3 ms·

For your second point: That line of reasoning has traditionally resulted in underfunding of security. It’s also quite impossible in practice. Say that you kno

For your second point: That line of reasoning has traditionally resulted in underfunding of security. It’s also quite impossible in practice. Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You can make educated guesses in both cases, but they are still strictly in the realm of the hypothetical.

jollyllama 2y ago
>For your second point: That line of reasoning has traditionally resulted in underfunding of security. Underfunding relative to what? Another example I'd cite would be the TSA. How much do we pay it now vs how much would we lose based on what they've truly stopped? >Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You could estimate at an order of magnitude based on the level of access of the user and a model of your infrastructure. For example, if only one machine is compromised, you could estimate order of magnitude based on the value of the data lost, the floor being set at the days of work lost * hourly rate of the user.
- watwut 2y ago
  Underfunding in the sense that extremely preventable real world hacks and breaches happened, with loss of customer private data. And underfunding because those companies had documented IT asking to be allowed to do exactly things that would prevent the attack. If you want proof that real world attack would be stopped by measure, then you will leave the system vulnerable to everything your internal people were not able to exploit.

jollyllama 2y ago

>For your second point: That line of reasoning has traditionally resulted in underfunding of security. Underfunding relative to what? Another example I'd cite would be the TSA. How much do we pay it now vs how much would we lose based on what they've truly stopped? >Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You could estimate at an order of magnitude based on the level of access of the user and a model of your infrastructure. For example, if only one machine is compromised, you could estimate order of magnitude based on the value of the data lost, the floor being set at the days of work lost * hourly rate of the user.

watwut 2y ago
Underfunding in the sense that extremely preventable real world hacks and breaches happened, with loss of customer private data. And underfunding because those companies had documented IT asking to be allowed to do exactly things that would prevent the attack. If you want proof that real world attack would be stopped by measure, then you will leave the system vulnerable to everything your internal people were not able to exploit.