FINANCIAL ASPECTS OF INFORMATION SECURITY INVESTMENTS

FINANCIAL ASPECTS OF INFORMATION SECURITY INVESTMENTS

Information security - the safeguarding of computer systems and the integrity, Confidentiality, and availability of the data they contain - has long been recognized as a critical issue. Two current trends indicate that its importance is growing.

First, the integration of computers into more and more aspects of modern life continues. Second, cyber-attacks, or breaches of information security, appear to be increasing in frequency, and few observers are willing to ignore the possibility that future attacks could have much more severe consequences than what has been observed to date.

The core issue, in all types of organizations, is whether we devote enough resources to information security Part of the answer must come from Financial analysis. What are the Costs  of security breaches? How frequently can attacks be expected? Can these factors be quantified precisely, so that business firms and their Boards can determine the optimal amount to spend on information security and measure the effectiveness of that spending?

Financial analysis

1.      Return due to investment in security

Return  is expressed as the net gain divided by the investment.

In the simplest of terms:

(TOTAL AMOUNT GAINED)−(AMOUNT invested)/( AMOUNT invested)

2.      annual loss expectancy

Annual Loss expectancy is expressed in the following form:

Sum of (Harmful outcomes x Impact in Rs. or $ x Frequency of outcome)

We calculate the Loss expectancy with Security controls and Annual loss without security controls in place.

3.      TOTAL AMOUNT GAINED = benefit = sum of annual loss expectancy

 = annual loss expectancy without sec control− annual loss expectancy with sec control

In addition, there are other parameters which can be calculated and presented to the board to justify the financial needs for Information security investments.

The above article has been written by Mr Anil Oberai, who is an IT Consultant. He has over 2 decades of experience specializing in areas of Information Security, Project Management, and Process Excellence. You may contact him through his Mob+91-9899124880 (New Delhi) or visit his website https://aniloberai.blogspot.in/