Failure of Investment
Recently, a lot of attention was given to an off the cuff comment by Jack Daniel in response to a Return On Investment (ROI) conversation via Twitter - "The only viable measurement in security is failure." The reason that this comment got so much traction is that it is a new way of thinking through your security scheme.
The newest topic seems to be "Is Penetration Testing dead?" - The answer is not straightforward and may need FOI to give some much needed clarity.
First there was ROI...
Will I Make A Profit?
Return On Investment is a valuable metric to the IT industry (as well as business community) as a whole. It answers the question "If I buy this thing, will I make money in the end?"
The Idea is that if you purchase something, it should at least earn you an equal amount of money back that you spent and can probably earn you more. This should also happen in a reasonable amount of time. For example, if you need to buy a firewall, it will help to know what that firewall will be doing. You can then calculate - "If I buy a firewall for $d then in t (weeks, months or years), I will see a return on my investment and everything earned beyond t is profit" At that point, It will have paid for itself (or you can use it in reverse to say that you shouldn't buy something because the ROI is either at a loss or too slow). This makes a lot of sense when you need to make sure your boss looks good when doing the budget ;)
Then There Was TCO...
How Much Will It Cost?
Total Cost Of Ownership (TCO) came into play during the original converstation. TCO is a predictive metric that tries to take into account everything that must be spend for something to be invested upon through its life.
For instance, the firewall that my boss needs, he won't look good if I google "cheap firewall" and then tell him that the firewall will cost $100 (it's a really cheap firewall). I will need to take into account the cost of software, hardware that is not included, any monthly fees, my bonus for making him look good and ANYTHING else conceivable. This is the Total Cost of Ownership. That firewall is not making my boss look good :(
Then there was FOI...
What is lssass.exe?
Before I begin, Jack had an accessory after the fact, namely Andy, IT Guy. Andy, helped Jack by really defining FOI.
FOI is even easier to define than ROI and TCO, but harder to inject into a real life scenario. FOI is not a predictive measurement, but is a mantra that can be used to make sure you are taking due care to ensure things are working as they should.
If something is allowed to fail, then the investment was not worth it in the beginning. (What do you expect from a $100 firewall?) One of the tenets of FOI is if something does fail and funds are either spent or lost as a result, then it better not happen again.
As far a security is concerned, if I have a security device, and it fails then something is compromised, even if you haven't found it yet. We now need to find and fix what happened. This will take time, salary dollars and you may need to hire outsiders, not to mention that you may have lost some revenue by an outage or data leak already. This is where FOI kicks in.
Something has failed, my boss is angry. He says "This is bad, we are stuck in this investment thanks to you. Will it happen again?" My answer is, of course, no. It is now a much higher priority of mine to keep that firewall from failing.
This is the essense of the argument. Why was it such a low priority and allowed to fail in the first place. There are many answers that I won't get in to. Although the "it's not my fault" argument may be valid (but it won't save your job, necessarily) if the vendor failed to notify or patch an existing known vulnerability. So, vendors, watch out there.
Hope these three metrics shine some light on what to do with your IT budget and IT staff.
Tim
Posted on 8:44 PM by Tim Cronin and filed under
FOI,
Metrics
| 42 Comments »
The newest topic seems to be "Is Penetration Testing dead?" - The answer is not straightforward and may need FOI to give some much needed clarity.
First there was ROI...
Will I Make A Profit?
Return On Investment is a valuable metric to the IT industry (as well as business community) as a whole. It answers the question "If I buy this thing, will I make money in the end?"
The Idea is that if you purchase something, it should at least earn you an equal amount of money back that you spent and can probably earn you more. This should also happen in a reasonable amount of time. For example, if you need to buy a firewall, it will help to know what that firewall will be doing. You can then calculate - "If I buy a firewall for $d then in t (weeks, months or years), I will see a return on my investment and everything earned beyond t is profit" At that point, It will have paid for itself (or you can use it in reverse to say that you shouldn't buy something because the ROI is either at a loss or too slow). This makes a lot of sense when you need to make sure your boss looks good when doing the budget ;)
Then There Was TCO...
How Much Will It Cost?
Total Cost Of Ownership (TCO) came into play during the original converstation. TCO is a predictive metric that tries to take into account everything that must be spend for something to be invested upon through its life.
For instance, the firewall that my boss needs, he won't look good if I google "cheap firewall" and then tell him that the firewall will cost $100 (it's a really cheap firewall). I will need to take into account the cost of software, hardware that is not included, any monthly fees, my bonus for making him look good and ANYTHING else conceivable. This is the Total Cost of Ownership. That firewall is not making my boss look good :(
Then there was FOI...
What is lssass.exe?
Before I begin, Jack had an accessory after the fact, namely Andy, IT Guy. Andy, helped Jack by really defining FOI.
FOI is even easier to define than ROI and TCO, but harder to inject into a real life scenario. FOI is not a predictive measurement, but is a mantra that can be used to make sure you are taking due care to ensure things are working as they should.
If something is allowed to fail, then the investment was not worth it in the beginning. (What do you expect from a $100 firewall?) One of the tenets of FOI is if something does fail and funds are either spent or lost as a result, then it better not happen again.
As far a security is concerned, if I have a security device, and it fails then something is compromised, even if you haven't found it yet. We now need to find and fix what happened. This will take time, salary dollars and you may need to hire outsiders, not to mention that you may have lost some revenue by an outage or data leak already. This is where FOI kicks in.
Something has failed, my boss is angry. He says "This is bad, we are stuck in this investment thanks to you. Will it happen again?" My answer is, of course, no. It is now a much higher priority of mine to keep that firewall from failing.
This is the essense of the argument. Why was it such a low priority and allowed to fail in the first place. There are many answers that I won't get in to. Although the "it's not my fault" argument may be valid (but it won't save your job, necessarily) if the vendor failed to notify or patch an existing known vulnerability. So, vendors, watch out there.
Hope these three metrics shine some light on what to do with your IT budget and IT staff.
Tim
Posts
42 comments:
Hello !.
might , probably very interested to know how one can reach 2000 per day of income .
There is no initial capital needed You may start to receive yields with as small sum of money as 20-100 dollars.
AimTrust is what you thought of all the time
The company incorporates an offshore structure with advanced asset management technologies in production and delivery of pipes for oil and gas.
Its head office is in Panama with structures around the world.
Do you want to become really rich in short time?
That`s your chance That`s what you desire!
I`m happy and lucky, I started to take up real money with the help of this company,
and I invite you to do the same. If it gets down to select a proper partner utilizes your savings in a right way - that`s the AimTrust!.
I earn US$2,000 per day, and my first investment was 500 dollars only!
It`s easy to join , just click this link http://iqokoboge.freecities.com/baqozugu.html
and lucky you`re! Let`s take this option together to become rich
Hi !.
You re, I guess , probably curious to know how one can make real money .
There is no initial capital needed You may commense to get income with as small sum of money as 20-100 dollars.
AimTrust is what you thought of all the time
The company represents an offshore structure with advanced asset management technologies in production and delivery of pipes for oil and gas.
It is based in Panama with affiliates everywhere: In USA, Canada, Cyprus.
Do you want to become a happy investor?
That`s your choice That`s what you really need!
I feel good, I started to get income with the help of this company,
and I invite you to do the same. It`s all about how to choose a proper companion utilizes your money in a right way - that`s AimTrust!.
I take now up to 2G every day, and my first investment was 500 dollars only!
It`s easy to join , just click this link http://pimidydamy.virtue.nu/ojufim.html
and go! Let`s take this option together to feel the smell of real money
Good day, sun shines!
There have been times of troubles when I didn't know about opportunities of getting high yields on investments. I was a dump and downright pessimistic person.
I have never thought that there weren't any need in big initial investment.
Nowadays, I'm happy and lucky , I begin to get real money.
It gets down to select a proper companion who utilizes your funds in a right way - that is incorporate it in real business, parts and divides the profit with me.
You can get interested, if there are such firms? I have to answer the truth, YES, there are. Please be informed of one of them:
http://theinvestblog.com [url=http://theinvestblog.com]Online Investment Blog[/url]
Glad to greet you, ladies and gentlemen!
For sure you didn’t here about me yet,
friends call me Peter.
Generally I’m a social gmabler. recently I take a great interest in online-casino and poker.
Not long time ago I started my own blog, where I describe my virtual adventures.
Probably, it will be interesting for you to read my notes.
Please visit my blog. http://allbestcasino.com I’ll be interested on your opinion..
Did he really deserve the treatment I was about to givehim. The reason Melvin was working out of town over theweekend was because his company had begun to feel a new pinch in thelocal economy.
free underage incest stories
stories xxx young men older women
naughtymom son bdsm stories
babysitting fuck stories
erotic young teen sex stories
Did he really deserve the treatment I was about to givehim. The reason Melvin was working out of town over theweekend was because his company had begun to feel a new pinch in thelocal economy.
Just popping in to say nice site.
