internally. Then they get hit by a virus and come back to us needing a solution almost instantly. And they're getting hit financially twice – because of the cost of implementing the security measures, and because of the downtime and clean-up costs."

The NSPCC uses two broad principles to steer its security investment strategy, explains Major. First, the charity takes an end-to-end view of security that encompasses both the physical and technological aspects – and maintains and updates the security infrastructure along end-to-end lines. "We have a ‘flank' approach, whereby different component parts of our security systems move forward together," Major explains. "There's no point having massively secure firewalls if your physical security is poor, for example," he says.

Second, the NSPCC has established a hierarchy of priorities for security spending, with protection of services and data at the top of the list, followed by preventative measures such as intrusion detection, then sophisticated investigation methods. "If we decided to look at security afresh, we'd look across the flank, according to our priorities," Major says.

Risky business
Owen of Andersen argues that the only effective way to measure the value of your security investment is to measure risk – the potential cost of not having security technologies in place. But that is easier said than done. Accurate risk assessment means technology decision-makers need to have a very thorough understanding of their businesses – what the key business processes are, and all the ways they might be affected by a major security breach, for example.


Julian Bogajski, Sybari: “Dont wait until your company gets hammered by a virus.”


"From our research, it's clear that few organisations have a sound method of managing the growth in information risk, " says Alan Stanley, managing director of the Information Security Forum (ISF). Set up in 1989, the ISF is a non-profit organisation focusing on providing practical solutions to information security problems. It has developed its own methodology, FIRM (Fundamental Information Risk Management), which companies can use to highlight their critical business applications and the relationship between costs, controls and security incidents. The ISF is working with technology risk software company Citicus to develop an automated version of the methodology.

ISF members can also benchmark their own security experiences and procedures against those of their peers using data from a two-yearly membership survey which the ISF has carried out since the late 1980s.

Another company that aims to assess companies' exposure to security risk – and does so from the physical, electronic and process points of view – is Compass Management Consulting. Compass has built up a database of IT performance metrics and operational practices by which to measure risk. "We look at things like proximity and location issues, at internal and external security, and at existing security policies," explains Debbie Rosario, a senior consultant with Compass. "Threat times vulnerability equals risk, and once you have an idea of the scale of the risk, you can have a sensible dialogue about the areas of security you should focus on."

Rosario believes that the difficulty of evaluating security risk is overestimated by many organisations. "The skill is simply in getting the company to understand what their critical business processes are, and the impact on the bottom line if something goes wrong," she says. "Some industries are already very good at that. Most retailers, for example, know their average sales per hour, and can calculate the impact of lost sales quite accurately."

Managers charged with justifying security investments should also bear in mind that some measures can have secondary, tangible benefits for the company, according to Peter Dudley, a former IT director of British Petroleum (BP) who now works as a consultant for security firm Asita. "For example," he says, "if you beef up your email encryption, you can may be able to consider doing away with your private virtual circuit for sending intra-company email and use the Internet instead."

By identifying low-cost options for maintaining or improving data security on a day-to-day basis, IT directors may find it easier to convince business-level managers that more expensive proposals for safeguarding corporate data from more exceptional breaches will pay off. But inevitably, they will frequently run up against this conundrum: If security measures are effective, an organisation will never really know what might have happened if it had not implemented those measures.


Hands on: Kleinwort Benson

As a private bank that prides itself on providing high-wealth individuals with "premium financial services", Kleinwort Benson cannot afford to slip up on security. "We don't do a return on investment (ROI) calculation at all. We consider that security is an integral part of the structure of the business," says Andre Gorvel, head of information security at the bank.

Nevertheless, Kleinwort Benson has defined methods in place for calculating its potential losses from security breaches, and for prioritising where its security budget should be spent.

Gorvel's information security department falls within the remit not of the IT department, but of the bank's operational risk division, which also oversees, for example, legal and regulatory compliance. As such, information security is viewed not as a purely technology issue, but as one of a number of issues affecting the bank's overall business risk profile.

Gorvel believes this approach makes it easier to get security projects signed off at board level: "Most security departments are within the IT function, where they're regarded [by the board] as a direct cost," he says. The information security department at Kleinwort Benson, by contrast, does not compete with the IT department for resources at all.

Rather than overseeing an annual budget, the information security department tends to put forward proposals for specific projects, which then go before a project steering group. In deciding its priorities, the department assesses projects by perceived risk, using a risk rating system developed by the audit staff within the operational risk division.

"We look at factors like financial loss, loss of confidential material, loss of reputation and so on, and give them a very defined audit rating," Gorvel says. "Having the audit team on our side helps. I can bring up what I consider a high risk rating and we talk it through."

The one element lacking from the calculation, Gorvel admits, is good data on the probability of a given risk occurring. "That's one area where information security generally has a problem – nobody has sufficient evidence of specific breaches to give them a sensible probability. You can ask companies about their security failures until you're blue in the face and no-one will tell you. So most of our calculations are based not on the likelihood of a breach, but by the potential damage it would cause."



Avatar photo

Ben Rossi

Ben was Vitesse Media's editorial director, leading content creation and editorial strategy across all Vitesse products, including its market-leading B2B and consumer magazines, websites, research and...

Related Topics