Weakness is a better teacher than strength ... - PDF Archive

320 Chapter 9
safeguards, the information security design team can deliver a budgeted value for planning
purposes. Sometimes noneconomic factors are considered in this process, so even when
ALE amounts are not large, control budgets can be justified.
The Cost-Benefit Analysis Formula CBA (or economic feasibility) determines
whether a control alternative is worth its associated cost. Such analyses may be performed
before implementing a control or safeguard, or after controls have been in place for a time.
Observation over time adds precision to the evaluation of the benefits of the safeguard and
the determination of whether the safeguard is functioning as intended. While many CBA
techniques exist, it is most easily calculated using the ALE from earlier assessments.
CBA = ALE(pre-control) - ALE(post-control) - ACS
where
ALE(pre-control) = ALE of the risk before the implementation of the control
ALE(post-control) = ALE examined after the control has been in place for a period of time
ACS = annual cost of the safeguard
Once the controls are implem~nted, it is crucial to examine their benefits continuously to
determine when they must be upgraded, supplemented, or replaced. As Frederick Avolio
states in his article "Best Practices in Network Security":
Security is an investment, not an expense. Investing in computer and network security
measures that meet changing business requirements and risks makes it possible
to satisfy changing business requirements without hurting the business's viability. 5
Other Methods of Establishing Feasibility
Earlier in this chapter, the concept of economic feasibility was employed to justify proposals
for information security controls. The next step in measuring how ready an organization is
for the introduction of these controls is to determine the proposal's organizational, operational,
technical, and political feasibility.
Organizational Feasibility Organizational feasibility analysis examines how well the
proposed information security alternatives will contribute to the efficiency, effectiveness, and
overall operation of an organization. In other words, the proposed control approach must contribute
to the organization's strategic objectives. Does the implementation align well with the
strategic planning for the information systems, or does it require deviation from the planned
expansion and management of the current systems? The organization should not invest in technology
that changes its fundamental ability to explore certain avenues and opportunities. For
example, suppose that a university decides to implement a new firewall. It takes a few months
for the technology group to learn enough about the firewall to configure it completely. A few
months after the implementation begins, it is discovered that the firewall as configured does
not permit outgoing Web-streamed media. If one of the goals of the university is the pursuit of
distance-learning opportunities, a firewall that prevents that type of communication has not
met the organizational feasibility requirement and should be modified or replaced.
Operational Feasibility Operational feasibility refers to user acceptance and support,
management acceptance and support, and the system's compatibility with the requirements
of the organization's stakeholders. Operational feasibility is also known as behavioral feasibility.
An important aspect of systems development is obtaining user buy-in on projects. If