SQUARE Project: Cost/Benefit Analysis Framework for Information ...

More documents

Recommendations

Info

6 Future Work There are several questions that drive future work on the Cost/Benefit Analysis Framework: • Can the Acme Company’s trend patterns be witnessed in other small companies and their security improvement projects? • How would the estimate values compare to empirical data if we were to follow through with the Acme Company over the lifetime of its project? • Are there any other variables that we have not accounted for in the framework? If so, why do they exist and how can we account for them? • What if Categories of Threats cannot be assumed to be independent from each other? So far we have assumed that the effects of mitigating threats in one category are negligible to the risks in other categories. If this assumption no longer holds, how do the resulting interdependencies affect the framework? • Can the framework be applied to larger companies? The overall goal of the framework is to provide a way for small companies to be able to accurately estimate the cost of their security improvement projects. By incorporating lessons learned from the Acme Company, we will strive in the future to • refine the estimation methods to facilitate further analysis • use the estimation methods with other companies to see if similar trend patterns exist • develop a general set of cost/benefit profiles and metrics for projects with different types of system architectures • design a spreadsheet to automate the cost/benefit calculations and to select the most optimal solution • formalize the relationship between the five metrics we proposed in Section 2.4 26 CMU/SEI-2004-TN-045
References URLs are valid as of the publication date of this document. [Allen 99] [Camm 00] [NIST 04] [Richardson 03] [SANS 03] Allen, J.; Christie, A.; Fithen, W.; McHugh, J.; Pickel, J.; & Stoner, E. State of the Practice of Intrusion Detection Technologies (CMU/SEI-99-TR-028, ADA375846). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 1999. http://www.sei.cmu.edu/publications/documents/99.reports/99tr028/ 99tr028app-a.html. Camm, Jeffrey D. & Evans, James R. Management Science & Decision Technology. South-Western College Publishing, 2000. National Institute of Standards and Technology. branch and bound. http://www.nist.gov/dads/HTML/branchNbound.html (2004). Richardson, Robert. 2003 CSI/FBI Computer Crime and Security Survey. Computer Security Institute. http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2003.pdf (2003). SANS Institute. SANS Glossary of Terms Used in Security and Intrusion Detection. http://www.sans.org/resources/glossary.php#top (2003). CMU/SEI-2004-TN-045 27
Page 1 and 2: SQUARE Project: Cost/Benefit Analys
Page 3 and 4: Contents Abstract .................
Page 5 and 6: List of Figures Figure 1: Categoriz
Page 7 and 8: List of Tables Table 1: Terms and C
Page 9 and 10: Abstract Many companies rely on his
Page 11 and 12: 1 Introduction The purpose of a cos
Page 13 and 14: Integrity: The system performs its
Page 15 and 16: will not explain in depth how to ge
Page 17 and 18: Using the aforementioned probabilit
Page 19 and 20: Total Benefits = = N ∑ i= 1 N ∑
Page 21 and 22: Category of Preventions ( P ) i Bas
Page 23 and 24: Back to the problem, there are N po
Page 25 and 26: 3 Cost/Benefit Analysis Framework i
Page 27 and 28: 3.3 Risk Exposures The cost/benefit
Page 29 and 30: Total System Value vs. Total Implem
Page 31 and 32: The variance around the trend line
Page 33 and 34: 4 Lessons Learned 4.1 Misuse Cases
Page 35: 5 Conclusions The objective of the
Page 39 and 40: REPORT DOCUMENTATION PAGE Form Appr

SQUARE Project: Cost/Benefit Analysis Framework for Information ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?