Hey there! Do you know if they make any plugins to help with SEO?
I'm trying to get my blog to rank for some targeted keywords but I'm not
seeing very good success. If you know of any please share.
Many thanks!
My site: Same Day Loans 118
This piece of writing offers clear idea in favor of the new
users of blogging, that truly how to do blogging.
Here is my page - Cash Loans
Thank you for sharing your thoughts. I really appreciate
your efforts and I am waiting for your further post thanks once again.
My webpage :: homework.kaist.ac.kr
I want to to thank you for this fantastic read!! I certainly loved
every bit of it. I have you saved as a favorite to check out new
stuff you post…
My website: bayerncom.com
Hello There. I found your blog using msn. This is a really well written article.
I'll be sure to bookmark it and return to read more of your useful information. Thanks for the post. I will certainly comeback.
Look into my homepage - InstantCashLoan
A motivating discussion is worth comment. I do think that you
should publish more on this subject matter, it might not be a taboo matter but typically folks don't discuss these issues. To the next! Best wishes!!
Also visit my web-site ; FastCashLoans
Touche. Great arguments. Keep up the amazing effort.
Also see my web site - http://Online-abc.net/index.php?title=Benutzer:VirgilConc
This paragraph will assist the internet visitors for creating
new website or even a blog from start to end.
My web blog : fastloan
I’m not that much of a internet reader to
be honest but your sites really nice, keep it up! I'll go ahead and bookmark your website to come back later. All the best
My web-site Short Term loan
I am really enjoying the theme/design of your site. Do you
ever run into any web browser compatibility issues?
A few of my blog audience have complained about my blog not working correctly in Explorer but looks great in Firefox.
Do you have any advice to help fix this issue?
Also see my website :: justsmarternow.com
Ahaa, its nice discussion concerning this article here at
this website, I have read all that, so at this time me also commenting here.
Stop by my web page www.Whatisinapressrelease.com
Pretty! This has been a really wonderful post.
Many thanks for providing this info.
Feel free to visit my web blog ; bukadrivision.com
dating circumcision http://loveepicentre.com/success_stories.php tattoo online dating
[url=http://loveepicentre.com/][img]http://loveepicentre.com/uploades/photos/6.jpg[/img][/url]
imdian dating sites [url=http://loveepicentre.com/articles.php]adult dating galway[/url] free dating site in egypt
100 free submissive men dating [url=http://loveepicentre.com/faq.php]southwest louisiana dating[/url] christian dating numbers
popular dating site with instant messenger [url=http://loveepicentre.com]dating place mountain view ca[/url] cool opening ines on dating sites
Как знаток, могу оказать помощь. Я специально зарегистрировался, воеже поучаствовать в обсуждении. [url=http://tutledy.ru/muzhchiny-i-lyubov.html]мужчина и любовь[/url]
[url=http://loveepicentre.com/map.php][img]http://loveepicentre.com/uploades/photos/12.jpg[/img][/url]
frederique van de wal is dating [url=http://loveepicentre.com/testimonials.php]miley cyrus dating justin[/url] san francisco girls dating tonight
free christian dating site 20 [url=http://loveepicentre.com/testimonials.php]nudists dating sites[/url] is reid rosenthal dating kristen dalton
dating websites for men seeking women [url=http://loveepicentre.com/articles.php]black dating single site web[/url] online dating single
[url=http://loveepicentre.com/testimonials.php][img]http://loveepicentre.com/uploades/photos/4.jpg[/img][/url]
dating dating dates [url=http://loveepicentre.com/]dating sites nc[/url] sexfun dating site
christisn singles dating [url=http://loveepicentre.com/advice.php]gay online dating[/url] steryotypes in a dating relationship
advice dating english single [url=http://loveepicentre.com/success_stories.php]new dating site 2009[/url] abilene singles dating email
song guitar ebook http://audiobookscollection.co.uk/de/Python/c3081/ jasper kent ebook [url=http://audiobookscollection.co.uk/Jos-Marcos-Moreno-Vega/m67371/]w e b griffin ebook[/url] wizard's first ebook
submitting ebook to kindle http://audiobookscollection.co.uk/21-Secrets-of-Millionaires/p12093/ call center ebook free romance ebook downloads travel trips ebook
the revolution in horsemanship ebook http://audiobooksplanet.co.uk/authors/?letter=Fo&page=4 download ebook gratis [url=http://audiobooksplanet.co.uk/Warning-Psychiatry-Can-Be-Hazardous-to-Your-Mental-Health/p196052/]ebook free 2009 jelsoft enterprises ltd[/url] indiana ebook project
ebook readers double page http://audiobooksworld.co.uk/Hour-Game/p29929/ ebook fish john christensen free download [url=http://audiobooksworld.co.uk/de/The-Future-of-Visual-Anthropology-Engaging-the-Senses/p188593/]sailing ebook torrent[/url] toenail fungus ebook
windows auto install software http://buysoftwareonline.co.uk/es/product-37184/Webpage-Maker-2-5 palm zire software update [url=http://buysoftwareonline.co.uk/es/category-100-103/Gr-ficas-y-publicaci-n?page=73]activecard gold software[/url] mentally impair software
[url=http://buysoftwareonline.co.uk/fr/category-2/Affaires]Affaires - Download OEM, Software Sale, OEM Software[/url] dvd slideshow vista software
[url=http://buysoftwareonline.co.uk/product-35922/Flowerfire-Sawmill-Enterprise-8-5-x64][img]http://buyoem.co.uk/image/6.gif[/img][/url]
Superb post however I was wondering if you could write a litte
more on this topic? I'd be very grateful if you could elaborate a little bit more. Many thanks!
