Why measuring what you protect is important?
Of course the psychological effects or physical harm cannot be thateasily quantified. My 5 year son is still shocked that someone tried to breakinto our neighbour's house, couple of months earlier. So security mechanisms atmy house is sort a trade-off considering the loss of tangibles and intangibles,and how much I am willing to spend.
Business security is much more complex, but very much similar topersonal security example quoted above. It should protect the organization, itsability to perform their mission and not just its IT assets. It shouldalso consider the factors like confidence loss and bad publicity, perception ofmarket, investors and all stakeholders. Finally is should also take intoconsideration the amount of money spent on security versus the value of assetsthat is being protected.
Any Risk Assessment activity starts with understanding and collectingsystem related information. The paper <link given below> from NISTelaborates on this activity. It classifies and gives details of the IT systemrelated information which can be collected. It also enumerates some techniquesto collect such information.
Another related activity is business impact analysis. It analyzes theimpact associated with the compromise of information assets based on aqualitative or quantitative assessment of the sensitivity and criticality ofthose assets. Identifying, classifying and associating a cost to theinformation helps to concentrate on realistic threats among the innumerablethreat perceptions. It would also help in deciding quantity of investment andany other tradeoffs which would be made with respect to security.
We automatically do risk assessment and impact analysis when it comes to our personal security,to ensure a comfort level. Organizations need to do the same but in amore systematic way. Only then, they will be sure on how much to spend on security and where to focus. It would also be a good beginning for measuring the Security Return on Investment (RoI).
Comments