Gbitten

This paper by Rainer Böhme and Thomas Nowey is really good. Its first part cleverly summarizes the main financial decision methods for information security investments like ALE (Annual Loss Expectancy), some ROSI (Return on Security Investment) variations and NVP (Net Present Value). In addition, it also analyzes some weakness of these methods.

The second part describes some security metrics based on market mechanisms. This subject is very interest and deserves more of my attention in the future. By the way, this paper was originally a chapter of “LNCS 4909 Dependability Metrics”.

Labels: Economics, Metric, Security Management

posted by Gustavo Araujo Bittencourt  # 7:37 AM