Free Ebook Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series)
But, this publication is truly various. Really feeling stressed is common, but not for this publication. Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) is specifically composed for all cultures. So, it will certainly be very easy and also readily available to be comprehended by all individuals. Currently, you require just prepare little time to obtain and also download the soft data of this book. Yeah, guide that we offer in this internet site is all in soft data formats. So, you will certainly not really feel complicated to bring huge publication almost everywhere.
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series)
Free Ebook Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series)
The first thing to go to the library is thinking about just what book to read. When you are here as well as seeing this online library, we will recommend you several advised publications for you. The books that is actually ideal with your life and also duties. Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) is one of the optional book catalogues that can be most wanted.
Why ought to be book Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) Book is among the very easy resources to seek. By obtaining the author as well as theme to obtain, you can locate numerous titles that supply their data to get. As this Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series), the inspiring book Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) will provide you just what you have to cover the work deadline. And also why should be in this site? We will ask first, have you much more times to go with shopping guides and search for the referred publication Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) in book shop? Lots of people could not have sufficient time to locate it.
What should you assume much more? Time to obtain this Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) It is very easy then. You could only rest as well as remain in your location to get this publication Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) Why? It is on the internet publication shop that provide a lot of compilations of the referred books. So, merely with web connection, you could delight in downloading this book Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) as well as varieties of publications that are looked for now. By visiting the link page download that we have actually given, the book Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) that you refer so much can be located. Merely save the asked for book downloaded then you could take pleasure in guide to check out every single time as well as place you really want.
In providing the info, we likewise show various other book collections. We realize that nowadays lots of people like reviewing a lot. So, locating thousands of the books right here in this online publication is extremely easy. Searching as well as surfing can be done anywhere you are. It is the way you make use of the contemporary technology as internet connection to connect to this site. From this case, we're actually certain that everybody requirements are covered in some books, the particular publications based upon the topics as well as needs. As the Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) that is currently preventative.
From the Back Cover
Cost-benefit guidelines for efficiently allocating scarce resources to your organization's cybersecurity program Cybersecurity breaches are a fact of life in today's interconnected world and the financial and business impact of unauthorized intrusions can be devastating. But how can you know if your firm is committing too much money, or not enough, to protect itself against such unseen hazards? Managing Cybersecurity Resources provides you with hands-on analysis and answers on this vital question. An invaluable resource for information security managers tasked with establishing cybersecurity initiatives as well as financial managers who must determine how much to allocate to such initiatives, this focused yet wide-ranging book details: Models that quantify precisely how firms should decide on the right amount to spend on cybersecurity Concepts and empirical evidence for assessing the real costs of cybersecurity breaches Strategies for minimizing the impact of negative incidents on company valuation The Internet is one of the great innovations of the past century. As with all innovations, it presents its users with both unprecedented opportunities and unavoidable perils. Managing Cybersecurity Resources outlines a cost-benefit framework for protecting your organization against the invasion of its information network while leaving you with the resources you need to compete and grow. "Using economic considerations to drive cybersecurity investments is a relatively new phenomenon. It happened when it did in large measure due to the efforts of this book's authors. It's a great thing for security that they've distilled their work from the past several years into one straightforward, comprehensive discussion. As they say within its pages: 'the reality is that cybersecurity investments can, and should, be determined in a rational economic manner.' If you've got budgetary responsibilities for information security, you need to spend time with this book."--Robert Richardson, Editorial Director, Computer Security Institute Every day, your organization's information system is at risk of attack. And while many of these attacks are little more than harmless pranks, other more insidious assaults can wreak devastating economic and operational damages. Nobody questions that you must take tangible steps to protect the cybersecurity of your organization. Thus, the question becomes: What is such protection worth? How can you, with so many areas competing for your firm's limited resources, determine the optimal level of funding to adequately secure your information and computer systems? And, perhaps most important, how can you convince decision-makers as well as colleagues of the importance of maintaining this funding? Managing Cybersecurity Resources details guidelines for using sound and measurable principles of cost-benefit analysis, as a compliment to gut instinct, to efficiently allocate and manage cybersecurity resources within your organization. Written by two globally acknowledged leaders in the increasingly critical area of cybersecurity, this comprehensive exploration presents: Key issues that impact the management of cybersecurity resources An economic framework for achieving sufficient cybersecurity protection The role risk plays in allocating cybersecurity resources A generic approach for making the business case for securing funding deemed necessary The growing role of cybersecurity in protecting national security
Read more
About the Author
Lawrence A. Gordon, Ph. D., is the Ernst & Young Alumni Professor of Managerial Accounting and Information Assurance, at the University of Maryland's Smith School of Business. Gordon is one of the world’s leading experts and frequent speaker on the subjects of cybersecurity economics, capital investments, cost management systems and performance measures. He is also the Editor-in-Chief of the Journal of Accounting and Public Policy. Martin P. Loeb, Ph.D., a professor of accounting and information assurance at the University of Maryland's Robert H. Smith School of Business, is also an affiliate professor at the University of Maryland Institute for Advanced Computer Studies. Loeb’s research on information security economics, mechanism design, and incentive regulation is internationally recognized, and has been published in leading academic journals in economics, computer science, and accounting.
