Re: Could InfoSec be Worse than Death?

[Benjamin Robson <ben.robson () classicblue com au>]

Paul wrote:
> Saving money is a form of generating revenue indeed, but even in his 
> description Ben is forced to use the words "reducing the risk" to 
describe 
> his money saving techniques.  That's loss avoidance, plain and simple.

One aspect of saving money is indeed risk avoidance.  But my point was 
that the introduction of effective procedure sets is a very direct method 
of saving money for the organisation, not just through risk avoidance but 
through the reduction in costs associated with: staffing levels, as people 
become more efficient when following a procedure instead of making it up 
as they go; staffing type, as a less skilled workforce is required to 
execute standard proceduralised functions; and through quality, as fewer 
mistakes means less time is spent in fixing problems and repeating 
actions.

So its not just about saving money through risk reduction, but is also 
about directly reducing the operational overheads of the business through 
the use of procedures, which will also improve the security outcome.


-- 
Benjamin M.A. Robson
Senior Security Consultant

Classic Blue Solutions
134-142 Ferrars St, Southbank
Victoria, Australia, 3006
Phone: +61-(0)3-9684-3104
Mobile: +61-(0)434-149-022
Fax: +61-(0)3-9682-8680



full-disclosure-bounces () lists grok org uk wrote on 26/09/2006 04:45:16 AM:

> --On Monday, September 25, 2006 11:30:36 -0400 "Kenneth F. Belva" 
> <ken () ftusecurity com> wrote:
>
> > Paul,
> >
> > Thanks for your comments.
> >
> > > Unless you can demonstrate concrete revenue generationg directly
> > > attributable to security, I don't think you can overcome that 
perception
> > > (and loss avoidance through trust building does not generate 
revenue.)
> > I believe the purpose of the paper is to move away from the loss 
avoidance
> > model and describe information security in fashion that demonstrates 
how
> > security mechanisms have a direct role to play in the creation of 
assets
> > and business relationships.
> I understand that, but I think your trust model is merely a euphemism 
for 
> loss avoidance.  And I don't see how you can avoid being seen as loss 
> avoidance - unless you can show the ability to generate revenue.
>
> Ben Robson writes, 'Firstly, your statement, "After all, information 
> security doesn?t make money?it only spends." in my experience is 
actually 
> incorrect.  An effective information security outcome actually will save 
a 
> company a significant amount of money.'
>
> Saving money is a form of generating revenue indeed, but even in his 
> description Ben is forced to use the words "reducing the risk" to 
describe 
> his money saving techniques.  That's loss avoidance, plain and simple.
>
> Mind you, I'm not saying there is no merit to couching your argument in 
the 
> trust model terms.  I'm just saying that any PHB worth is salt will 
> automatically translate the model into "loss avoidance".  They might 
make 
> dumb decisions from time to time (or at least what appear to be dumb 
> decisions to us), but most PHBs *are* pretty intelligent creatures, and 
> they excel at cutting through the BS to the bottom line arguments. 
(That's 
> why, in part, they *are* PHBs.)
>
> Paul Schmehl (pauls () utdallas edu)
> Adjunct Information Security Officer
> The University of Texas at Dallas
> http://www.utdallas.edu/ir/security/
> [attachment "att7uu78.dat" deleted by Benjamin Robson/Australia/IBM]
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/