Orientacion

Return On Security Investment (ROSI): A Practical Quantitative Model Wes Sonnenreich SageSecure, LLC 116 W. 23 St. 5th Floor, NYC, NY 10011 wes@sagesecure.com
rd

A summary of Research and Development conducted at SageSecure by: Wes Sonnenreich, Jason Albanese (jpa@sagesecure.com) and Bruce Stout (bstout@sagesecure.com)

ABSTRACT Organizations need practical security benchmarking tools inorder to plan effective security strategies. This paper explores a number of techniques that can be used to measure security within an organization. It proposes a benchmarking methodology that produces results that are of strategic importance to both decision makers and technology implementers. 1. INTRODUCTION

2.

A RETURN ON INVESTMENT MODEL FOR SECURITY

"Which of these options gives me themost value for my money?" That's the fundamental question that Return On Investment (ROI) is designed to answer. ROI is frequently used to compare alternative investment strategies. For example, a company might use ROI as a factor when deciding whether to invest in developing a new technology or extend the capabilities of their existing technology.
ROI

In a world where hackers, computerviruses and cyber-terrorists are making headlines daily, security has become a priority in all aspects of life, including business. But how does a business become secure? How much security is enough? How does a business know when its security level is reasonable? Most importantly, what's the right amount of money and time to invest in security? Executive decision-makers don't really care whetherfirewalls or lawn gnomes protect their company's servers. Rather, they want to know the impact security is having on the bottom line. In order to know how much they should spend on security, they need to know: • • • • • How much is the lack of security costing the business? What impact is lack of security having on productivity? What impact would a catastrophic security breach have? What are the mostcost-effective solutions? What impact will the solutions have on productivity?

=

Expected Returns - Cost of Investment Cost of Investment

(1)

To calculate ROI, the cost of a purchase is weighed against the expected returns over the life of the item (1). An overly simplistic example: if a new production facility will cost $1M and is expected to bring in $5M over the course of three years,the ROI for the three year period is 400% (4x the initial investment of net earnings). A simple equation for calculating the Return on Investment for a security investment (ROSI) is as follows:
ROSI

=

(Risk Exposure • % Risk Mitigated) - Solution Cost Solution Cost

(2)

Let's see how this equation works by looking at the ROI profile for a virus scanner. ViriCorp has gotten virusesbefore. It estimates that the average cost in damages and lost productivity due to a virus infection is $25,000. Currently, ViriCorp gets four of these viruses per year. ViriCorp expects to catch at least 3 of the 4 viruses per year by implementing a $25,000 virus scanner. Risk Exposure: Risk Mitigated: Solution Cost: $25,000, 4x per year = $100,000 75% $25,000

Before spending money on a productor service, decisionmakers want to know that the investment is financially justified. Security is no different -- it has to make business sense. What decision-makers need are security metrics that show how security expenditures impact the bottom line. There's no point in implementing a solution if its true cost is greater than the risk exposure. This paper will present a model for calculating thefinancial value of security expenditures, and will look at techniques for obtaining the data necessary to complete the model.

ROSI

=

($100,000 • 75%) - $25,000 $25,000

= 200%

(3)

Page 1 of 7

The virus scanner appears to be worth the investment, but only because we're assuming that the cost of a disaster is $25,000, that the scanner will catch 75% of the viruses and that the...