RISK MANAGEMENT STRATEGIES
Forget ROI; Use Six Sigma to prove business value
Tom Bowers
02.28.2007
Rating: -4.64- (out of 5)
|
Your colleagues on the business side are at it again. They're asking for proof of a return on security investment -- metrics. They are asking you to measure the "unmeasurable." It is disheartening to know that security will always be viewed as a cost center and never a profit center. This is, however, a reality of the business world. At its core, security is a risk management function. The challenge is that the classic models for ROI simply don't work well in security's business role. Security staffs prevent adverse events from happening to their companies, and how do you measure that?
At my previous job, which was working in the security department at a large pharmaceutical company, we had success using Six Sigma to identify relevant data that can show the value of initiating a new project or technology. Instead of attempting to prove ROI, we used Six Sigma tools to define what can be measured, conduct the "measurement" and provide an analysis of that data to show business value to the CFO. The bottom line is always showing "business value" -- hopefully in real dollars saved.
Six Sigma is a statistical approach to process measurement used by corporations such as GE, Motorola and Ford for improving manufacturing processes. It is completely data driven and statistics are used to identify problem areas. These areas are then prioritized and resolved. Because Six Sigma reduces defects in process, it maximizes production line efficiency, thus improving profit. However, Six Sigma can be used for any process, and it has many adherents in the service industries.
The cornerstone of Six Sigma is WHAT is being measured. There are five major steps in using Six Sigma. These are:
Our security department used the first three steps of Six Sigma:
Next we looked at regulatory compliance breaches. And finally, we used external events such as information theft reports and regulatory noncompliance reports at other firms. While not as strong as using o
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
ur own cases, they provided a framework of reasonableness in our argument before our business peers. I used tools such as Google Alerts and RSS feeds to find these examples daily.
To create a larger statistical sample, we use freeware and commercial risk assessment tools. Please note that freeware tools are free in software cost, but not in the time needed to master them. Examples of time proven tools are the NIST SP 800-30, OCTAVE and OSSTMM methods. Commercial tools are usually more user-friendly and offer better reporting, but at a cost. Vendors to consider in this space are Relational Software (RSAM) and RiskWatch.
For the IT security data points, we looked at our SEM/SIM, which provides log and event correlation that supports events seen in one location by providing corroborating evidence in other locations. These tools provide data points that are of higher quality and can speak more clearly of the ROI/business value provided by security in protecting infrastructure. SEM/SIM tools also speak to content monitoring appliances that may provide more concrete content protection events. Since SIM/SEMs aggregate events they make it easier to show improvements after the define/measure/analyze process. Bottom line, SIM/SEM tools provide a larger data set to conduct your analysis upon and show improvements with.
All of this speaks to the business value of security. This has been the key for success: talking about business value provided, supported by the "metrics" we developed using Six Sigma tools. These tools allowed us to identify information security risks that potentially prevent the business from achieving its mission. They provided for Proscription vs. Prescription or providing protection before an incident instead of after an incident. They aided in creating a protection strategy and mitigation plans designed to reduce the highest priority information security risks.
With this framework, it's easier to present your case to senior management. Speak in business value terms and build management support for your project through the layers (bottom to top). Use the financial resources lost during incident response or investigations, starting with your most recent incident first. In general terms, use the results from your forensic exams (let the evidence speak for itself). Use your risk assessment or audit findings as your quantifying metrics. Ensure that you provide a tie-in to regulatory and privacy data breach requirements to show that this project protects your intellectual property and your senior management. Lastly, propose your project and funding in stages to garner the support of your CFO and his peers.
About the Author:
Tom Bowers, CISSP, PMP, CEH, is a technical editor for Information Security serves as the managing director of the independent think tank and industry analyst group Security Constructs LLC. Bowers formerly served as security manager for a pharmaceutical company.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
