Balancing the cost and benefits of countermeasures

This is the last tip in our series, "How to assess and mitigate information security threats," excerpted from Chapter 3: The Life Cycle of Internet Access Protection Systems of the book The Shortcut Guide to Protecting Business Internet Usage published by Realtimepublishers.

The task of balancing the cost and benefits of countermeasures is essentially an exercise in risk analysis. The purpose of a risk analysis is to identify assets, threats to those assets, the potential loss to an organization due to threats, and finally, how to respond to that potential loss. The risk analysis process consists of five steps.

First, the organization must assign values to information assets. The value can be based on the replacement cost, if the asset is hardware, or the cost to recreate or recover, if it is a software asset or data. Also consider differences in how assets are used. For example, two laptops might both cost $1000, but one stores only the email of a sales representative, which is less valuable data than the other, which belongs to the CFO and contains undisclosed financial data. Organizations should also take into account the effect of a security breach on customer goodwill and brand value. These, of course, are more difficult to measure, but some consideration should be given to all costs, not just those that are easily quantifiable.

The second step is to estimate the potential loss per risk. This could include:

• The cost to recover from a malware attack, including lost productivity and IT staff time.
• The cost to recover from a DoS attack, including the cost of modifications to firewalls, IPSs, and other network assets to prevent future successful attacks.
• The cost of fines and penalties for violating confidentiality and privacy agreements by allowing the disclosure of sensitive information during a security breach.
• Lost revenues due to unavailable systems that were compromised by an attack

With this information, you can calculate the single loss expectancy, or the cost of recovering from a single incident.

The next step requires an estimate of the likelihood of each type of risk. For example, based on past experience, an organization may estimate that a significant malware attack will occur once per year and information loss due to a security breach will occur twice per year. The cost per year (known as the annual loss expectancy—ALE) of a malware attack is the cost of recovering from one malware incident; the cost per year of information losses is two times the single incident cost.

These costs should provide an upper bound on the amount spent on countermeasures to prevent these threats from materializing. Countermeasures that cost less than the ALE should be deployed to mitigate the risk in cases in which the organization wants to reduce risks. There might be situations in which organizations are willing to accept the risk, either because the likelihood is so low or the cost of mitigating the risk so high. Alternatively, an organization could shift the risk by purchasing insurance.

So much depends on accurate valuations of assets and intangibles—such as customer goodwill, that it is essential to have accurate estimates or you risk skewing security resources to the wrong assets. Assessing threats and appropriate countermeasures is a key component of the asset protection life cycle. By understanding the risks associated with each asset, the value of each asset, and the cost of protecting the asset, organizations can make rational and efficient choices with regard to security practices. After the objectives for information asset protection are in place and choices are made about appropriate countermeasures, policies and procedures should be defined to put those decisions into practice.

How to Assess and Mitigate Information Security Threats

• Introduction
• Malware: The ever-evolving threat
• Network-based attacks
• Information theft and cryptographic attacks
• Attacks targeted to specific applications
• Social engineering
• Threats to physical security
• Balancing the cost and benefits of countermeasures

This chapter excerpt from the free eBook The Shortcut Guide to Protecting Business Internet Usage, by Dan Sullivan, is printed with permission from Realtimepublishers, Copyright 2006.

Now that you're finished reviewing these 7 tips, move on and review the rest of the chapter, or download the entire eBook.