How is Buying a Home Like Justifying Data Security Investments? Developing Return on Security Investment (ROSI) Analysis

World®
’16
How is Buying a Home Like Justifying Data Security
Investments? Developing Return on Security
Investment (ROSI) Analysis
Jeff Cherrington - Senior Director of Product Management - CA Technologies
MFX118S
MAINFRAME AND WORKLOAD AUTOMATION

2 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
© 2016 CA. All rights reserved. All trademarks referenced herein belong to their respective companies.
The content provided in this CA World 2016 presentation is intended for informational purposes only and does not form any type of
warranty. The information provided by a CA partner and/or CA customer has not been reviewed for accuracy by CA.
For Informational Purposes Only
Terms of this Presentation

Abstract
Data protection is a mandatory hygiene required in the data center and demanded by
customers, both consumer and commercial. Justifying additional investments in data security
can be challenging to justify to the executive team, as it seldom has direct line-of-sight to
increased revenue or reduced costs. However, investments must pace with the increases in both
the threats of increasingly organized and sophisticated attacks and the broader, more invasive
regulations. Find out how justifying investments in data security is similar to the decisions made
when purchasing a home. The session continues by reviewing strategies for building persuasive
business cases for the additional mainframe protections to protect the mainframe data center in
its current role and in the increasingly critical role it must play in the emerging Application
Economy.
Jeff
Cherrington
CA Technologies
Senior Director,
Product Management

Agenda
PURPOSE OF SESSION
SHARED EXPERIENCE – BUYING A HOME
QUESTIONS, DISCUSSIONS, AND EXPERIENCES
HOW DOES THAT RELATE TO DATA SECURITY?
RETURN ON SECURITY INVESTMENT (ROSI)
DEVELOPING A ROSI ANALYSIS
1
2
3
4
5
6

Purpose of This Session
§ Enterprises must diligently assess investments in data
security, striving to invest enough, neither too much nor
too little
§ This session offers some strategies for equipping senior
managers with relevant financial analysis
§ The conversation is framed using comparison to experience
many of us share – purchasing a home
§ You are encouraged to share your questions and experiences

Shared Experience – Buying a Home
§ Buying a home is the largest financial decision most of us
make in our personal lives
§ Most of us find the process unfamiliar the first time, with
many murky components – lending rates and terms, home owners insurance, title
insurance, inspection fees, …
§ Think about when you bought your first home and you had to engage with
things like PMI or MIP (insurance on my mortgage? Really?), loan-to-value(LTV)
ratio, points, …
§ In good cases, we are guided through the process by competent professionals of
integrity, who speak to us clearly using concepts we understand

What does that have to do with enterprise data security?
§ Senior enterprise executives struggle with assessing security investment, at least in
part, because it aligns only uncomfortably with the concepts they use most frequently –
Return on Investment (ROI), Internal Rate of Return (IRR), Net Present Value (NPV) …
§ Evaluating and committing to investments
in data security introduces elements less
familiar and more nebulous to most senior
executive experience
§ They know some is required by regulation, some is
mandatory to remain operational, while some is
discretionary with uncomfortable understanding
of the risk addressed and to what degree…

Return on Security Investment (ROSI)
§ ROI = (Gain from Investment – Cost of Investment)
Cost of Investment
§ Gains from investment in security are hard, if not impossible, to quantify – if the
security works, the best case is nothing bad happens (meet expectations)
§ Return on Security Investment alters the view point from ‘what happens if you
invest in x’ to ‘what happens if you don’t invest in x’
§ Standard approaches applied to normalizing units of measure and probability of
negative event occurrences
§ Supported by a body of both academic and commercial research

Return on Security Investment (ROSI)
§ ROSI = ((Risk Exposure * % Risk Mitigated) – Solution Cost)/Solution Cost
§ Risk Exposure = Annual Loss Exposure (ALE)
§ ALE = Single Loss Exposure (SLE) * Annual
Rate of Occurrence (ARO)
§ SLE = Estimated cost of a negative
security event
§ ARO = Estimated probability of the negative
security event occurring in a period
(typically, a year)

An Example of an ROSI Analysis – Data Breach
§ Analysis using industry standard Return on Security Investment (ROSI) calculations1
§ ROSI = ((Risk Exposure * % Risk Mitigated) – Solution Cost)/Solution Cost
§ Risk Exposure = Annual Loss Exposure (ALE)
§ ALE = Single Loss Exposure (SLE) * Annual Rate of Occurrence (ARO)
§ ARO = 22%3, according to Ponemon Institute
§ Using Ponemon Institute figures2
Cost/Record $217.00
Records Lost Range Cost of Breach ALE
Low 5,655 $1,227,135 $269,970
Average 28,070 $6,091,190 $1,340,062
High 96,550 $20,951,350 $4,609,297

An Example of an ROSI Analysis – Data Breach
ROSI = ((Risk Exposure * % Risk Mitigated) – Solution Cost)/Solution Cost
Assume an investment option mitigates only 20% of the target risk
Using the Average Ponemon Institute Incident
[ALE] $6,091,191 * [ARO] 22% = [Risk Exposure] $1,340,062
Small Enterprise (using 28K compromised records as basis)
ROSI = (($1,340,062 * 20%) – $31,8934)/$31,893, or 700%+ ROSI
Medium Enterprise (using 28K compromised records as basis)
ROSI = (($1,340,062 * 20%) – $160,6404)/$160,640, or 69% ROSI
Large Enterprise (using public figures for major data breach)
ROSI = (($56,000,000 * 20%) – $833,3335)/$833,33, or 1200%+ ROSI

Recap
§ Many executives who the ultimate decision
makers regarding security investments are
more comfortable approaching such decisions
using concepts and techniques familiar from
evaluating other investments
§ Security investments are poorly aligned with
traditional ROI approached
§ ROSI aligns financial analysis techniques
familiar to executives with the content of data
protection’s realities

Questions?

Recommended Sessions
SESSION # TITLE DATE/TIME
MFX173S The Importance of Mainframe Security Education 11/16/2016 at 3:45 pm
MFT174S
Mainframe Security Strategy and Roadmap: Best
Practices for Protecting Mission Essential Data
11/17/2016 at 12:45 pm
MFT175S Gaps in Your Defense: Hacking the Mainframe 11/17/2016 at 3:00 pm

Must See Demos
Real-Time Data Security
and Compliance
CA Data Content
Discovery
Mainframe Theatre
Mainframe Security
Smart Bar
CA Top Secret®
Mainframe Theatre
Real-Time Data Security
and Compliance
CA Compliance
Event Manager
Mainframe Theatre
Mainframe Security
Smart Bar
CA ACF2
Mainframe Theatre

Thank you.
Stay connected at communities.ca.com

Mainframe and Workload Automation
For more information on Mainframe and Workload Automation,
please visit: http://cainc.to/9GQ2JI

How is Buying a Home Like Justifying Data Security Investments? Developing Return on Security Investment (ROSI) Analysis

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (20)

Similar to How is Buying a Home Like Justifying Data Security Investments? Developing Return on Security Investment (ROSI) Analysis

Similar to How is Buying a Home Like Justifying Data Security Investments? Developing Return on Security Investment (ROSI) Analysis (20)

More from CA Technologies

More from CA Technologies (20)

Recently uploaded

Recently uploaded (20)

How is Buying a Home Like Justifying Data Security Investments? Developing Return on Security Investment (ROSI) Analysis