SQUARE Project: Cost/Benefit Analysis Framework for Information ...

Contents
Abstract .............................................................................................................vii
1 Introduction..................................................................................................1
1.1 The Problem .........................................................................................1
1.2 A Framework for Cost/Benefit Analysis..................................................1
1.3 The Acme Company..............................................................................2
1.3.1 System Overview.......................................................................2
1.3.2 Business Goals..........................................................................2
1.3.3 Security Objectives....................................................................2
2 Cost/Benefit Analysis Framework...............................................................4
2.1 Terms and Concepts .............................................................................4
2.2 Methodology .........................................................................................4
2.3 Stakeholder Involvement .....................................................................10
2.4 Evaluation Criteria...............................................................................10
2.5 Maximizing System Value Within Real-Life Budget Constraints...........12
3 Cost/Benefit Analysis Framework in Practice..........................................15
3.1 Misuse Cases .....................................................................................15
3.2 Categories of Threats..........................................................................16
3.3 Risk Exposures ...................................................................................17
3.4 Architectural Recommendations..........................................................17
3.5 Policy Recommendations....................................................................17
3.6 Total System Value Versus Total Implementation Costs.......................18
3.7 Benefit/Cost Ratio Versus Total Implementation Costs ........................19
3.8 Total Implementation Costs Versus Risk Exposures ............................20
3.9 Values Versus Risk Exposures............................................................21
4 Lessons Learned........................................................................................23
4.1 Misuse Cases .....................................................................................23
4.2 Estimation of Losses ...........................................................................23
4.3 Estimation of Costs .............................................................................23
4.4 Cost Structures of Security Improvement Projects...............................24
CMU/SEI-2004-TN-045
i