There are two camps when it comes to demonstrating ROI for security initiatives. One camp believes it is absolutely impossible, ridiculous and suggests you should not even try. The other camp believes it is not only possible but important and absolutely necessary. Somewhere in the middle is a plausible methodology for demonstrating ROI for many security initiatives, including penetration testing.

In part one of this series we discussed the necessity of understanding financial terms in relationship to justifying security expenditures. We also discussed the idea of aligning security initiatives with productivity enhancing and revenue generating initiatives. In particular, we used the example of a VPN (Virtual Private Network) initiative and the example of a Pen Test piggybacked on a Web-based project initiative. For the purpose of this series we are going to focus on demonstrating ROI specifically for penetration testing, however it is important to understand that the ROSI (return on security investment) discussion can apply to to a broader range of security services and products.

[ Read more ]

Related items

• News: Demonstrating ROI for penetration testing (part one) (25 July 2003)
• Review: Hack Attacks Revealed: A Complete Reference for UNIX, Windows, and Linux with Custom Security Toolkit 2/e (24 April 2003)
• Review: Hack Attacks Testing: How to Conduct Your Own Security Audit (1 April 2003)
• Review: Hack I.T. - Security Through Penetration Testing (18 August 2002)