Lesson 1.71: Spending a security budget for the most risk reduction
Security always has more proposals than money. Comparing them on the same scale helps: how much expected annual loss (ALE, from Intro 201) each one removes, against what it costs. Return on security investment (ROSI) puts that in one number. It doesn't replace judgement (estimates are rough, some controls are mandatory), but it stops the loudest proposal from winning by default. In the lab you rank seven proposals, find one that costs more than the loss it prevents, fill a fixed budget and report what the money buys.
18 min
You will learn to
- Compare proposals on cost and ALE reduction
- Compute return on security investment (ROSI)
- Spot proposals that cost more than they save
- Fill a fixed budget by value
- Explain the limits of the numbers
Key terms
- ALE reduction
- How much expected annual loss a control removes.
- ROSI
- Return on security investment: (ALE reduction - cost) / cost.
- Greedy selection
- Taking options in order of value per cost until the budget runs out.
- Mandatory control
- A control required by law, regulation or contract regardless of its ratio.
← Asset inventory and data classification · All lessons · Board oversight and what you disclose about it →