Assessing Cyber Security Investment Options: An
PT
Published · 24 slides · 0 views
1 / 1
Description
Assessing Cyber Security Investment Options: An Economic View Xian Sun Assistant Professor in Finance Carey Business School Johns Hopkins University 0 DRAFT Module outline Basic finance skills in decision making: Time value of money Net
Related Topics
Share
Embed code
Download this presentation From Below
"Assessing Cyber Security Investment Options: An" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
01
Assessing Cyber Security Investment Options: An Economic View Xian Sun
Assistant Professor in Finance
Carey Business School
Johns Hopkins University 0 DRAFT<br>
Assistant Professor in Finance
Carey Business School
Johns Hopkins University 0 DRAFT<br>
02
Module outline Basic finance skills in decision making:
Time value of money
Net Present Value
Free Cash Flows
Decision making framework in cyber security investment projects:
Benefits
Costs
Value-at-Risk model
Case study: 2013 Target data breach
Identify the costs of 2013 Target data breach and benefits of its cyber investment. 1 DRAFT<br>
Time value of money
Net Present Value
Free Cash Flows
Decision making framework in cyber security investment projects:
Benefits
Costs
Value-at-Risk model
Case study: 2013 Target data breach
Identify the costs of 2013 Target data breach and benefits of its cyber investment. 1 DRAFT<br>
03
Overview Firms should undertake a project when and only when it creates value.
The challenges in evaluating cyber securities projects are that their incremental values have uncertainties and therefore are hard to measure economically.
This module is designed to introduce the basic finance skills and framework used in decision making, apply the framework to a real world case and discuss what a traditional financial framework can do for security spending decisions. 2 DRAFT<br>
The challenges in evaluating cyber securities projects are that their incremental values have uncertainties and therefore are hard to measure economically.
This module is designed to introduce the basic finance skills and framework used in decision making, apply the framework to a real world case and discuss what a traditional financial framework can do for security spending decisions. 2 DRAFT<br>
04
Learning objectives Introduce time value of money;
Understand how to use NPV (net present value) rule to make investment decisions;
Introduce the benefits and costs associated with cyber security investment decisions;
Learn VaR (Value-at-risk) and its application in cyber security investment decision making;
Apply the benefit-cost framework to a real world cyber event;
Discuss the challenges in applying a traditional economic model in cyber security decisions. 3 DRAFT<br>
Understand how to use NPV (net present value) rule to make investment decisions;
Introduce the benefits and costs associated with cyber security investment decisions;
Learn VaR (Value-at-risk) and its application in cyber security investment decision making;
Apply the benefit-cost framework to a real world cyber event;
Discuss the challenges in applying a traditional economic model in cyber security decisions. 3 DRAFT<br>
05
Shift in Cyber security investment decisions from technical risk to business risk More companies treat cyber security as critical business decisions.
Currently, about 10% of U.S. CISOs (chief information security officers) report to CFOs (chief financial officers) instead of to CIOs (chief information officers) and the percentage is increasing (Source: WSJ).
“CFOs make cyber security decisions using the same approach they use across other risk domains. Their focus is on how cyber investments impact the bottom line by preventing losses due to risks, or increasing revenue …”, Steven Grossman, VP of Bay Dynamics. 4 DRAFT<br>
Currently, about 10% of U.S. CISOs (chief information security officers) report to CFOs (chief financial officers) instead of to CIOs (chief information officers) and the percentage is increasing (Source: WSJ).
“CFOs make cyber security decisions using the same approach they use across other risk domains. Their focus is on how cyber investments impact the bottom line by preventing losses due to risks, or increasing revenue …”, Steven Grossman, VP of Bay Dynamics. 4 DRAFT<br>
06
Basic Finance Skills in Decision Making_Time value of money Time value of money
Financial decisions often require combining cash flows or comparing values. We use interest rate to move money forward or backward in time. 5 DRAFT<br>
Financial decisions often require combining cash flows or comparing values. We use interest rate to move money forward or backward in time. 5 DRAFT<br>
07
The 1st Rule of Time Travel A dollar today and a dollar in one year are not equivalent.
It is only possible to compare or combine values at the same point in time.
Which would you prefer: A gift of $1,000 today or $1,210 at a later date?
To answer this, you will have to compare the alternatives to decide which is worth more. One factor to consider: How long is “later?” 6 DRAFT<br>
It is only possible to compare or combine values at the same point in time.
