The problem is that security doesn't provide any benefits (in terms of producing measurable revenues). It only mitigates costs. What happens to that nice clear cost/benefit analysis is that management reads it and goes "We're OK on the cost part, but benefits? We haven't had a recorded security incident yet. What benefit do we get from preventing something that doesn't happen? All you're showing us is costs here, come back when you can show us some real numbers on what it would've saved us in real incidents.". Of course, with security by the time you've got data on real incidents it's too late...

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11228/32052#32052