Demonstrating ROI for penetration testing (part two)

Tuesday, 5 August 2003, 1:26 PM EST

There are two camps when it comes to demonstrating ROI for security initiatives. One camp believes it is absolutely impossible, ridiculous and suggests you should not even try. The other camp believes it is not only possible but important and absolutely necessary. Somewhere in the middle is a plausible methodology for demonstrating ROI for many security initiatives, including penetration testing.

In part one of this series we discussed the necessity of understanding financial terms in relationship to justifying security expenditures. We also discussed the idea of aligning security initiatives with productivity enhancing and revenue generating initiatives. In particular, we used the example of a VPN (Virtual Private Network) initiative and the example of a Pen Test piggybacked on a Web-based project initiative. For the purpose of this series we are going to focus on demonstrating ROI specifically for penetration testing, however it is important to understand that the ROSI (return on security investment) discussion can apply to to a broader range of security services and products.

[ Read more ]

Related items




Spotlight

Attackers use reflection techniques for larger DDoS attacks

Posted on 17 April 2014.  |  Instead of using a network of zombie computers, newer DDoS toolkits abuse Internet protocols that are available on open or vulnerable servers and devices. This approach can lead to the Internet becoming a ready-to-use botnet for malicious actors.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Apr 18th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //