{"id":561,"date":"2012-09-18T15:25:02","date_gmt":"2012-09-18T04:25:02","guid":{"rendered":"http:\/\/wonkothesane.com\/blog\/?p=561"},"modified":"2012-09-19T00:28:01","modified_gmt":"2012-09-18T13:28:01","slug":"optimising-security","status":"publish","type":"post","link":"https:\/\/wonkothesane.com\/blog\/2012\/09\/optimising-security\/","title":{"rendered":"Optimising Security"},"content":{"rendered":"

Way back at university when i was studying Aeronautical Engineering, we covered one of the fundamental concepts in aircraft design; Safety.\u00a0 It was summed up in an info-graphic which has stayed with me. In recent times, as I’ve moved over into IT security and up into solution architecture, I’ve been drawing on this educational background more and more. The analogous relationship between aircraft safety and IT security is safety = security.<\/p>\n

I’ve put together a series of diagrams to illustrate how this aircraft design concept applies to IT security.<\/p>\n

\"\"<\/a><\/p>\n

Firstly, the base concept; a cost vs security graph. The total cost to an organization being the union of two component cost categories. One, the cost of security measures implemented. Things like technology, people, processes, loss of agility, reduction in productivity. And secondly, the indirect costs due to all the security measures that have not been implemented. The lowest point in the total-cost curve is the optimum level of security that should be implemented.<\/p>\n

\"\"<\/a><\/p>\n

But of course, things are always changing. Technology improvements, smarter people and better processes all give you more security for your $. Also, security incidents start costing you more money(too many reasons to list here).\u00a0 As a result, the total cost curve will shift up and to the right.<\/p>\n

\"\"<\/a><\/p>\n

and things are not always as well understood as you’d like.\u00a0 The cost of security measures implemented is easy, but it’s not always certain how much security you’re actually getting.\u00a0 The indirect costs are even less well understood, often almost not at all.\u00a0 If you get the numbers wrong, and end up over the break even line, then you’re out of business or sacked.\u00a0 The safer choice is err on the side of being too secure, trading off efficiency or cost effectiveness.<\/p>\n

The takeaway is; you need good data and to know your two types of costs as well as possible.\u00a0 Qualitative data is nice for understanding the concepts, but completely useless in practice.<\/p>\n

If you aren’t moving towards finding your optimum security level, your competition most certainly is. That break-even line isn’t fixed either. It will start coming down.<\/p>\n

UPDATE: A common mistake i see is for organizations to underestimate their indirect costs (red line). They only factor in what they know, assuming zero contribution from the unknown indirect costs.\u00a0 Look for statistical data from other organizations to make an informed guess.\u00a0 Preferably including companies that have both survived and failed due to catastrophic events.\u00a0 Make sure the companies are comparable; industry, size, market. Be wary of vendors as a source of this info though. They are motivated to shift your security spend as far to the right as possible. That said, vendor data can be useful for the extreme\/worst case.<\/p>\n","protected":false},"excerpt":{"rendered":"

Way back at university when i was studying Aeronautical Engineering, we covered one of the fundamental concepts in aircraft design; Safety.\u00a0 It was summed up in an info-graphic which has stayed with me. In recent times, as I’ve moved over into IT security and up into solution architecture, I’ve been drawing on this educational background […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,18],"tags":[],"class_list":["post-561","post","type-post","status-publish","format-standard","hentry","category-career","category-security"],"_links":{"self":[{"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/posts\/561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/comments?post=561"}],"version-history":[{"count":14,"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/posts\/561\/revisions"}],"predecessor-version":[{"id":575,"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/posts\/561\/revisions\/575"}],"wp:attachment":[{"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/media?parent=561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/categories?post=561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wonkothesane.com\/blog\/wp-json\/wp\/v2\/tags?post=561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}