Return On Security Investment Research Articles

On metrics and prioritization of investments in hardware security

AbstractThe security risks posed by electronics are numerous. There are typically a variety of risk‐reducing countermeasures for a given system or across an enterprise. Each countermeasure is associated with both a level of risk reduction and its lifecycle costs. Given budgetary constraints, risk managers and systems engineers must determine what combinations of countermeasures cost‐effectively maximize risk reduction, and what metrics best guide the investment process. In this paper, we seek to answer these questions through exploration of risk reduction metrics from the field of security economics, including the benefit/cost ratio, return on security investment (ROSI), expected benefit of information security (EBIS), and expected net benefit of information security (ENBIS). The results suggest that ratio‐based metrics are not strongly correlated with risk reduction, while EBIS is equivalent to risk reduction and ENBIS is equal to risk reduction minus cost.

Mean platelet volume (mpv) as a predictor of impaired reperfusion in patients with st-segment elevation myocardial infarction receiving thrombolytic therapy

Today’s business environment is extremely dynamic and reliant on innovative Information Technology (IT). Such dependence upon technology leads to an increased rate of successful cyber-attacks whose impact is greater than ever. Due to the exponential increase in security breaches, companies should secure their IT systems by adopting appropriate risk management framework. Organizations have to make justified investments in cyber security. However, it is quite challenging to convince higher management to invest in security measures, since such investments cannot be exactly translated into profits. The Return on Security Investment (ROSI) holds great importance to justify such security investments. A large number of ROSI solutions have already been proposed. However, these solutions do not provide any approach to analyze the impact of single security investment upon whole infrastructure. Furthermore, uncertainty of security incident emerges as another important challenge. The existing ROSI frameworks work on approximations, which can be influenced by employees’ exposure and experience, resulting in wrong estimation. The objective of this research is to propose a comprehensive framework to measure ROSI effectively by overcoming gaps in the traditional approaches. The framework has been validated with the help of Common Vulnerability Security System (CVSS) attack dataset. The results show that the annual loss in the absence of security mechanisms is very high i.e. 585,553. However, by following the proposed systematic approach to determine ROSI, it can be reduced to 146,388 which is comparatively low. As a result, organization can save its resources, time, money, trust, and reputation in the market.

Framework for Calculating Return on Security Investment (ROSI) for Security-Oriented Organizations

Today’s business environment is extremely dynamic and reliant on innovative Information Technology (IT). Such dependence upon technology leads to an increased rate of successful cyber-attacks whose impact is greater than ever. Due to the exponential increase in security breaches, companies should secure their IT systems by adopting appropriate risk management framework. Organizations have to make justified investments in cyber security. However, it is quite challenging to convince higher management to invest in security measures, since such investments cannot be exactly translated into profits. The Return on Security Investment (ROSI) holds great importance to justify such security investments. A large number of ROSI solutions have already been proposed. However, these solutions do not provide any approach to analyze the impact of single security investment upon whole infrastructure. Furthermore, uncertainty of security incident emerges as another important challenge. The existing ROSI frameworks work on approximations, which can be influenced by employees’ exposure and experience, resulting in wrong estimation. The objective of this research is to propose a comprehensive framework to measure ROSI effectively by overcoming gaps in the traditional approaches. The framework has been validated with the help of Common Vulnerability Security System (CVSS) attack dataset. The results show that the annual loss in the absence of security mechanisms is very high i.e. 585,553. However, by following the proposed systematic approach to determine ROSI, it can be reduced to 146,388 which is comparatively low. As a result, organization can save its resources, time, money, trust, and reputation in the market.

Cyberattacks on Critical Infrastructure: an Economic Perspective

The aim of this article is to analyze the economic aspects of cybersecurity of critical infrastructure defined as physical or virtual systems and assets that are vital to a country’s functioning and whose incapacitation or destruction would have a debilitating impact on national, economic, military and public security. The functioning of modern states, firms and individuals increasingly relies on digital or cyber technologies and this trend has also materialized in various facets of critical infrastructure. Critical infrastructure presents a new cybersecurity area of attacks and threats that requires the attention of regulators and service providers. Deploying critical infrastructure systems without suitable cybersecurity might make them vulnerable to intrinsic failures or malicious attacks and result in serious negative consequences. In this article a fuller view of costs and losses associated with cyberattacks that includes both private and external (social) costs is proposed. An application of the cost-benefit analysis or the Return on Security Investment (ROSI) indicator is presented to evaluate the worthiness of cybersecurity efforts and analyze the costs associated with some major cyberattacks in recent years. The “Identify, Protect, Detect, Respond and Recover” (IPDRR) framework of organizing cybersecurity efforts is also proposed as well as an illustration as to how the blockchain technology could be utilized to improve security and efficiency within a critical infrastructure.

