In my recent columns, I have been reviewing the book _Managing Cyber-Security Resources: A Cost-Benefit Analysis_ by Lawrence A. Gordon & Martin P. Loeb.
Chapter 4 is entitled “The Right Amount to Spend on Cyber Security” and introduces the highly controversial ALE, which stands for either “annual loss expectancy” or “annualized loss expectancy” depending on the user.
The ALE begins by computing the product c-sub-i*p-sub-i for each expenditure i where c is the cost and p is the probability that the expense will occur in a one-year period. By summing these products, one can develop a model showing the average expected gains and losses from different security strategies. ALE computations are the basis for actuarial calculations in the insurance industry; they allow insurers to set premiums as a function of both potential loss and expected probabilities of loss (and the converse, the expected probability that there will be no loss and therefore a profit for the insurer).
Chapter 4 of this text is one of the best and most detailed descriptions of ALE computations that I have seen. There are many examples, tables and figures to help readers grasp and master this quantitative method. The chapter also briefly discusses outsourcing cyber security.
Chapter 5 of the text is “Risk Management and Cybersecurity.” The authors present some simple approaches to dealing with uncertainty as discussed above and they extend the review to encompass risk aversion or risk tolerance in the organization.
This chapter logically flows straight into Chapter 6, “The Business Case for Cybersecurity,” which is one of the most valuable in the book. The authors present a systematic approach to developing a business case for presenting proposed IA plans to business colleagues. Each of the following steps is explored in detail, and I think this chapter alone would be worth the price of the book:
1. Specify organizational cybersecurity objectives.
2. Identify alternatives for achieving cybersecurity objectives.
3. Acquire data and examine each alternative identified.
4. Conduct cost-benefit analysis and rank-order the alternatives identified.
They present a case study in detail in a way that will help any IA manager grasp and apply the principles they are teaching.
Chapter 7, “Cybersecurity Auditing,” and Chapter 8, “Cybersecurity’s Role in National Security,” are both well-written and useful as the book draws to a close. The authors conclude with a brief chapter of interesting pointers that draw on their professional experience and wisdom.
I thank Prof. Gordon for having personally sent me an autographed copy of this textbook. I thoroughly enjoyed reading it and am considering it for inclusion in the curriculum of my own security-management courses.
* * *
Readers and instructors interested in this subject matter may wish to read a little article from several years ago called “The Net Present Value of Information Security” that discusses how IA can be more than just loss-avoidance. Another resource you might like bears on the problem of uncertainty about computer-security statistics: “Understanding Computer Crime Studies and Statistics v4.”
Finally, you might be able to use the PowerPoint lecture notes on risk assessment and risk management from my “IS342 Management of IA” course.