Sustainable and adaptive Cyber Security investments

February 5, 2024

Transforming the cyber investment model

As organizations navigate the complexities of cyber threats, the right balance between investment and risk mitigation emerges as a key determinant of cyber security resilience.

Your organization has experienced an increase in cyber threats and recognizes the need to strengthen its cyber security measures. The management team is concerned about potential financial losses, reputational damage, and regulatory penalties in the event of a security breach.

Where it has been found to be deficient is in network security equipment due to obsolescence, as three years ago the manufacturer indicated that this equipment in six months would be out of support. There are therefore no longer any security measures to compensate for their continuity in the infrastructure and technological architecture.

Due to this, the corporate government is requesting an evaluation of the investments to be made and how the use of resources will be managed. What are the criteria to be considered and established in the acquisition process? Imagine that you have received six proposals from various suppliers and of these there are two offers that have caught your attention where the costs are 45,000 and 57,000 euros.

Do you consider that those criteria are enough to evaluate your decision making before the report that you have to present? If you considered it, I would tell you that it is not the right way to go. Your action should have been more comprehensive and not only focused on the cost but go beyond. That is why I will here help you to evaluate an investment with a sustainable and adaptive approach in Cyber Security.

An organization's cyber security posture is only as strong as its weakest link; therefore, strategic resource management extends beyond finances to include personnel, training, and technology infrastructure.

Investment in cyber security should be a priority for organizations. Despite the difficulty in calculating its exact financial return (as in any investment in security, whatever its type), given the increasing frequency of cyberattacks and the great impact they have both on the service provided and on safeguarding the information and reputation of the organization itself, there should be no doubt in carrying it out.

As Gartner defines Total Cost of Ownership (TCO) as a comprehensive assessment of information technology (IT) or other costs across company boundaries over time. For IT, TCO includes hardware and software acquisition, management and support, communications, end-user expenses, and the opportunity cost of downtime, training, and other productivity losses.

The dynamic nature of cyberthreats requires continuous reflection on the adequacy and adaptability of cyber security measures, pushing organizations to regularly reassess their investment strategies.

This is a framework designed to help evaluate the overall costs associated with the acquisition of any IT asset. Rather than focusing solely on the initial purchase price, as when purchasing a firewall, this model encourages a comprehensive evaluation.

This includes considering not only the cost of the computer, but also other elements such as moving expenses, space requirements, power consumption, implementation costs, maintenance costs and personnel-related costs. The model facilitates more informed investment decisions by weighing and aggregating these various costs, providing a holistic view of the true costs associated with an IT asset over its entire lifecycle.

Beyond the traditional metrics of monetary costs, the true value of cyber security investments lies in mitigating reputational damage, preserving customer confidence, and avoiding regulatory sanctions.

During my day to day to help organizations I work with financial indicators that have perspective on Cyber Security as an investment where I seek to evaluate its positive or negative profitability and how security can be viewed.

Some of these indicators are:

Return on investment (ROI): Measure of benefits plus cost savings as a proportion of expenditure.
Return on security investment (ROSI): Measure of (security) benefits plus cost savings (reduced incident losses) as a proportion of security expenditure.
Internal rate of return (IRR): Calculated over several years, e.g., 5 years. It is used to determine whether it would be better to have put the money in a remunerated financial asset.
Net present value (NPV): This is calculated over a few years, e.g., 5. It is used to estimate the value of the investment after correcting for the depreciation of the expenditure. For example, it corrects for the effect of inflation.

In practice the calculation of Cyber Security investments involves a structured approach to assessing the costs associated with implementing and maintaining various cyber security measures. While the specific calculations may vary depending on the size of the organization, the industry and the risk profile, the following are general steps to guide the process:

1. Conduct a risk assessment

Identify and assess potential Cyber Security risks to the organization.
Quantify the potential impact and likelihood of various threats and vulnerabilities.

2. Define security objectives

Clearly outline the organization's security objectives based on the identified risks.
Determine the level of security required for the different assets and information systems.

3. Determine the required security controls

Identify and prioritize the security controls and technologies needed to mitigate the identified risks.
Consider industry best practices, regulatory requirements, and the specific needs of the organization.

4. Estimate implementation costs

Estimate the initial costs associated with implementing the selected security controls.
Include costs for hardware, software, licenses, training, and any external consulting services.

5. Consider operational costs

Consider ongoing operational costs, such as maintenance, upgrades, monitoring, and personnel.
Calculate the cost of periodic security audits, assessments, and training programs.

6. Assess potential cost savings

Evaluate the potential cost savings from improved security, such as reduced incidents, downtime, and legal consequences.
Consider the impact on organizational reputation and customer confidence.

7. Calculate return on investment (ROI)

Compare estimated costs with potential benefits and savings.
Calculate ROI by dividing the net gain (benefits minus costs) by the initial investment and multiplying by 100 to obtain a percentage.

ROI = (Savings on investment - Cost of investment) / Cost of investment * 100%.

8. Consider the value of information assets

Assess the value of the information assets to be protected.
Prioritize investments according to the criticality and sensitivity of these assets.

9. Alignment with business objectives

Ensure that Cyber Security investments are aligned with overall business objectives.
Prioritize investments that directly contribute to achieving strategic objectives.

10. Regular review and adjustment

Regularly review and adjust Cyber Security investments based on changes in the threat landscape, technology, and business environment.
Take into account the results of security audits, incidents and the effectiveness of existing measures.

Conclusion

The intricate landscape of Cyber Security investment and resource management requires an astute understanding of the dynamic interplay between financial considerations, risk mitigation and strategic resilience.

The analysis underscores that effective Cyber Security measures transcend mere economic investments; they require judicious allocation of financial and non-financial resources. Organizations must reflect on the holistic nature of cyber security, recognizing it as a continuous and evolving process that requires strategic foresight, adaptability, and collaboration across all facets of the enterprise.

In the ever-evolving digital realm, thinking about cyber security investment and resource management serves as a compass that guides organizations toward a balanced and sustainable security posture. The effectiveness of these measures does not lie solely in the monetary numbers, but in the strategic alignment of investments with organizational goals, the ability to adapt to emerging threats, and the cultivation of a resilient cyber security culture.

As we look ahead, organizations that take a holistic approach to Cyber Security, integrating it seamlessly into their business strategy, will be better positioned to navigate the complexities of an evolving digital landscape with confidence and foresight. Measuring cyber risk enables organizations to systematically assess and address emerging threats in a structured way.

Sustainable and adaptive Cyber Security investments