Viewing posts from August, 2011
Determining Cost of Capital
Posted by: admin 13 years, 2 months ago
A key underlying premise in finance is the cost of capital. Information security professionals need to understand that investors can put their money into other stocks and bankers can loan their money to other borrowers. The reason they loan money to your company is to make a good return for the risks they are taking. The less the risk, the cheaper the money.
Information Security and Economic Profit
Posted by: admin 13 years, 3 months ago
This is the third in a series of blog posts (that I hope to be able to finish, because otherwise these first ones will seem stupid). My goal is to provide information security professionals a basis for discussing risks with business professionals - especially finance people - and to dispel some myths. In the first post, I discussed how businesses create value arguing that reducing risk increases value. In the second, I bitched about how I hated the term 'ROI', it's over-use in marketing and it's short-comings. While NPV is better, it too has some shortcomings, including the fact that it isn't a very good tool for ongoing evaluation. NPV basically states "According to these assumptions, this project should create value". However, it does not track the outcome nor can it easily be used as a basis for incentives.
Financial Analysis for InfoSec Pros
Posted by: admin 13 years, 3 months ago
This is the second in (hopefully) a series of blog posts. My goal is to provide information security professionals a basis for discussing risks with business professionals - especially finance people - and to dispel some myths. The first post discussed how reducing risk creates value. This goal of this post is to lay some groundwork for proper financial analysis techniques - or at least minimize the dumber ones.
How firms create value
Posted by: admin 13 years, 3 months ago
The first myth is that information security needs to contribute to the top line or to reduce costs to create value for an enterprise. This myth is based on the assumption that firms create value solely by increasing revenue or decreasing expenses. In particular, I'm picking on my friend Rafal Los at HP for his post on "Business Relevant Security - The Top and Bottom Lines" in which he states:
Recent Posts
- Blast-RADIUS attack
- The latest WiKID version includes an SBOM
- WiKID 6 is released!
- Log4j CVE-2021-44228
- Questions about 2FA for AD admins
Archive
2024
2022
- December (1)
2021
2019
2018
2017
2016
2015
2014
- December (2)
- November (3)
- October (3)
- September (5)
- August (4)
- July (5)
- June (5)
- May (2)
- April (2)
- March (2)
- February (3)
- January (1)
2013
2012
- December (1)
- November (1)
- October (5)
- September (1)
- August (1)
- June (2)
- May (2)
- April (1)
- March (2)
- February (3)
- January (1)
2011
2010
- December (2)
- November (3)
- October (3)
- September (4)
- August (1)
- July (1)
- June (3)
- May (3)
- April (1)
- March (1)
- February (6)
- January (3)
2009
- December (4)
- November (1)
- October (3)
- September (3)
- August (2)
- July (5)
- June (6)
- May (8)
- April (7)
- March (6)
- February (4)
- January (427)
2008
- December (1)
Categories
- PCI-DSS (2)
- Two-factor authentication (3)
Tags
- wireless-cellular-mobile-devices (7)
- Two-factor authentication (10)
- Wireless, cellular, mobile devices (6)
- NPS (1)
- Phishing and Fraud (111)
- Active Directory (1)
- pam-radius (3)
- privileged access (2)
- Cloud Security (10)
- Mutual Authentication (60)
- Web Application Authentication (1)
- Authentication Attacks (99)
- pci (50)
- Security and Economics (97)
- WiKID (133)
- pam (2)
- VPN (1)
- Installation (2)
- RADIUS Server (1)
- Open Source (64)
- Tutorial (2)
- Strong Authentication (35)
- Information Security (137)
- Transaction Authentication (13)
- Miscellaneous (100)
- Linux (2)
- transaction-authentication (6)
- Two Factor Authentication (254)