The WiKID Blog

Viewing posts tagged Security and Economics

schneier-questions-need-for-himself

Posted by: admin 12 years ago

I read with delight this quote from omnipresent security pundit Bruce Schneier questioning the reasons for the existance of the security industry:

"We shouldn't have to come and find a company to secure our e-mail. E-mail should already be secure. We shouldn't have to buy from somebody to secure our network or servers. Our networks and servers should already be secure."

infosec-and-the-affect-heuristic

Posted by: admin 12 years ago

Perhaps there is a lesson for infosec professionals in this post on the Affect heuristic on Overcoming Bias:

Suppose an airport must decide whether to spend money to purchase some new equipment, while critics argue that the money should be spent on other aspects of airport safety. Slovic et. al. (2002) presented two groups of subjects with the arguments for and against purchasing the equipment, with a response scale ranging from 0 (would not support at all) to 20 (very strong support). One group saw the measure described as saving 150 lives. The other group saw the measure described as saving 98% of 150 lives. The hypothesis motivating the experiment was that saving 150 lives sounds vaguely good - is that a lot? a little? - while saving 98% of something is clearly very good because 98% is so close to the upper bound of the percentage scale. Lo and behold, saving 150 lives had mean support of 10.4, while saving 98% of 150 lives had mean support of 13.6.

The post also shows that people tend to over-estimate the value of going with known brands, even though they might not add any extra value:

Ganzach (2001) found the same effect in the realm of finance. According to ordinary economic theory, return and risk should correlate positively - or to put it another way, people pay a premium price for safe investments, which lowers the return; stocks deliver higher returns than bonds, but have correspondingly greater risk. When judging familiar stocks, analysts' judgments of risks and returns were positively correlated, as conventionally predicted. But when judging unfamiliar stocks, analysts tended to judge the stocks as if they were generally good or generally bad - low risk and high returns, or high risk and low returns.

But perhaps you don't have time to consider all this, because you've got a deadline!

Finucane et. al. also found that time pressure greatly increased the inverse relationship between perceived risk and perceived benefit, consistent with the general finding that time pressure, poor information, or distraction all increase the dominance of perceptual heuristics over analytic deliberation.

risk-and-effectiveness-for-project-evaluation

Posted by: admin 12 years ago

Gunnar Peterson has a post from Metricon about Bryan Ware's presentation about combining the effectiveness of a solution and the risk involved. I couldn't find the link to the actualy presentation. (I didn't have the time to go through them all.)

I think I would tie the effectiveness of the proposed security solution to the cost of capital of the overall project. It would be interesting to tie Bryan's work with my "work" on estimating the cost of capital for an information security project.

response-to-responses-incentive-plans-for

Posted by: admin 12 years ago

My recent (assumption laden and simplistic) post on incentive plans for an information security team was picked up by Adam and subsequently poked at by mordaxus and then piled on by Mike Rothman.

incentive-plan-for-an-information-security-team

Posted by: admin 12 years ago

It has occurred to me that you could develop an interesting incentive program for an information security team, assuming that you believe a couple of data points (or can come up with your own) and your primary concern is a data breach. In my opinion, security people are all too often incented only to maintain security - not to optimize the investment in security. Interests need to be aligned.

• Page 8 of 20
• ←
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• →