Question

looking at all of the data breaches here( Facebook, Anthem data breach) what are some of the commonalities what are the commonalities?

Companies are often reluctant to spend extra money on security, as it does not seem to contributed directly to increased profits. Can you justify security spending from a financial point of view? Could you determine a return on investment (ROI) for security?

Answer 1

Answer.

The commonality in such data breaches is that, the information related to public and their all personal datas are hacked. For example, their bank details, mobile and emails, passwords, age, their qualifications, many more information. Some time an individual's biometric datas are also hacked, these informations are to be protected and kept confidential, because they can be used in many wrong ways.

Commonalities are the similarities of the hacking pattern, in which similar set of data's are hacked or stolen.

It is very difficult to justify the security spending from a financial view point, because of its intangibility, which cannot quantity the cost and return. And it is also very challenging to calculate the reputation loss due to such breaches of security. Cyber security investment is about loss prevention, not about earnings. But, an organisation can" try to quantify the ROI in a language understandable to the business with the statistics of % of security incidents increase year on year and average financial loss per breach to the company."

One can determine a return on investment for security based on the assessment of specific risk that a given security investment could address. Therefore, one "needs to clearly understand security risk exposure and estimate the value of each asset that the security investment aims to protect."

ROSI=(ALE* mitigation ratio - cost of solutions)/ cost of solution

Here, ROSI is return on security investment

ALE is annualised loss expectancy

The mitigation ratio is the percentage of risks that the security investment would address.

-------------------------------------------------------------------------------------------------------------------------------

References:

* Return on Investment (ROI) of Information Security – What Business should consider?

May 10, 2017 ,Vishal Pranjale

* How to Calculate Return on Security Investment

Matt Middleton-Leal, Published: August 7, 2018