4 ms·

Interesting, although not particularly surprising, results there. I'm afraid that the InfoSec community has been unsucessfully persuing the idea of "RoI" for s

Interesting, although not particularly surprising, results there. I'm afraid that the InfoSec community has been unsucessfully persuing the idea of "RoI" for security activities for a long time (I remember debating the idea 10+ years ago..) Also the idea that increasing breaches would drive good practices seems not to have taken root that much, probably due to breach fatigue and the fact that most companies who are breached don't take any serious financial hit. Realistically the most likely way to improve this situation is for it to feature more heavily in contracts and perhaps regulations. Having a contractual requirement to carry out specific activities relating to code quality/security can drive them as there's a clear monetary cost of not doing so.

arcbyte 9y ago
If there isn't any financial hit, then there isn't any value in added security.
- raesene6 9y ago
  I said no serious financial hit, not no hit. Serious in terms of "the stock price went down significantly", there's still costs of breach clean up etc. Also there's a big negative externality in that a lot of the costs are borne by users of the app/system and not necessarily the developers, but due to a lack of liability for software development and security breaches that isn't taken into account by many companies
nickpsecurity 9y ago
"I'm afraid that the InfoSec community has been unsucessfully persuing the idea of "RoI" for security activities for a long time (I remember debating the idea 10+ years ago..)" I've always suggested they focus on confidence in control of assets and IT. The upper management are usually control freaks that like knowing what's happening is what they want to happen. A good, security program puts them in control of the businesses assets. A bad, security program puts a 14 yr old troll or competitor wanting their marketing/I.P. in control. A list of their asssets, esp those easy to move, next to the cost of a reasonable security program is next move. I'd love to see more data on attempts at doing this along with the responses. I know the scheme has already worked for people selling life insurance. I learned it from one of them. Might help on security since ROI is a dead end for most companies.

arcbyte 9y ago

If there isn't any financial hit, then there isn't any value in added security.

raesene6 9y ago
I said no serious financial hit, not no hit. Serious in terms of "the stock price went down significantly", there's still costs of breach clean up etc. Also there's a big negative externality in that a lot of the costs are borne by users of the app/system and not necessarily the developers, but due to a lack of liability for software development and security breaches that isn't taken into account by many companies

nickpsecurity 9y ago

"I'm afraid that the InfoSec community has been unsucessfully persuing the idea of "RoI" for security activities for a long time (I remember debating the idea 10+ years ago..)" I've always suggested they focus on confidence in control of assets and IT. The upper management are usually control freaks that like knowing what's happening is what they want to happen. A good, security program puts them in control of the businesses assets. A bad, security program puts a 14 yr old troll or competitor wanting their marketing/I.P. in control. A list of their asssets, esp those easy to move, next to the cost of a reasonable security program is next move. I'd love to see more data on attempts at doing this along with the responses. I know the scheme has already worked for people selling life insurance. I learned it from one of them. Might help on security since ROI is a dead end for most companies.