Which would you prefer: A gift of $1,000 today or $1,210 at a later date?
To answer this, you will have to compare the alternatives to decide which is worth more. One factor to consider: How long is “later?” 6 DRAFT<br>
08
The 2nd Rule of Time Travel To move a cash flow forward in time, you must compound it.
Suppose you have a choice between receiving $1,000 today or $1,210 in two years. You believe you can earn 10% on the $1,000 today, but want to know what the $1,000 will be worth in two years. FV = C * (1+r)n 7 DRAFT<br>
Suppose you have a choice between receiving $1,000 today or $1,210 in two years. You believe you can earn 10% on the $1,000 today, but want to know what the $1,000 will be worth in two years. FV = C * (1+r)n 7 DRAFT<br>
09
The 3rd Rule of Time Travel To move a cash flow backward in time, we must discount it.
Present Value of a Cash Flow 8 DRAFT<br>
Present Value of a Cash Flow 8 DRAFT<br>
10
Basic Finance Skills in Decision Making_Net present value Calculating the NPV of future cash flows allows us to evaluate an investment decision.
Net Present Value compares the present value of cash inflows (benefits) to the present value of cash outflows (costs).
NPV = PV (all cash flows from the project) = PV (Benefits) – PV (Costs)
Only projects with positive NPV will be accepted. 9 DRAFT<br>
Net Present Value compares the present value of cash inflows (benefits) to the present value of cash outflows (costs).
NPV = PV (all cash flows from the project) = PV (Benefits) – PV (Costs)
Only projects with positive NPV will be accepted. 9 DRAFT<br>
11
Basic Finance Skills in Decision Making_NPV Rules When evaluating the cash flows related with a project, only the incremental earnings should matter.
Incremental Earnings
The amount by which the firm’s earnings are expected to change as a result of the investment decision. 10 DRAFT<br>
Incremental Earnings
The amount by which the firm’s earnings are expected to change as a result of the investment decision. 10 DRAFT<br>
12
Examples of incremental cash flows Opportunity Cost :The value a resource could have provided in its best alternative use. For example, if an equipment will be housed in an existing lab, the opportunity cost of not using the space in an alternative way (e.g., renting it out) must be considered.
Project Externalities : Indirect effects of the project that may affect the profits of other business activities of the firm. Cannibalization is when sales of a new product displaces sales of an existing product. 11 DRAFT<br>
Project Externalities : Indirect effects of the project that may affect the profits of other business activities of the firm. Cannibalization is when sales of a new product displaces sales of an existing product. 11 DRAFT<br>
13
Examples of cash flows Not included in investment decision making Sunk costs are costs that have been or will be paid regardless of the decision whether or not the investment is undertaken. Sunk costs should not be included in the incremental earnings analysis.
Fixed Overhead Expenses: Typically overhead costs are fixed and not incremental to the project and should not be included in the calculation of incremental earnings. 12 DRAFT<br>
Fixed Overhead Expenses: Typically overhead costs are fixed and not incremental to the project and should not be included in the calculation of incremental earnings. 12 DRAFT<br>
14
Basic Finance Skills in Decision Making_NPV and free cash flows Therefore, what really matters in any investment decision is the amount of the incremental cash flows created by a project, or it is also referred to as free cash flow. 13 DRAFT<br>
15
Illustrate free cash flows in cyber security spending The free cash flow concept helps us value cyber security investment.
For example, even if a cyber security project that requires initial investment but does not create cash inflows at all, the NPV analysis may still yield positive value if the cyber project reduces the existing cost of cyber breaches. The reduction in the existing cost create incremental value to the firm by releasing resources that would have been consumed without undertaking the cyber project. 14 DRAFT<br>
For example, even if a cyber security project that requires initial investment but does not create cash inflows at all, the NPV analysis may still yield positive value if the cyber project reduces the existing cost of cyber breaches. The reduction in the existing cost create incremental value to the firm by releasing resources that would have been consumed without undertaking the cyber project. 14 DRAFT<br>
16
Understanding the Benefits and Costs of cyber security projects Benefits:
Direct:
Reduced opportunity costs (positive incremental value): the investment in cyber security reduce the existing cost of cyber breaches.
Stability of the operating system and avoid loss from system downtime.
Indirect:
Stronger partnership with suppliers.
Attract more customers.
Increase the value of the whole value chain.
