Security control mechanisms have expenses connected with their purchase, deployment, and maintenance, and implementing these systems in a redundant fashion can raise costs significantly. When choosing an appropriate redundancy and security controls for a given system or network, it is helpful to create a number of negative scenarios in which a security breach or an outage happens, to determine the corporation’s costs for each occurrence. This risk-model plan should help management decide the value to the corporation of the different security control mechanisms.
For example, what costs are affordable to recover from a security breach or when reacting to a system outage outside of regular business hours? Be sure to include cost calculations for direct items, such as wasted sales, decreased productivity, and replacement costs, as well as for indirect items, such as destruction of the organization’s reputation and brand name, and the resultant loss of customer trust. Armed with an approximation of expected loss, organizations can decide appropriate expenditure levels.
For example, paying $200,000 to improve a trading system to achieve 99.999 percent availability may look overly expensive on the surface, but it is a trivial expense if system downtime can cost the corporation $250,000 per hour of outage.