Home » Security Leadership » Metrics/Budgets

Build Business Cases Like Steel Pistons!

Seven quick-and-dirty tricks for using numbers to strengthen your case

That's a surefire way to turn some heads, considering where Saenz started. And look, ma, no calculus!3| DO Get creativeWe can see you sweating already. Baseline? What baseline? Executives outside of retailand those who are trying to secure IT assets in particularcomplain that if you're not talking about boxes of widgets, it's hard to know where to get that baseline. Sometimes there are industry benchmarks that can help. The Building Owners & Managers Association International, for example, tracks how much money companies are spending on security per rentable square foot each year. But other times, you might have to get more creative.

Ken Pfiel, CSO of Capital IQ, a New York-based financial services technology company that was recently acquired by Standard & Poor's, relies on infosec studies as a starting point. He says that if you know, say, that a certain virus cost companies $X billion, then you can extrapolate how much money you are saving the company. That'll get you to a little something called a return on security investment (ROSI). (Hint: Your CFO will like that.)4| DON'T Get too creativeBe careful about the numbers you begin with, though, or you'll gain a rep as a FUD-meister. (That's fear, uncertainty and doubt, for those of you who've managed to keep the words out of your vocabulary.) A lot of the vendor-driven research has its own game plan: getting you in the door and your pocketbook open.

"You're always left to your own interpretation when using numbers that have been put out there," Pfiel warns. "A lot of [studies publicized by vendors] may be scare tactics and things that are trying to draw a revenue, but there are also some solid facts behind that. I think a good rule of thumb is the old adage: Believe half of what you see and none of what you hear. If you cut those numbers in half, you've eliminated your margin of error."

Maybe you're being overly conservative using this adage, he says, "but any numbers, as long as you can reference them, are helpful."5| DO Get people to look at youJust because you have some solid numbers to share, however, doesn't mean they should be the be-all and end-all of your presentation to the board. Far from it. You don't want to blend into the scenery. "In the background on television, when you see [the screen] behind Peter Jennings or Dan Rather or Tom Brokaw, what does it contain?" asks Jerry Weissman, the corporate presentation consultant who wrote Presenting to Win: The Art of Telling Your Story. "It contains two words or four words, or an image and four words, and then they [the newscasters] tell the story." They don't rely on the screen to tell it for them.