3 ms·
> The problem with security is that it’s impossible to measure your ROI Sometimes I wonder what we lost by only working on things with measurable impact
by OsrsNeedsf2P 2y ago
> The problem with security is that it’s impossible to measure your ROI
Sometimes I wonder what we lost by only working on things with measurable impact
- deleted 2y ago[deleted]
- tlb 2y agoThe ROI of security is too noisy at a single company where you (hopefully) get less than one incident per year. But across the industry there is enough data to estimate ROI of various procedures.
- deleted 2y ago[deleted]
- esafak 2y agoYou can estimate: https://www.wiley.com/en-us/How+to+Measure+Anything+in+Cybersecurity+Risk%2C+2nd+Edition-p-9781119892304 https://www.wiley.com/en-us/How+to+Measure+Anything+in+Cyber... It's just that it is not the norm, so expectations are low. Some companies consistently do better than others, so clearly it's not all down to luck.
- andruby 2y agoThere's an actual name for this fallacy: https://en.wikipedia.org/wiki/McNamara_fallacy https://en.wikipedia.org/wiki/McNamara_fallacy > The McNamara fallacy (also known as the quantitative fallacy),[1] named for Robert McNamara, the US Secretary of Defense from 1961 to 1968, involves making a decision based solely on quantitative observations (or metrics) and ignoring all others. Which had a profound effect on the Vietnam War I agree, by the way, we shouldn't focus only on measurable metrics. Humans, and businesses should also value "norms and values". Although I have no idea how to evangelise this