More sympathy from shareholders at the event of a cyber security attack. 15 DRAFT<br>
Direct:
Reduced opportunity costs (positive incremental value): the investment in cyber security reduce the existing cost of cyber breaches.
Stability of the operating system and avoid loss from system downtime.
Indirect:
Stronger partnership with suppliers.
Attract more customers.
Increase the value of the whole value chain.
More sympathy from shareholders at the event of a cyber security attack. 15 DRAFT<br>
17
Understanding the Benefits and Costs of cyber security projects Costs:
Direct Costs: investment in systems, training employees and/or outsourcing
Indirect costs in the event of cyber security concerns:
Legal penalties;
Loss of customers;
Loss of partnerships/suppliers;
Impair firm reputation and stock value slides;
Spillover effects that impacts the future prospect of the whole industry. 16 DRAFT<br>
Direct Costs: investment in systems, training employees and/or outsourcing
Indirect costs in the event of cyber security concerns:
Legal penalties;
Loss of customers;
Loss of partnerships/suppliers;
Impair firm reputation and stock value slides;
Spillover effects that impacts the future prospect of the whole industry. 16 DRAFT<br>
18
Indirect costs Note that both the indirect benefits costs may depend on the likelihood of a cyber security event, which may be inversely impacted by the amount directly invested in cyber security.
Therefore, firms need to allocate resources between these two options: one requires to sacrifice resources now, and one requires later.
The supplementary relationship between spending now or later may be magnified or moderated by broader factors, such as the industry vulnerability to cyber security events, the advances of information technology at industry level, the connectedness among the firms in the industry. 17 DRAFT<br>
Therefore, firms need to allocate resources between these two options: one requires to sacrifice resources now, and one requires later.
The supplementary relationship between spending now or later may be magnified or moderated by broader factors, such as the industry vulnerability to cyber security events, the advances of information technology at industry level, the connectedness among the firms in the industry. 17 DRAFT<br>
19
Evaluating cyber security investment by value-at-risk approach VaR (Value-at-risk) is a prevalent risk management framework in financial industries where firms simulate a distribution of returns on certain assets/investments and measure the left tail risk (negative returns).
Because of the particular uncertain outcome of cyber security project, VaR helps us understand the incremental effect of cyber projects on firm’s existing risk.
Again, it is the incremental effect on the current risk management that matters. That is, does cyber project improve the left tail risk and by how much. 18 DRAFT<br>
Because of the particular uncertain outcome of cyber security project, VaR helps us understand the incremental effect of cyber projects on firm’s existing risk.
Again, it is the incremental effect on the current risk management that matters. That is, does cyber project improve the left tail risk and by how much. 18 DRAFT<br>
20
VAR VaR analysis would provide a good idea of the estimated economic losses given the occurrence and therefore suggest the “cushion” needed to cover the estimated losses or certain amount of the unexpected losses. More and more U.S. CFOs who undertake the role of supervising cyber security investment decisions have started adopting VaR approach in estimating the occurrence of such negative events and the dollar amount at stake upon the occurrence. 19 DRAFT<br>
21
limitations of VaR Method The estimation of the distribution of possible losses is data driven. It would be difficult to generate a meaningful VaR analysis with sparse data availability.
The distribution estimated using historical data may not be a good indicator for future possible losses.
Both concerns may magnify when applying to cyber security events. 20 DRAFT<br>
The distribution estimated using historical data may not be a good indicator for future possible losses.
Both concerns may magnify when applying to cyber security events. 20 DRAFT<br>
22
Apply the benefit-cost framework to a real world cyber event Target 2013 Data Breach
In 2013, Target Corporation’s (Target) security and payment system was breached, compromising 40 million credit and debit card numbers, along with 70 million addresses, phone numbers and other personal information.
Read the provided Target packages about the articles of Target data breach and summarize the costs of the 2013 data breach and all the benefits of Target’s reaction to make new investment in cyber security. 21 DRAFT<br>
In 2013, Target Corporation’s (Target) security and payment system was breached, compromising 40 million credit and debit card numbers, along with 70 million addresses, phone numbers and other personal information.
Read the provided Target packages about the articles of Target data breach and summarize the costs of the 2013 data breach and all the benefits of Target’s reaction to make new investment in cyber security. 21 DRAFT<br>
23
Suggested summary of benefits and costs Available to students after class discussion 22 DRAFT<br>
24
Discuss the challenges in applying a traditional economic model in cyber security decisions. 23 DRAFT<br>