“Economics of IT Security Management”

1) The article questions the loss estimate obtained from CSI/FBI security surveys since they exclude some categories of costs associated with security breaches. It suggests that cost estimate based on the loss in capital markets as a result of a breach in security may be a proxy to estimate true cost of security breaches.

a. What do you think about the quality of this cost estimate? Can you think of better ways to capture true cost of security breaches?

Although I can see the benefit to utilizing capital market losses as a basis for estimating the true costs of a security breach because it attempts to capture the intangible costs of a breach, there is a great deal of uncertainty in the market and market share may go up or down as much based on the public perception of company’s ability to handle the situation as the damage done by the event itself.

Additionally, the marketplace is often affected, in the long term by a multitude of indirect factors that skew the data; the price of fuel, socio-economic instability or new laws/regulations in parts of the world where they have warehouses or production facilities, natural disasters etc.

Furthermore capital market changes only capture the effects of those security breaches that are publicly reported. Privately held companies are not subject to many of the laws and regulations that compel larger businesses to self-report and even when companies are required by law, to report security breaches, anything that does not meet the legal threshold is likely to go unreported. Undetected losses also generate indirect costs: consumers become more wary of utilizing electronic payments after their data is compromised, whether or not they know the source, and business partners may choose to restrict data flow based on generalized security concerns; leading to increased costs in