Part of the problem, I believe, is the vocabulary and mindset. Most infosec pros are well versed in infosec terms but some get well out of depth when speaking or writing on finances and economics. It reminds me of the misunderstandings that occur when journalists interview scientists: when the latter say that such-and-such “could happen”, the former report it as forgone conclusion that such-and-such *will* happen. The issue of ‘return’ meaning ‘profit’ to some and ‘lower net costs’ to others is a classic example.

I’m a bit puzzled at your paper on “virtual trust”. The concept of security as a business enabler (giving management the confidence to run with business processes that would otherwise be too risky) has been around for ages, and I see no need to give it a shiny new name – or am I missing something?

Anyway, thanks for contributing to the debate. We’ve been discussing ROI on CISSPforum for a couple of weeks, again, and we’re still no nearer a genuine consensus. Give it a few months and the living corpse of another undead discussion will return to haunt us.

Kind regards,
Gary

Go forth and do good things,
Cutaway