Economics of Information Security Investment Integrated with IDS and Attacker’s Behavior

ROSI (Return On Security Investment) has attracted a great deal of attention in recent years. By inheriting Gordon and Loeb 2002 security breach probability function, we present an adaptive economics model of investment in information security integrating dynamic characteristics of outside threat probability and detective mechanism, and deduce some guidelines for optimal investment amount.

An approach to finding the cost-effective immunization targets for information assurance

Information assurance is increasing in importance as threats abound in the highly connected world of e-business. For enterprises, the goal is to achieve a secure information environment in a cost-effective manner. This paper focuses on the issue of how to cost-effectively immunize an enterprise's network to prevent threats (e.g., virus, rumor) from invading and spreading. An approach, namely Cost-Effective Immunization Targets (CEIT) is proposed as a means to identify the cost-effective immunization targets and provide direct cost/benefit trade-off solutions for practitioners. In the approach, a novel concept, savability, is introduced as an extension of return on security investment (ROSI), with the reduced expected infection probability as mitigated risks through immunization. Meanwhile, a bond percolation process, which can be done in just a single graph traversal, is incorporated to simplify the estimation of expected infection probability in place of repeated diffusion simulations. Theoretical analysis proves that the proposed approach can approximate the optimal solutions within a definite lower bound. Finally, experiments on real-world information network datasets reveal that the algorithm CEIT outperforms other immunization strategies in both homogeneous and heterogeneous cost cases. Further, a case study indicates that the CEIT-identified immunization targets are more likely to ‘save’ the important nodes with high potential infection loss, avoiding redundant immunization.

Forecasting for Return on Security Information Investment: New Approach on Trends in Intrusion Detection and Unwanted Internet Traffic

The methods used to determine the return on security investment (ROSI) concern historic incidents' analysis, cost avoidance resulting from resistance, recognition and reconstitution efforts. Although some ROSI methods consider security incidents' likelihood, they don't approach studies about forecasts and trends of incidents or unwanted events. Likewise other sciences (seismology, meteorology, vulcanology, and economics) in which extent efforts are done for forecasts, information technology and information security may analyze tendencies, as Internet traffic and intrusion detection trends. The aim of this paper is to show a forecasting approach which could be aggregated to common ROSI methods. In this study, forecasting approach is based on two trend techniques: moving averages and Fibonacci sequence - for security incidents with intrusion detection system (IDS) and unwanted Internet traffic. Tests applied over two datasets (DARPA, KDD), with an IDS, showed that the employed techniques define incidents trends; therefore, forecasting approach may be complementary to ROSI methods.

What's the return on your security investment?

AbstractWhat's the return on your company's investment in security? Few companies provide an adequate picture of value for security and compliance— because they simply don't know how to measure or present it.It's time for companies to discover their return on security investment (ROSI), argues the author. Otherwise, security solutions will be only expensive bandages and not cost‐effective remedies. The author explains how to measure and apply ROSI in your company. © 2008 Wiley Periodicals, Inc.

Return on security investment – proving it's worth it

The pressure is mounting on security professionals to justify what they spend. But up to now proving return on investment has proved very tricky – and frustrating. Certain methods of demonstrating a return on investment - often termed return on security investment (ROSI) – have been advanced, but use remains limited. As a result, security projects are often justified on fear, uncertainty and doubt. Justifying investment can be problematic because information security often delivers non-financial benefits, rather than an increase in revenue or a reduction in costs. Also, there is a lack of clear guidance about calculating the financial benefits of information security activities – not to mention the fact that security professionals usually don't have a financial background. Before reviewing some key purchasing trends, we take a look at a fresh approach, backed by many global corporations, to getting ROSI on track. In today's business environment, security professionals are increasingly under pressure to justify the investments made in information security by their organisations. Various methods of demonstrating a return on investment – often termed return on security investment (ROSI) – have been advanced, but use remains limited. As a result, security projects are often justified on fear, uncertainty and doubt.

The effect of intrusion detection management methods on the return on investment

This paper examines how implementation methods, management methods, and Intrusion Detection System (IDS) policy affect Return on Investment (ROI). The paper will seek to demonstrate the value associated with a well thought out implementation and effective lifecycle management of IDS technology and will culminate in a case study with a number crunching exercise to calculate the ROI for an IDS deployment by a hypothetical financial company named UTVE, Inc. on risk. The paper also discusses general IDS types and expands on the impact that the logical location of a company's critical networked assets could have on the risk equations. To this end, the Cascading Threat Multiplier (CTM) is introduced to expand on the Single Loss Expectancy (SLE) equation. Also, implementation and management costs based on various support profiles and commonly accepted risk equations are reviewed. Finally, a formula for calculating ROI for security, otherwise commonly known as Return on Security Investment (ROSI) is devised.