Your SlideShare is downloading. ×
Justifying your Security Spend<br />Presented by: Jojo Colina<br />Head, Product Management & Development <br />Privileged...
“Security Problems are never truly solved. The bad guys are always waiting for an opportunity...”<br />
“Security Problems are never truly solved. The bad guys are always waiting for an opportunity...”<br />And they are gettin...
Risk can never be Eliminated!<br />“There is no ‘right’ amount of money to spend on IT infrastructure.” No matter how much...
Good Security is Invisible<br />It’s difficult to justify security when it’s working.  <br />
The biggest investments in security usually come right after a security breach <br />One in the news or a breach in your o...
Making People Dissatisfied is the Only Way to Justify Investment<br />Dissatisfaction with the status quo is most importan...
Three challenges to Security<br />Make your end users “feel” secure<br />
Three challenges to Security<br />Make your end users “feel” secure<br />Implement an infrastructure with a reasonable lev...
Victim of your own success<br />“Security to your end users is a state of mind. One which you created by your success in s...
Victim of your own success<br />“Security to your end users is a state of mind. One which you created by your success in s...
Three challenges to Security<br />Make your end users “feel” secure<br />Implement an infrastructure with a reasonable lev...
How to determine the right level of Investment<br />What are other companies doing who have a similar risk tolerance to yo...
Justify the Need<br />Enterprise Objectives for Security<br />Obtain Blueprint documents from CTO/CIO to understand roadma...
Build a Business Case<br />Understand TCO<br />Total Cost of Ownership – use Finance to assist; plan across next 5 fiscal ...
Build a Business Case<br />Articulate Impact – Piggyback<br />You have to be able to articulate what the umbrella benefit ...
ROI and ROSI<br />To calculate ROI, the cost of a purchase is weighed against the expected returns over the life of the it...
Justifying your Investment– Key points<br />Security Investment is hard to quantify<br />The need for security is obvious<...
References<br />Return On Security Investment (ROSI): A Practical Quantitative Model<br />http://www.infosecwriters.com/te...
Upcoming SlideShare
Loading in...5
×

[EB100510] Jojo Colina: Justifying IT Security Spend

910

Published on

Jojo Colina's presentation on "Justifying IT Spend on Security" during Computerworld Philippines' Executive Briefing on Information Security in October.

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
910
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
0
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Transcript of "[EB100510] Jojo Colina: Justifying IT Security Spend"

