Home » Security Leadership » Metrics/Budgets

Value Made Visible

How American Water's Bruce Larson uses a simple metric to build bridges with business partners and justify security spending at the same time

Other times, the hard-to-quantify costs simply remain separate, a footnote. In those cases, Larson can present a Value Protection metric with a note attached that says, "We've left perception costs out of this, but we expect to incur some costs there." Larson must keep a careful balance between leaving out the costs that are wild guesses (because they will create a misleading ratio) and including all costs that can be assigned with some accuracy (because they will increase the confidence in the ratio).

In any case, Larson says, it's important to define event costs consistently with all business process owners so that comparisons are valid. If, for example, American Water defined response costs differently than RWE Thames, then the comparison of man-hours for recovery, and eventually this implementation of the Value Protection ratio, would be invalid.

Savvy security professionals will see Larson's Value Protection metric for what it is: a simple, smart approach to risk analysis. But Larson has larger ambitions for Value Protection. "That's why I'm sharing it," he says. "We need to start sharing our data. We need to share what we know about ourselves. And we need to accumulate a good set of historical data resulting from events like Welchia."

From that, Larson can see in his mind's eye what he calls the "ultimate evolution" of Value Protection, "when cross-discipline industry organizations have these metrics. Underwriters could supply the metrics and tell us what's 'good' and what's 'not good' security. Because," he says, "ultimately we'd love to transfer this risk instead of just mitigate it and own it. There needs to be that third option of transference. We have insurance for everything else. There's M&A insurance, IPO insurance.

"Why not real, scientific information security insurance? That should be our goal."