Timeline for Secure Development costs
Current License: CC BY-SA 3.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 18, 2012 at 23:33 | comment | added | Vitaly Osipov | @atdre I am not giving it a go, because some arguments are not worth having. | |
| Dec 17, 2012 at 18:10 | comment | added | atdre | @agelastic: There are many authors of that book. Security is not a science, and as a proponent of quals over quants, my Poisson distribution suggestion is clearly not the end-all-be-all. However, I'd like to hear your ideas about incident-oriented and evidence-based risk management in information security management practices, if you have any. Why don't you give a go at an answer? | |
| Dec 8, 2012 at 4:04 | comment | added | Vitaly Osipov | @atdre You are quoting a book written by a consultant selling security operations services and, of all places, Gartner (which is entirely vendor driven). On arbitrariness - choice of Poisson distribution for security incidents is arbitrary. Quote me a an article in a peer reviewed journal that concludes Poisson is the best, and I will back out my comment :) Besides, there are many other components in addition to incidents - reputation, customer loyalty etc. | |
| Dec 6, 2012 at 21:41 | comment | added | atdre | @agelastic: that's not true. your comment is untrue. please back it up with facts and/or references. | |
| Nov 28, 2012 at 4:12 | comment | added | Vitaly Osipov | @atdre these number are quite arbitrary and vendor-driven. | |
| Jun 12, 2011 at 19:25 | vote | accept | Rory McCune | ||
| May 31, 2011 at 20:52 | comment | added | atdre | @Graham: Then you and I agree. Reputation and brand are for marketing people. I'll stay in the real world of technology where availability (i.e. networks, apps, and databases) and integrity (i.e. system and data) matter most, while confidentiality follows a close third. Networks can be made highly available through BGP and DNS, which are difficult black-arts that rarely have upper management support. Systems are always easy to scale and provide high-availability for. Apps/DBs are the least understood of all -- with no standards for acquisition, creation, or deployment. | |
| May 31, 2011 at 8:47 | comment | added | Rakkhi | @graham-lee 200% increases in Sony Ps3 returns: goo.gl/h8oTD . But my point was that reputational damage will hurt companies that trade on it like RSA more than it will those who trade on fun and entertainment like Sony or TK Maxx. Reputation still matters a hell of a lot though and is the primary business case for security after regulation for many companies. Bit of blog spam: rakkhis.com/2011/05/what-does-sony-need-to-rebuild.html | |
| May 31, 2011 at 8:00 | comment | added | user185 | @atdre I didn't intend to raise that point: I asked the question of whether anyone had discarded their PS3s for Xbox/Wii because of the Sony hacks. Until someone shows that these people exist, or that PS3 users have stopped their subscriptions to the PSN, or that people who were potential PS3 owners bought Xboxen instead, I don't believe that the "damage to reputation" is as important as has been claimed. | |
| May 30, 2011 at 19:22 | comment | added | atdre | @Graham: I'm sorry -- but you lost me in this conversation. You brought up the point that "people" (my: "they") may have thrown their PS3s away. Are you talking about another subject? | |
| May 30, 2011 at 8:08 | comment | added | user185 | @atdre: and who are they? Numbers? References? | |
| May 29, 2011 at 16:16 | comment | added | atdre | @Graham: I don't think that they switched to Xbox because of Sony's brand. They did it because Sony's network was unavailable. Availability is part of the CIA triad. It is the one massive reason that most companies need security. | |
| May 28, 2011 at 10:42 | comment | added | user185 | @Rakkhi so how many people have thrown their PS3s away and bought Xbox 360s because of the PSN #fail? I'm not saying you're incorrect, I'm just skeptical until I see the data (e.g. TJ Maxx actually had a better quarter after their DSS #fail than before). | |
| May 28, 2011 at 8:10 | comment | added | Rory Alsop♦ | @atdre - we are nihilists. We believe in nothing <The Big Lebowski) :-) | |
| May 28, 2011 at 3:34 | comment | added | atdre | @Rory: I don't believe in the stock market either | |
| May 27, 2011 at 8:39 | comment | added | Rakkhi | @atre "I do not believe in brand/reputation damage, especially not as "hard costs"." Wow ok. Never heard of Anderson after one image of shredding files....Totally disagree on that point, it is the one massive reason most companies need security. Industry vertical does matter e.g. RSA incident will cost them more than Sony or TK Maxx but man.. | |
| May 26, 2011 at 23:15 | comment | added | Rory Alsop♦ | There is something to be said for cumulative brand damage over multiple incidents - see some banks currently, and Sony, as examples - share price is now being hit. | |
| May 26, 2011 at 20:29 | comment | added | atdre | @Rakkhi: No, it's not a problem (see my references). You use your own data. I do not believe in brand/reputation damage, especially not as "hard costs". See the Gordon-Loeb Model -- cyber.umd.edu/research/economics.html | |
| May 26, 2011 at 15:50 | comment | added | Rakkhi | @atdre isn't the big problem the predicable number of incidents? what is that in security? You could use the Verizon data breech report but that is biased again to where Verizon / secret service has been called in. Also how do you value your assets? e.g. what is 37% of your reputation? There are some brand value reports for big companies but not for most. How did you get the 37% number anyway? | |
| May 26, 2011 at 14:25 | history | answered | atdre | CC BY-SA 3.0 |