Read more
Product details
Series: The Mcgraw-Hill Homeland Security Series
Hardcover: 224 pages
Publisher: McGraw-Hill Education; 1 edition (September 28, 2005)
Language: English
ISBN-10: 9780071452854
ISBN-13: 978-0071452854
ASIN: 0071452850
Product Dimensions:
6.2 x 0.9 x 9.1 inches
Shipping Weight: 1 pounds (View shipping rates and policies)
Average Customer Review:
4.6 out of 5 stars
4 customer reviews
Amazon Best Sellers Rank:
#1,337,224 in Books (See Top 100 in Books)
Managing Cybersecurity Resources (MCR) is an excellent book. I devoured it in one sitting on a weather-extended flight from Washington-Dulles to Boston. MCR teaches security professionals how to think properly about making security resource allocation decisions by properly defining terms, concepts, and models. The only problem I have with MCR is the reason I subtracted one star: its recommended strategy, cost-benefit analysis, relies upon estimated probabilities of loss and cost savings that are unavailable to practically every security manager. Without these figures, constructing cost-benefit equations as recommended by MCR is impossible in practice. Nevertheless, I still strongly recommend reading this unique and powerful book.My favorite aspect of MCR is its explanation of economics and finance terms to the security audience. I felt like applauding when I read on p 47 "[M]any managers... are merely calling the IRR an ROI or ROSI (return on security investment). Given that the concepts of "return on investment" and "internal rate of return" are well established in the accounting, finance, and economics literature, as well as among nearly all senior financial managers (e.g., CFOs), security managers should be careful how they use these terms. Indeed, misusing these terms can only lead to problems for the security manager." (See p 45 for a comparison of ROI, IRR, and NPV.)In a similar fashion, MCR explains what a "return" is for security on p 21: "The benefits associated with cybersecurity activities are derived from the cost savings (often called cost avoidance) that result from preventing cybersecurity breaches. These benefits are difficult, and often impossible, to predict with any degree of accuracy. Moreover, since the actual benefits are conceptually the cost savings associated with potential security breaches that did not occur, it is not possible to measure these benefits precisely after the security investments are made."What of "investment"? Pp 28-30 say: "[O]rganizations tend to treat the bulk of their cybersecurity expenditures as operating costs and charge them to the period in which they are incurred," unlike capital investments, which "represent assets of an organization that should appear on the organization's balance sheet." The authors recommend us to "view all costs related to cybersecurity activities... as capital investments with varying time horizons."So what is a cost? P 5 says "The cost of information security is essentially a negative network externality associated with the Internet... [It] arises when malevolent individuals and organizations [which the authors properly label "threats" on p 12] join the network, thereby imposing costs on all well-intentioned users. These costs take the form of losses caused by actual security breaches plus the cost of actions... designed to prevent such breaches."P 30 wisely states "[N]o amount of security can guarantee that breaches will not occur... The goal of the organization should be to implement security procedures up to the point where the benefits minus the costs are at a maximum." The footnote on p 31 continues with "An alternative way to view this discussion is to think of the goal as one of trying to minimize the sum of the costs associated with cybersecurity activities and the costs associated with breaches... the optimal level of cybersecurity for an organization would be the same under the cost minimization goal as it would be if the organization were to maximize the net benefits." I think most managers prefer to think in terms of cost minimization, which is a prevalent throughout IT.Costs are dissected on pp 56-58: "The direct costs of cybersecurity breaches are those costs that can be clearly linked to specific breaches... the indirect costs of cybersecurity breaches cannot be linked... Explicit costs of cybersecurity breaches are those costs of breaches that can be measured in an unambiguous manner... implicit costs are opportunity costs (i.e., costs associated with lost opportunities), which cannot be measured without ambiguity... the benefits derived from spending funds on cybersecurity activities come largely from the cost savings derived by avoiding the implicit costs of breaches."Page 63 explains why companies have "Chief Privacy Officers" and the like, even though preserving privacy is the confidentiality aspect of the CIA triad and could be a CISO responsibility: "The findings from our study show that, on average, information breaches that compromise confidentiality do have a significant negative impact on the stock market value of corporations experiencing breaches. Indeed, the average decline in the firm's stock market value... was approximately 5 percent."So far so good, right? The major flaw with MCR arrives in ch 