Here is my webpage: Hawaii logo design and branding
[url=http://onlinemedistore.com/products/norvasc.htm][img]http://onlinemedistore.com/8.jpg[/img][/url]
executive pharmacy jobs http://onlinemedistore.com/products/evista.htm south dakota state board of pharmacy [url=http://onlinemedistore.com/products/aleve.htm]homeopathic pharmacy wisconsin[/url]
cvs pharmacy milton nj http://onlinemedistore.com/products/neurontin.htm common pharmacy abbreviations [url=http://onlinemedistore.com/products/viagra-super-active-plus.htm]viagra super active plus[/url]
washington state pharmacy association http://onlinemedistore.com/products/metformin.htm pharmacys in mexico [url=http://onlinemedistore.com/products/rogaine-5-.htm]minnesota state pharmacy board[/url]
discount lipitor pharmacy purchase http://onlinemedistore.com/products/tadacip.htm oxygen north carolina board of pharmacy [url=http://onlinemedistore.com/products/brahmi.htm]brahmi[/url]
g8z2l1755
Here is my page Easy Payday Loans
There is significantly surprise this particular simply just released sorts are listed below: uggs estimates boots
or shoes mayfair " booties " girls java Highkoo Microsof corporation 5450 fight-style exceptional.
ì (IE: sand, chestnut, chocolate, black) UGG boots.
Delicately wipe it using a damp material, will not likely brush it fiercely that features
a brush, don't melt away these comfortable shoes with boiled water, and don't
use washing detergent and alkaline cleaning fluid to completely
clean it on the same time.
Have a look at my homepage: コーチ 財布
What's up, its good post on the topic of media print, we all be aware of media is a great source of data.
My website: レイバンサングラス
Touche. Solid arguments. Keep up the great work.
Also visit my web-site; wiki-paesaggio.arc.uniroma1.it
Hey there! Would you mind if I share your blog with my myspace group?
There's a lot of people that I think would really enjoy your content. Please let me know. Thank you
My web blog: followers on twitter without following
Hello there, I do believe your website may be having
internet browser compatibility issues. When I look at your website in Safari,
it looks fine however, when opening in I.E.
, it has some overlapping issues. I simply wanted to give you a quick heads up!
Apart from that, wonderful website!
Have a look at my web page ... クロエバッグ
Good day! I could have sworn I've been to this blog before but after browsing through some of the post I realized it's new to me.
Anyhow, I'm definitely delighted I found it and I'll be book-marking and checking back often!
Here is my homepage :: コーチ オンライン
I quite like reading a post that will make men and women think.
Also, many thanks for allowing me to comment!
Check out my blog - christian louboutin shoes
whoah this blog is excellent i like reading your articles.
Keep up the good work! You realize, many people are looking round for this info, you
can help them greatly.
Feel free to visit my webpage: oakley サングラス
Hello there, You've done a fantastic job. I will certainly digg it and personally suggest to my friends. I am sure they'll be
benefited from this web site.
Also visit my web page :: レイバン 通販
Ι simply couldn't go away your website before suggesting that I actually loved the usual info a person supply in your visitors? Is gonna be back ceaselessly in order to investigate cross-check new posts
My weblog reputation management
I ѵіsіted many web sіtes but
the audio quality foг audio songs ρreѕent at this website
iѕ in fасt ωοnderful.
Hаνe a lοοk at my ωеb site - Lloyd Irvin
Post a Comment