Return On Security Investment (ROSI)

The Return On Secu­rity Investment

Making the case for a com­pany to include var­i­ous com­puter secu­rity mea­sures can be a dif­fi­cult task. There are many rea­sons for this; pri­mary among them are the dif­fi­culty to gauge any finan­cial losses caused by secu­rity breaches and the ephemeral nature of many ben­e­fits of secu­rity sys­tems on a company’s com­puter net­work. IT staff who seek to have dif­fer­ent types of secu­rity pro­to­cols put into use within a com­pany, then, often face an uphill bat­tle in demon­strat­ing their neces­sity. In these sorts of cases, using a Return On Secu­rity Invest­ment cal­cu­la­tion can be the most effec­tive way of mea­sur­ing and deter­min­ing exist­ing secu­rity mea­sures, and the poten­tial need for addi­tional ones.

Put sim­ply, a Return On Secu­rity Invest­ment cal­cu­la­tion is a tra­di­tional ROI (Return On Invest­ment) equa­tion that applies specif­i­cally to secu­rity invest­ments. Thus, ROSI stands for Return On Secu­rity Invest­ment. A Return On Secu­rity Invest­ment equa­tion can be used to quan­tify the fea­si­bil­ity — and the advis­abil­ity — of insti­tut­ing a par­tic­u­lar kind of secu­rity measure.

The Return On Secu­rity Invest­ment equa­tion is as follows:

Return On Secu­rity Invest­ment = (Risk Expo­sure * %Risk Mit­i­gated) — Solu­tion Cost / Solu­tion Cost. This equa­tion is, like any other, decep­tively sim­ple. The real­ity, though, is that deter­min­ing the parts that make it up can be extremely dif­fi­cult at best.

For exam­ple, let’s take a look at the “Risk Expo­sure” por­tion of the Return On Secu­rity Invest­ment equa­tion. In basic terms, this refers to the secu­rity breaches and risks that a company’s com­puter sys­tem might be exposed to. It can include things such as inten­tional attacks by hack­ers and the inad­ver­tent down­load of var­i­ous com­puter viruses, adware, spy­ware and other com­mon online pests. Unlike many risks con­sid­ered by a tra­di­tional ROI equa­tion, the risk expo­sure used in a Return On Secu­rity Invest­ment equa­tion is not a sta­tic entity. Rather, the risks that a company’s com­puter sys­tem faces can fluc­tu­ate weekly, daily — and even hourly.

At the same time, mea­sur­ing the per­cent­age of risk mit­i­gated by a secu­rity mea­sure is also dif­fi­cult. As this arti­cle will out­line, none of the com­po­nents of a Return On Secu­rity Invest­ment equa­tion are easy to deter­mine; even mea­sur­ing the cost of a secu­rity solu­tion can fall into many gray areas. How­ever, when care­ful con­sid­er­a­tion is used, a Return On Secu­rity Invest­ment equa­tion is still the best way for an orga­ni­za­tion to deter­mine their secu­rity needs and costs.

Cal­cu­lat­ing Or Mea­sur­ing Expo­sure To Risk

The first thing to deter­mine when work­ing out a Return On Secu­rity Invest­ment equa­tion is the risk expo­sure of the com­pany in ques­tion. What sorts of com­puter secu­rity risks is it rou­tinely exposed to? Fig­ur­ing that out — and trans­lat­ing it into finan­cial terms — can be cum­ber­some. One way of look­ing at this issue is to, for exam­ple, come up with a num­ber for the finan­cial losses incurred by a com­pany when­ever its com­puter net­work suf­fers from a virus or a hacker infiltration.

Assum­ing that the major types of these events have been duly recorded over a decent period of time, one could attempt to fig­ure out an aver­age yearly cost to the com­pany. For exam­ple, the IT pro­fes­sion­als within the busi­ness could look through records over a period of a year. As they peruse these records, they could note the major occur­rences of viruses and deter­mine a rough esti­mate for how fre­quently they tend to occur.

With this done, it is then nec­es­sary to fig­ure out how much money these events cost the com­pany on aver­age. And that is part of the prob­lem; one of these events might have cost the busi­ness approx­i­mately $100,000; the next clos­est virus might have cost closer to $45,000, and so on. With these num­bers, an aver­age cost can nat­u­rally be deter­mined, but the trou­ble lies in the fact that there is no real way to pre­dict when the next attack will occur — or how much it will ulti­mately cost a company.

We can turn to another com­mon equa­tion to quan­tify this risk expo­sure ele­ment in sim­ple terms. Fig­ur­ing out the Annual Loss Expo­sure (ALE) of a spe­cific secu­rity threat can be done by mul­ti­ply­ing the Sin­gle Loss Expo­sure (SLE) inflicted on a busi­ness by the Annual Rate of Occur­rence (ARO). Again, this equa­tion dras­ti­cally over­sim­pli­fies all of the com­po­nents and fac­tors that can come into play with the rather intan­gi­ble aspects of com­puter security.

Cal­cu­lat­ing Or Mea­sur­ing The Risk Mit­i­gated By A Secu­rity Measure

Once a risk expo­sure fig­ure has been agreed upon, we must move on to deter­min­ing the per­cent­age of that risk that is elim­i­nated — or mit­i­gated — by imple­ment­ing a par­tic­u­lar secu­rity mea­sure. In other words, imag­ine that a par­tic­u­lar virus costs a com­pany approx­i­mately $20,000 each time it strikes (Sin­gle Loss Expo­sure); assume that it occurs about five times per year (Annual Rate of Occur­rence). Its Annual Loss Expo­sure num­ber would, there­fore, be $100,000.

