In my recent columns, I have been reviewing the book _Managing Cyber-Security Resources: A Cost-Benefit Analysis_ by Lawrence A. Gordon & Martin P. Loeb.

Chapter 4 is entitled “The Right Amount to Spend on Cyber Security” and introduces the highly controversial ALE, which stands for either “annual loss expectancy” or “annualized loss expectancy” depending on the user.

The ALE begins by computing the product c-sub-i*p-sub-i for each expenditure i where c is the cost and p is the probability that the expense will occur in a one-year period. By summing these products, one can develop a model showing the average expected gains and losses from different security strategies. ALE computations are the basis for actuarial calculations in the insurance industry; they allow insurers to set premiums as a function of both potential loss and expected probabilities of loss (and the converse, the expected probability that there will be no loss and therefore a profit for the insurer).

Chapter 4 of this text is one of the best and most detailed descriptions of ALE computations that I have seen. There are many examples, tables and figures to help readers grasp and master this quantitative method. The chapter also briefly discusses outsourcing cyber security.

Chapter 5 of the text is “Risk Management and Cybersecurity.” The authors present some simple approaches to dealing with uncertainty as discussed above and they extend the review to encompass risk aversion or risk tolerance in the organization.

This chapter logically flows straight into Chapter 6, “The Business Case for Cybersecurity,” which is one of the most valuable in the book. The authors present a systematic approach to developing a business case for presenting proposed IA plans to business colleagues. Each of the following steps is explored in detail, and I think this chapter alone would be worth the price of the book:

1. Specify organizational cybersecurity objectives.
2. Identify alternatives for achieving cybersecurity objectives.
3. Acquire data and examine each alternative identified.
4. Conduct cost-benefit analysis and rank-order the alternatives identified.

They present a case study in detail in a way that will help any IA manager grasp and apply the principles they are teaching.

M. E. Kabay, PhD, CISSP-ISSMP is Program Director of the Master of Science in Information Assurance at Norwich
University.