  1. 1. Justifying your Security Spend<br />Presented by: Jojo Colina<br />Head, Product Management & Development <br />Privileged and Confidential. NDA Required for External Disclosure.<br />
  2. 2. “Security Problems are never truly solved. The bad guys are always waiting for an opportunity...”<br />
  3. 3. “Security Problems are never truly solved. The bad guys are always waiting for an opportunity...”<br />And they are getting better all the time!<br />
  4. 4. Risk can never be Eliminated!<br />“There is no ‘right’ amount of money to spend on IT infrastructure.” No matter how much money you spend on infrastructure, you’ll never be totally safe and secure.  So the “right” amount of money for a company to spend on IT infrastructure — whether it’s for security or for something else like database reliability or resilient servers — depends on the amount of risk that the company is willing to tolerate.<br />
  5. 5. Good Security is Invisible<br />It’s difficult to justify security when it’s working. <br />
  6. 6. The biggest investments in security usually come right after a security breach <br />One in the news or a breach in your own company’s security<br />
  7. 7. Making People Dissatisfied is the Only Way to Justify Investment<br />Dissatisfaction with the status quo is most important when you’re trying to sell security investment. <br />To justify additional security investment you have to convince the business that your current security infrastructure is inadequate.<br />
  8. 8. Three challenges to Security<br />Make your end users “feel” secure<br />
  9. 9. Three challenges to Security<br />Make your end users “feel” secure<br />Implement an infrastructure with a reasonable level of security for the amount of money the company is willing to invest<br />
  10. 10. Victim of your own success<br />“Security to your end users is a state of mind. One which you created by your success in solving security challenges.”<br />
  11. 11. Victim of your own success<br />“Security to your end users is a state of mind. One which you created by your success in solving security challenges.”<br />Now that they feel secure, how do you justify additional security expense?<br />
  12. 12. Three challenges to Security<br />Make your end users “feel” secure<br />Implement an infrastructure with a reasonable level of security for the amount of money the company is willing to invest<br />Recommend the right level of infrastructure security investment and getting agreement from the business<br />
  13. 13. How to determine the right level of Investment<br />What are other companies doing who have a similar risk tolerance to your company? <br />Does your company deal with confidential information from your customers? <br />Does your company differentiate itself from its competition based on an enhanced level of trust or risk avoidance? <br />Does your company hold a proprietary advantage over its competition which could be lost if confidential company information was revealed? <br />
  14. 14. Justify the Need<br />Enterprise Objectives for Security<br />Obtain Blueprint documents from CTO/CIO to understand roadmap for technology growth in hardware/software/network<br />Regulatory Mandates<br />Contact Compliance, Legal and industry groups to understand immediate and short-term/long-term regulatory requirements <br />Risk Analysis<br />Understand your risks in cyber/physical security, disaster recovery/business continuation and compliance to data protection/data sharing regulations<br />Quantify the impacts wherever possible; per incident, per potential loss<br />Probability of Occurrence<br />Be realistic; Pull industry trend information; poll industry alliances; previous internal loss<br />Impact of Occurrence<br />Be realistic; compute hard financial impacts, estimate soft financial impact based on real industry losses/settlements/pay-outs; poll industry vendors<br />Benefit to Enterprise<br />Avoidance is one benefit but weak justification for getting approved funds<br />Tie to hard savings/loss reduction <br />
  15. 15. Build a Business Case<br />Understand TCO<br />Total Cost of Ownership – use Finance to assist; plan across next 5 fiscal years [understand where you can cut if necessary]<br />Timelines and Resource Requirements<br />Articulate inter-dependencies between security initiatives<br />Speak to the large plan; cross-utilize resources<br />Use compliance requirements to your advantage<br />Make contact with industry firms early to determine resource availability<br />Try to MINIMIZE EXPENSES [save up for future battles]<br />Use Financial Metrics<br />Build metrics that can reflect your project progress<br /> Always be ready to estimate financial cost avoidance from a deterred incident <br />Provides immediate feedback of success and hardened evidence of ROSI for future projects/enhancements<br />
  16. 16. Build a Business Case<br />Articulate Impact – Piggyback<br />You have to be able to articulate what the umbrella benefit is, what the specific impact potential might be, and the specific benefits of each project<br />Piggyback related projects to provide ‘value-added’ benefit.<br />Meet Stakeholders Expectations<br />Write the narrative to the expectations of your project stakeholders<br />Know what they need to accomplish within their realm [financial, organizational, resource management, bonus structure, etc]<br />
  17. 17. ROI and ROSI<br />To calculate ROI, the cost of a purchase is weighed against the expected returns over the life of the item. <br />Ex: if a new production facility will cost $1M and<br />is expected to bring in $5M over the course of three years, the ROI for the three year period is 400% (4x the initial investment of net earnings).<br />ROI(Return on Investment)<br />ROSI (Return on Security Investment)<br />ViriCorp has gotten viruses before. It estimates that the average cost in damages and lost productivity due to a virus infection is $25,000. Currently, ViriCorp gets four of these viruses per year. ViriCorp expects to catch at least 3 of the 4 viruses per year by implementing a $25,000 virus scanner.<br />
  18. 18. Justifying your Investment– Key points<br />Security Investment is hard to quantify<br />The need for security is obvious<br />Impact of a security breach is real<br />Justification ahead of time is difficult<br />Accurate Risk Analysis<br />Accurately determine your risk profile<br />Financial Analysis<br />ROI/ROSI<br />Determine impact and loss deference of investing<br />Create a sound business plan<br />Instrument your projects<br />Create metrics which highlight success/failure<br />Roadmap your security plan<br />
  19. 19. References<br />Return On Security Investment (ROSI): A Practical Quantitative Model<br />http://www.infosecwriters.com/text_resources/pdf/ROSI-Practical_Model.pdf<br />Three things your CEO wants to Know<br />http://blog.makingitclear.com/2008/06/10/ceowantstoknow/<br />Trial by Fire - Price Waterhouse Coopers Advisory Services<br />http://www.pwc.com/en_GX/gx/information-security-survey/pdf/pwcsurvey2010_report.pdf<br />

×