A com­pany can then attempt to deter­mine how many of those occur­rences will be pre­vented or thwarted by the secu­rity mea­sure they are inter­ested in imple­ment­ing. This can often be gauged by research­ing pre­vi­ously pub­lished results from other orga­ni­za­tions against sim­i­lar secu­rity threats. How­ever, since the secu­rity mea­sure might also pre­vent risks or attacks that pre­vi­ously went unde­tected, it can be dif­fi­cult to pin­point its pre­cise effectiveness.

For the sake of sim­plic­ity, though, let us assume that the secu­rity mea­sure in ques­tion is thought to pre­vent about 80% of all attacks — or four out of five. There­fore, if it works as it is sup­posed to, $80,000 in losses will be pre­vented or mit­i­gated — 80%. This model nat­u­rally only works if the secu­rity threat in ques­tion can be eas­ily quan­ti­fied, which they sel­dom are.

In addi­tion to the pre­ven­tion of known threats, a secu­rity mea­sure might also increase pro­duc­tiv­ity — and save money — in other ways. Pre­ex­ist­ing prob­lems can some­times be elim­i­nated by the imple­men­ta­tion of a secu­rity mea­sure. Where pos­si­ble, IT per­son­nel should attempt to gauge this effect by sur­vey­ing employ­ees as to the speed of their com­puter expe­ri­ence before and after imple­men­ta­tion. This can improve the accu­racy of the per­cent­age of risk mit­i­gated in order to achieve more accu­rate results going forward.

Cal­cu­lat­ing Or Mea­sur­ing The Cost Of A Return On Secu­rity Investment Solution

The final com­po­nent of the Return On Secu­rity Invest­ment (ROSI) equa­tion is the cost of imple­ment­ing a solu­tion to the secu­rity threat. It can be tempt­ing to cal­cu­late this amount by sim­ply look­ing at the sticker price of the solu­tion as seen upon pur­chas­ing it. How­ever, a lot more nat­u­rally goes in to deter­min­ing the actual cost of a solu­tion in terms of a Return On Secu­rity Investment equation.

In some cases, imple­ment­ing a secu­rity solu­tion can actu­ally decrease the pro­duc­tiv­ity of an organization’s employ­ees. This some­times hap­pens because the adher­ence to new secu­rity mea­sures forces employ­ees to jump through many more hoops than they had to in the past; in other words, increased secu­rity often trans­lates into a loss of ease and con­ve­nience. IT per­son­nel can attempt to gauge this effect by deter­min­ing the aver­age time that it takes for var­i­ous employ­ees to accom­plish rou­tine tasks, before the imple­men­ta­tion. After the mea­sure has been in place for a spell, IT per­son­nel can recal­cu­late the time frame for these same employ­ees and their tasks to see whether pro­duc­tiv­ity has been impacted.

On the flip side, though, a secu­rity mea­sure might actu­ally increase the pro­duc­tiv­ity of an organization’s staff. Obvi­ously, if repeated crashes and long down time are dra­mat­i­cally reduced due to the imple­men­ta­tion of a secu­rity mea­sure, then most employ­ees are likely to expe­ri­ence greater pro­duc­tiv­ity. Whether a mea­sure increases or decreases pro­duc­tiv­ity, though, must be deter­mined and taken into con­sid­er­a­tion along with its actual “sticker price”.

Let us assume that the cost of the secu­rity mea­sure to be used as a solu­tion for the risks dis­cussed pre­vi­ously is deter­mined to be $20,000. Turn­ing to our Return On Secu­rity Invest­ment equa­tion, we now have all of the num­bers nec­es­sary to cal­cu­late whether the secu­rity mea­sure is a cost effec­tive solu­tion for our busi­ness. We take the risk expo­sure of $100,000 and mul­ti­ply it by the per­cent­age of risk mit­i­gated of 80% to come to $80,000. We sub­tract the solu­tion cost of $20,000 from this num­ber to arrive at a total of $60,000. Using the equa­tion, we divide the $60,000 by the cost of the solution.

Upon suc­cess­fully com­plet­ing the Return On Secu­rity Invest­ment equa­tion, we can see that the solu­tion appears to be worth the invest­ment; the return on the invest­ment in this case is 300%. Obvi­ously, this is a very overly sim­pli­fied exam­ple that we use here in order to more clearly demon­strate how a ROSI equa­tion is meant to work. As dis­cussed through­out this arti­cle, there are many exten­u­at­ing cir­cum­stances that go into play in deter­min­ing the com­po­nents used to per­form a Return On Secu­rity Investment equation.

Under­stand­ing the fun­da­men­tals of the Return On Secu­rity Invest­ment equa­tion and using them to gauge whether or not a solu­tion is worth it finan­cially is the good way to pro­tect the prof­itabil­ity of an orga­ni­za­tion. IT per­son­nel who become com­fort­able with this con­cept and in explain­ing it to the man­age­ment of a com­pany can expe­ri­ence greater suc­cess in get­ting their point across. Over time, a Return On Secu­rity Invest­ment equa­tion can become a finely honed way of deftly assess­ing whether or not to imple­ment a par­tic­u­lar secu­rity measure.