Assessing Cyber Security Investment Options: An

Transcript:Assessing Cyber Security Investment Options: An:
Assessing Cyber Security Investment Options: An Economic View Xian Sun Assistant Professor in Finance Carey Business School Johns Hopkins University 0 DRAFT Module outline Basic finance skills in decision making: Time value of money Net Present Value Free Cash Flows Decision making framework in cyber security investment projects: Benefits Costs Value-at-Risk model Case study: 2013 Target data breach Identify the costs of 2013 Target data breach and benefits of its cyber investment. 1 DRAFT Overview Firms should undertake a project when and only when it creates value. The challenges in evaluating cyber securities projects are that their incremental values have uncertainties and therefore are hard to measure economically. This module is designed to introduce the basic finance skills and framework used in decision making, apply the framework to a real world case and discuss what a traditional financial framework can do for security spending decisions. 2 DRAFT Learning objectives Introduce time value of money; Understand how to use NPV (net present value) rule to make investment decisions; Introduce the benefits and costs associated with cyber security investment decisions; Learn VaR (Value-at-risk) and its application in cyber security investment decision making; Apply the benefit-cost framework to a real world cyber event; Discuss the challenges in applying a traditional economic model in cyber security decisions. 3 DRAFT Shift in Cyber security investment decisions from technical risk to business risk More companies treat cyber security as critical business decisions. Currently, about 10% of U.S. CISOs (chief information security officers) report to CFOs (chief financial officers) instead of to CIOs (chief information officers) and the percentage is increasing (Source: WSJ). “CFOs make cyber security decisions using the same approach they use across other risk domains. Their focus is on how cyber investments impact the bottom line by preventing losses due to risks, or increasing revenue …”, Steven Grossman, VP of Bay Dynamics. 4 DRAFT Basic Finance Skills in Decision Making_Time value of money Time value of money Financial decisions often require combining cash flows or comparing values. We use interest rate to move money forward or backward in time. 5 DRAFT The 1st Rule of Time Travel A dollar today and a dollar in one year are not equivalent. It is only possible to compare or combine values at the same point in time. Which would you prefer: A gift of $1,000 today or $1,210 at a later date? To answer this, you will