The "RISKY BUSINESS" Blog

When I first became an Information Security Auditor I was inspired by the “rightness” of the mythical concept of “Return on Security Investment” (ROSI). Quantitative Risk Assessment drives risk quantification which drives controls that reduce risk by a quantifiable amount making a return on security investment calculable and the world is right.

Fast forward to today. Calculating ROSI is something I haven’t attempted in years, and I will admit to being jaded about Information Technology/Security Risk Assessments. We have tried tool based approaches, NIST 800-30, Octave, Octave-S, our own, and customer proprietary methodologies; all with limited success. I’m not suggesting that the fundamental concept of understanding risks is not important to determining which controls are most critical, rather, we (as a community) have not figured out the right way to understand/qualify/quantify/communicate our risks.

At this point Risk Assessments are a lot like a bikini; “What they reveal is suggestive, but what they conceal is vital”. Worse, it’s easy (and common) to make what they reveal what you want them to reveal.

With the growing acceptance of ISO27001 (something that I believe will be good in the long run) Risk Assessment is once again front and center, as it is integral to the ISO27001 Information Security Management System (ISMS). I suspect that there will be renewed focus on improving prevailing methodologies to make them easier to leverage and yield more consistent/standardized results across different organizations.

Interesting, and concurrently, the growing trend towards government involvement and litigation relating to Identity Theft (http://wistechnology.com/articles/5446/) (http://www.ftc.gov/opa/2009/02/compgeeks.shtm) makes risk relating to Personally Identifiable Information (PII) disclosure notably higher. This has the effect of making it easier to rationalize security investment. Another data point supporting this thought is the most recent Ponemon Institute “Annual Cost of a Data Breach Study”.

At $202 per name for a PII Data Breach, the risk associated with inadvertent disclosure of a half-million names makes it easy to demonstrate a ROSI for a Security Certification & Accreditation program. Oddly, this both reduces the need for, and increases the importance of, Risk Assessment at the same time. Life never gets boring …