Return On Security Investment (ROSI) a practical quantitative model

Proceedings of the 3rd International Workshop on Security in Information Systems, WOSIS 2005, in Conjunction with ICEIS 2005

Volumn , Issue , 2005, Pages 239-252

  Sonnenreich, Wes ^a   Albanese, Jason ^a   Stout N, Bruce ^a  

^a SageSecure   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BENCHMARKING METHODOLOGY; BENCHMARKING TOOLS; DECISION MAKERS; PRACTICAL EXPERIENCE; QUANTITATIVE MODELS; RETURN ON SECURITY INVESTMENTS; SECURITY STRATEGIES; WORK-IN-PROGRESS;

BENCHMARKING; INFORMATION SYSTEMS;

SECURITY OF DATA;

EID: 33750953854     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (18)

1. Information Security Forum, "Standard of Good Practice," See: http://www.isfsecu.ritystandard.eom/index-ns.htm.
2. ISO 17799
3. NSW Government Office of Information and Communications Technology, "Information Security Guideline," June 2003. See: http://www.oict.nsw. gov.au/
4. "Security Metrics Guide for Information Technology Systems Special," Publication 800-55 US National Institute of Standards and Technology Computer Security Research Centre, 2002. See: csrc.nist.gov/ publications/nistpubs/800-55/sp800-55.pdf.
5. "The Return on Investment for Information Security" See: http://www.oit.nsw.gov.au/content/7.1.15.ROSI.asp
6. "The Return on Investment for Information Security" See: http://www.cisco.com/en/US/netso1/ns340/ns394/ns171/networking-solutions- audience-busmess-benefit09186a008010e490.html
7. Calculated Risk Scott Berinato in CSO Magazine, December 2002. See: www.csoonline.com/read/120902/calculate.html
8. Security Attribute Evaluation Method: A Cost-Benefit Approach Shawn A. Butler, Computer Science Department, Carnegie Mellon University, 2002. See: www2.cs.cmu.edu/-Compose/ftp/SAEM-(Butler)-ICSE-2002.pdf
9. Cost-Benefit Analysis for Network Intrusion Detection Systems Huaqiang Wei, Deborah Frinke et al. Centre for Secure and Dependable Software, University of Idaho. In Proceedings of the 28th Annual Computer Security Conference October 2001. See: wwwcsif.cs.ucdavis.edu/-balepin/new-pubs/costbenefit.pdf
10. A Guide to Security Risk Management for Information Technology Systems Published by the Government of Canada Communications Security Establishment, 1996. See: www.cse.dnd.ca/en/documents/knowledge-centre/publications/manuals/ mg2e.pdf
11. Executives Need to Know: The Arguments to Include in a Benefits Justification for Increased Cyber Security Spending Timothy Braithwaite in Information Systems Security, Auerbach Publications, September/October 2001
12. Seeking Security Scorecards Chris King, Meta Group (File: 9377), Dec 2001
13. Analysis of Return on Investment for Information Security: Steve Foster and Bob Pad, Getronics.
14. VPN Security and Return on Investment: RSA Solution White Paper
15. Finally, a Real Return on Security Spending CIO Magazine, 15 February 2002; See: www.cio.com/archive/021502/security.html.
16. Secure Business Quarterly, Special Issue on Return on Security Investment, Quarter 4, 2001. See:www.sbq.com/sbq/rosi/index.html
17. Computer World ROI Knowledge Centre at www.computerworld.com/ managementtopics/roi
18. Primer on Cost-Effectiveness Analysis published by the American College of Physicians' Effective Clinical Practice, September/October 2000. See: www.acponline.org/journals/ecp/sepoct00/primer.htm