4, on p 68: "The variables affecting potential cost savings include (1) the potential losses associated with information security breaches, (2) the probability that a particular breach will occur, and (3) the productivity associated with specific investments, which translates into a reduction in the probability of potential losses." This is true -- but this is the key problem: devising even rough estimates of 1, 2, and 3 is nearly impossible in practice. The authors' examples (see figure 4-2 for one) assume these factors can be determined (like $10 mil total potential loss without countermeasures, 75% probability of loss with no countermeasures / 50% with $650,000 of countermeasures, and so on). When I saw these contrived examples I wondered "what is the origin of these figures?" The fact of the matter is that they are all guesswork, which means the calculator can say anything the analyst wishes to produce.In some sense we are back to square one, although much better educated in economics. (Note that Andy Jaquith's book Security Metrics also observes how calculating these figures is nearly impossible in real life.)Because MCR is so right in all of its other discussions, the book deserves 4 stars. A proper acceptance of the difficulty or impossibility of determining 1, 2, and 3 might have resulted in 5 stars. Perhaps a second edition will address these concerns?PS: I would be remiss to not quote the authors' exceptional insights into the problems with security auditing. P 132 says "[T]he checklist approach tends to shift attention away from the cost-benefit aspects of such security. That is, the checklist approach usually assumes that conducting a particular procedure is inherently worth doing." P 137 hits the nail on the head: "[F]or some firms, it is quite possible that the costs of cybersecurity auditing will exceed the benefits. If this were to occur, then cybersecurity auditing would in effect decrease the firm's value." Amen.
Managing Cybersecurity Resources: A Cost-Benefit Analysis is excellent! Information security practitioners will appreciate the insightful economic analysis on how to determine the right amount to spend on cybersecurity projects and how to prepare a business case to justify such projects. I especially liked the chapter on risk that included perspectives and analysis not found in any other information security books. The book discusses many topics (for example, economics of cybersecurity and its role in national security) in a manner that novice and expert alike will find appealing. Its clear that the authors, chaired professors from a top business school and pioneers in cybersecurity economics, have a strong understanding of the security environment along with great technical skills. Of more importance, is their intuitive understanding of problems in the cybersecurity trenches. Policy makers, CISOs, CFOs, and managers at all levels, should find enormous value in this book. While at times I wish the authors would not have condensed their discussion, the good news is that they have left some important issues for a follow-up book. I am recommending this book to co-workers and friends.
This book is very timely and extremely useful as a tool for key decision-makers in organizations - Chief Technology Offiers, Information System Managers, and general managers, including CEOs, as well as academics. How do you allocate scarce resources to increasing cybersecurity, in the context of other competing claims ? Professors Gordon and Loeb provide a solid economic framework to do this. They bring their decades of experience researching and teaching about a cost-benefit approach to managerial decisions to the table, in the context of cybersecurity investments.What I like about the book is its appeal to practitioners and academics alike. There is a nice section on developing a business case for cybersecurity investments. Empirical evidence to support their arguments are provided throughout the book. Complex ideas like real options and cybersecurity investments are nicely explained with simple and insightful examples.Overall, whether you are a manager making or evaluating the case for cybersecurity investments, or teaching in this area, this book is a must-read.
This book provides an excellent discussion of key economic principles needed to make managing cybersecurity resources more effective. I really liked the nice examples provided throughout the book. The examples reinforce the economic concepts and applications. I foresee this book becoming a prime reference for me.
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) PDF
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) EPub
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) Doc
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) iBooks
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) rtf
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) Mobipocket
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) Kindle
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) PDF
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) PDF
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) PDF
Managing Cybersecurity Resources: A Cost-Benefit Analysis (The Mcgraw-Hill Homeland Security Series) PDF
