‘Beep’ Prepared: How Security Economics Can Help The Coyote Catch The Roadrunner

Acme Corp., fictional purveyor of fine products to the coyote in a relentless quest to catch the roadrunner, has found that cyberattacks are affecting its manufacturing processes and are at least partly to blame for repeated product failures in the field. They asked Intel Security to take a look at their operations and recommend ways to improve them.

Like many real-life organizations, Acme is experiencing cyberattacks that are getting nastier, taking longer to clean, and affecting multiple aspects of business operations. It knows that it needs to update its security systems, but it struggles to quantify what it takes to move forward. And -- just as importantly -- the company isn’t sure how to capture and quantify the benefits of its potential actions. Acme’s CFO is holding tight on the purse strings until the security team can provide a business case. Meanwhile, the clock ticks…

Does this sound like a familiar challenge to you?

For many of us in security, the conversation between us as technical experts and our non-technical colleagues can be frustrating. We have our top priorities: must-do, urgent actions that will advance our organization’s security. But sometimes it feels like our partners in finance or lines of business speak a different language.

The practice of security economics helps bridge that divide. Our practice at Intel Security started with building a process and methodology to use in conversations with security teams in any size businesses as well as government and other organizations.

Let’s go back to our fictional friends at Acme. Say Acme was suffering from advanced targeted attacks that were able to evade their existing defenses. Acme has implemented lots of tools from many different vendors, all with the best intentions. Frustratingly, though, Acme is still getting penetrated and, in spite of all the top quadrant products from the latest start-ups, Acme has limited visibility into what’s happening.

Acme’s CISO says she is driving focus on rapid remediation to get systems cleaned and returned to operation as quickly as possible. She has quotes from security vendors that have compelling technology to help her reduce infection rates. The problem? The CISO is struggling to get funding for her investment because her stakeholders see the situation as a security problem, not a business problem.

Our first step is a conversation with the team for data gathering. Turns out, Acme is suffering several dozen attacks per year. Most of the attacks are minor and can be remediated in two to four hours.

For the daily work involved for minor incidents, we estimate the cost for IT’s remediation work at about $100 per incident. But here’s the thing the security team forgets: Remediation has costs beyond the security team. For an endpoint machine, an end-user without a PC is a less productive end-user. So in our model, we want to make sure we are capturing the impact to Acme’s line of business teams. This becomes the key insight for our CISO to use in influencing her business partners to support funding her plan.

We determine that the productivity impact for end users is roughly equal to the impact on the security team. In other words, the number of hours consumed by infections is hurting Acme’s business (no wonder Road Runner keeps on winning!). The table summarizes the math.

Solving this problem alone won’t justify the investment Acme’s CISO wants to make, but it does begin to help demonstrate how gaps in the security architecture impair business results. Next time, we’ll share some other examples of how we worked with Acme’s CISO to build a compelling business case for change.